Mailing-List: contact dev-help@ofbiz.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ofbiz.apache.org
MIME-Version: 1.0
In-Reply-To: <32b902ce-0ed8-9ee9-8a10-e05752ba3011@les7arts.com>
References: <5293a771-d95c-ac85-8472-7152776e7b42@nereide.fr>
 <c645d6b6-ac85-b3ec-beab-004bc78c1e83@nereide.fr> <df49a3f4-e239-fa3f-5c7a-63e2785f9044@les7arts.com>
 <7e44b7d2-758b-30c1-06ad-e7627b5cafb4@nereide.fr> <e991e9f7-294a-af64-1f99-313fd834b4e3@apache.org>
 <CADPkm84DcSmRp4CPzg-WtTmYzVa1sumc9KSJ=P4uX+O361YPxA@mail.gmail.com>
 <fb37f92a-f8ae-f2e1-71c7-a5ae48605a32@les7arts.com> <CALzBqrZUcvMa5uoEjgnAOJ-Q29E7eN4rSdNP3e2nT49+XtGEPQ@mail.gmail.com>
 <12713d6b-7566-cedd-ca47-2009abcfe52a@les7arts.com> <32b902ce-0ed8-9ee9-8a10-e05752ba3011@les7arts.com>
From: Taher Alkhateeb <slidingfilaments@gmail.com>
Date: Wed, 7 Sep 2016 18:11:54 +0300
Message-ID: <CAFqjAi1ymUGB0SeZqUhASf0tCpk+K=uTMxwZUnZ7bW5E=0H02A@mail.gmail.com>
Subject: Re: Taking a decision on remaining Jars in OFBiz
To: OFBIZ Development Mailing List <dev@ofbiz.apache.org>
Content-Type: multipart/alternative; boundary=001a11470bb869d075053bec55a7
archived-at: Wed, 07 Sep 2016 15:12:02 -0000

--001a11470bb869d075053bec55a7
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Jacques,

First of all the ofbizSecure task is gone instead everything calls the
correct jvm arguments by default to fetch notsoserial.

The work to remove notsoserial is almost nothing. You just to remove a few
jvm args and that's it. Even if you don't remove the jvm args nothing
happens because it will just ignore it as missing from the classpath.

Taher Alkhateeb

On Sep 7, 2016 5:48 PM, "Jacques Le Roux" <jacques.le.roux@les7arts.com>
wrote:

> Huho, I was too fast on this. Currently the Gradle "ofbizSecure" tasks
> depends on the notsoserial-1.0-SNAPSHOT.jar
>
> So this would need more work and w/o answers from them I suspect they wil=
l
> not publish the jar.
>
> Now it's a serious security but not OOTB. So I see 2 possibilities.
>
> 1. Ask the ASF for a derogation (after all it's a Java issue not an OFBiz
> one)
> 2. Do what I said before AND change the Gradle "ofbizSecure" tasks
>
> Opinions?
>
> Jacques
>
>
> Le 07/09/2016 =C3=A0 14:01, Jacques Le Roux a =C3=A9crit :
>
>> Yes I see no problems with that. I just need to add directions for users
>> before. I'll then remove the jars... very soon...
>>
>> Jacques
>>
>>
>> Le 07/09/2016 =C3=A0 13:09, Jacopo Cappellato a =C3=A9crit :
>>
>>> Jacques, any news from notsoserial?
>>> If not, I think we can proceed by (temporarily) removing the jars until
>>> they will publish the jar.
>>>
>>> Regards,
>>>
>>> Jacopo
>>>
>>> On Sat, Aug 20, 2016 at 11:12 AM, Jacques Le Roux <
>>> jacques.le.roux@les7arts.com> wrote:
>>>
>>> Yes that's what I proposed also, I will try that before the worse
>>>> solution
>>>> as Taher called them, would you help?
>>>>
>>>> Jacques
>>>>
>>>>
>>>>
>>>> Le 20/08/2016 =C3=A0 08:32, Pierre Smits a =C3=A9crit :
>>>>
>>>> Hi Jacques,
>>>>>
>>>>> Why not try to convince the people behind notsoserial to have them pu=
sh
>>>>> the
>>>>> library to maven central and/or jpublish? In stead of this community
>>>>> doing
>>>>> the work?
>>>>>
>>>>> Best regards,
>>>>>
>>>>>
>>>>> Pierre Smits
>>>>>
>>>>> ORRTIZ.COM <http://www.orrtiz.com>
>>>>> OFBiz based solutions & services
>>>>>
>>>>> OFBiz Extensions Marketplace
>>>>> http://oem.ofbizci.net/oci-2/
>>>>>
>>>>>
>>>>>
>>
>>
>

--001a11470bb869d075053bec55a7--