Use maven-model to parse the pom.xml and calculate paths #2181
Use maven-model to parse the pom.xml and calculate paths #2181DavyLandman merged 56 commits intomainfrom
Conversation
| var loc = context.pom; | ||
| var artifactLoc = me.getLocation("artifactId"); | ||
| if (artifactLoc != null) { | ||
| loc = IRascalValueFactory.getInstance().sourceLocation(loc , 0, 0, artifactLoc.getLineNumber(), artifactLoc.getColumnNumber(), artifactLoc.getLineNumber(), artifactLoc.getColumnNumber() + 1); |
There was a problem hiding this comment.
This is broken. Source locations with 0,0 as offset and length are never queried for line and column information. The two have to align; as they are intended to be redundant information.
| if (artifactLoc != null) { | ||
| loc = IRascalValueFactory.getInstance().sourceLocation(loc , 0, 0, artifactLoc.getLineNumber(), artifactLoc.getColumnNumber(), artifactLoc.getLineNumber(), artifactLoc.getColumnNumber() + 1); | ||
| } | ||
| messages.append(Messages.warning("I could not resolve dependency in maven repository: " + me.getGroupId() + ":" + me.getArtifactId() + ":" + me.getVersion(), loc)); |
There was a problem hiding this comment.
The use of "I" is a style breach for rascal exceptions and error messages. "Rascal" would be better or "Rascal dependency resolution could not..."
jurgenvinju
left a comment
jurgenvinju
left a comment
There was a problem hiding this comment.
An enormous jump in a short time. It's a lot of code but it makes all our lives a lot simpler.
jurgenvinju
left a comment
jurgenvinju
left a comment
There was a problem hiding this comment.
I didn't see any checksum checking in this code; which is a minimum level of "security" checking for transport correctness and the absence of a man-in-the-middle attack. Of course this is not "secure" in any serious way, but it is a "bottom bar" to jump over.
|
Yes, we'll add checksum support. The PR is still in draft mode, there are about 10 TODOs in the code, and we also have to move the old code away. I will however note that the checksum feature is primarily for detecting corrupted downloads. HTTPS is a better protection against mitm. Especially since the checksums aren't signed, so any MITM can also just rewrite the checksum. |
|
I am running against mvn jar loading issues in rascal-maven-plugin. @rodinaarssen and I think that our lives will be easier once the current PR is merged. Then we have fewer maven-x projects to depend on (and shaded) and we hope that will resolve the complex issues we are running into. Groetjes! See usethesource/rascal-maven-plugin#28 |
…repo-from-settings
…epo-from-settings Retrieve local repo from system property or settings.xml when available
…le-improvement Using a temp file in the same directory as the target
… at the pom level
…scope Implemented system scope resolving
3 participants
This makes us more flexible and allows us to detect errors in the pom, and maybe fix them with projects in the workspace.
It also removes a whole set of maven dependencies that we recently accepted.
todo:
nullversion numbers, that maven somehow resolves