groovy-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Steve Amerige <Steve.Amer...@sas.com>
Subject Remove Version from File Names in Distributions; Add Manifest
Date Tue, 28 Jul 2015 12:26:00 GMT
Hi all,

Every time we take a download of the latest Groovy software, we have to 
do the same task: remove version numbers from file names.  As of the 
2.4.4 release, there are 39 files, shown below, that have the version 
number as part of the distribution.  So, why is this a problem?

  * IDEs cannot silently be updated to use a mandated Groovy version. 
    With 2.4.4 dealing with a zero-day vulnerability issue, we want to
    push this out.  However, the version numbers in files mean that
    users must participate in the updating.  This is not desirable.
  * Links that users might have at the OS level are broken with each new
    release.
  * Version numbers in files makes it more difficult to diff between
    releases.
  * Version numbers as a part of a filename is a specific case of
    metadata as part of file names and, as such, we consider it to be a
    bad practice.  This information is better kept in a file, preferably
    machine readable in a format such as JSON or XML, or in manifest
    files that can be consumed by software that might do version number
    validation as part of security efforts in maintaining code.

It is reasonable that the root directory include a version number. But, 
under that directory, we'd expect that the contents are version-less. A 
good example of a version-less Apache project is the HTTP Server 
<http://httpd.apache.org/download.cgi>. The download is presently a file 
named *httpd-2.4.16.tar.gz*, and when extracted produces a top-level 
directory named *httpd-2.4.16*. No file name contains the version number 
string.  The two files *CHANGES *and *httpd.spec *contain the version 
number string.  I believe that Groovy should follow this example, and 
possibly go one step better by having an explicit manifest file with all 
pertinent metadata for the Groovy release that includes metadata such as 
the version number, license name, checksums of files (for security 
checking), etc.

If you agree, how can we start the process of making this change?

Thanks,
Steve Amerige
Principal Software Developer, Fraud and Compliance Solutions Development
SAS Institute, 100 SAS Campus Dr, Room U3050, Cary, NC 27513-8617



./lib/groovy-sql-2.4.4.jar
./lib/groovy-testng-2.4.4.jar
./lib/groovy-jsr223-2.4.4.jar
./lib/groovy-servlet-2.4.4.jar
./lib/groovy-json-2.4.4.jar
./lib/groovy-jmx-2.4.4.jar
./lib/groovy-test-2.4.4.jar
./lib/groovy-bsf-2.4.4.jar
./lib/groovy-groovydoc-2.4.4.jar
./lib/groovy-nio-2.4.4.jar
./lib/groovy-console-2.4.4.jar
./lib/groovy-xml-2.4.4.jar
./lib/groovy-ant-2.4.4.jar
./lib/groovy-docgenerator-2.4.4.jar
./lib/groovy-groovysh-2.4.4.jar
./lib/groovy-templates-2.4.4.jar
./lib/groovy-swing-2.4.4.jar
./lib/groovy-2.4.4.jar
./apache-groovy-src-2.4.4-incubating.zip
./embeddable/groovy-all-2.4.4-indy.jar
./embeddable/groovy-all-2.4.4.jar
./indy/groovy-json-2.4.4-indy.jar
./indy/groovy-console-2.4.4-indy.jar
./indy/groovy-2.4.4-indy.jar
./indy/groovy-sql-2.4.4-indy.jar
./indy/groovy-jmx-2.4.4-indy.jar
./indy/groovy-servlet-2.4.4-indy.jar
./indy/groovy-xml-2.4.4-indy.jar
./indy/groovy-swing-2.4.4-indy.jar
./indy/groovy-templates-2.4.4-indy.jar
./indy/groovy-ant-2.4.4-indy.jar
./indy/groovy-groovydoc-2.4.4-indy.jar
./indy/groovy-nio-2.4.4-indy.jar
./indy/groovy-test-2.4.4-indy.jar
./indy/groovy-testng-2.4.4-indy.jar
./indy/groovy-groovysh-2.4.4-indy.jar
./indy/groovy-docgenerator-2.4.4-indy.jar
./indy/groovy-bsf-2.4.4-indy.jar
./indy/groovy-jsr223-2.4.4-indy.jar


Mime
View raw message