Re: How secure is invoking a single mojo?

2022-12-28 Thread Aldrin Leal
Tamas, Thanks for your idea. If I wanted to resolve from reading a pom file from scratch, where you'd point me at (thinking MavenXpp3Reader and friends perhaps?). -- -- Aldrin Leal, / https://aldrinleal.link On Fri, Dec 16, 2022 at 4:17 PM Tamás Cservenák wrote: > You can write a si

Re: How secure is invoking a single mojo?

2022-12-16 Thread Aldrin Leal
Thanks Michael, indeed this can be better worded What about? How to programatically list a poms dependencies (incl transitive) without the risk of running untrusted/unauthorized code? -- -- Aldrin Leal, / https://aldrinleal.link On Fri, Dec 16, 2022 at 3:55 PM Michael Osipov wrote: >

How secure is invoking a single mojo?

2022-12-16 Thread Aldrin Leal
files for a given project) the most secure way if you were given this task? Thank you -- -- Aldrin Leal, / https://aldrinleal.link

Re: Silly Saturday idea - If Maven Central were a bunch of Git repos

2017-05-17 Thread Aldrin Leal
thats my point: the golang approach does no magic at all. It simply stores the source code and bases it on a convention. Just the files, and thats it. -- -- Aldrin Leal, / http://about.me/aldrinleal On Wed, May 17, 2017 at 2:38 PM, Paul Hammant wrote: > Aldrin, The blog entry I wrote

Re: Silly Saturday idea - If Maven Central were a bunch of Git repos

2017-05-17 Thread Aldrin Leal
e scope of what to do to avoid abuse. -- -- Aldrin Leal, / http://about.me/aldrinleal On Wed, May 17, 2017 at 1:49 PM, Paul Hammant wrote: > There is that, yes. And Git's general upper limits which are subject of "I > heard of a team that had a corruption at 2GB". I'

Re: Silly Saturday idea - If Maven Central were a bunch of Git repos

2017-05-17 Thread Aldrin Leal
Still, once github gets an outage, our repositories are basically 'left-padded' (taken offline) -- -- Aldrin Leal, / http://about.me/aldrinleal On Wed, May 17, 2017 at 1:35 PM, Paul Hammant wrote: > Aldrin - https://github.com/paul-hammant/mc-xs-all - no large files added > t

Re: Silly Saturday idea - If Maven Central were a bunch of Git repos

2017-05-17 Thread Aldrin Leal
Just a friendly reminder that git is not optimized for large files (for this, they made git-lfs). Plus, when you do checkout a git repo, there's no binary diffs - so if you've got plenty of releases, you'll be wasting a lot of space/time in terms of transmission and storage. --

Re: Silly Saturday idea - If Maven Central were a bunch of Git repos

2017-05-14 Thread Aldrin Leal
This is quite similar to what "go get" does to golang. I'd say its worth a try On May 14, 2017 09:28, "Paul Hammant" wrote: > Article updated to eliminate misunderstandings and talk about a different > index for 'maven central' too. > > - ph > > On Sat, May 13, 2017 at 3:04 PM, Paul Hammant wro

Re: Publish Maven releases on SDKMAN!

2017-04-16 Thread Aldrin Leal
just fyi: github releases has an atom feed. https://github.com/apache/maven/releases.atom -- -- Aldrin Leal, / http://about.me/aldrinleal On Sun, Apr 16, 2017 at 4:49 AM, Marco Vermeulen wrote: > Hi Heinz, > > On Sun, 16 Apr 2017 at 08:41 Karl Heinz Marbaise > wrote: > > &

Re: Publish Maven releases on SDKMAN!

2017-04-16 Thread Aldrin Leal
Ironically, I've ported nvm (for node), but for Maven <https://github.com/ingenieux/mvm>, but ended up using sdkman later. I wonder if it would be interesting to have a service to generate webhooks and rss feeds for new versions/releases on github and apache overall. -- -- Aldrin Le

Re: Thoughts on MR-Jar support in Maven

2017-03-24 Thread Aldrin Leal
Wouldn't preprocessing help? https://blog.jooq.org/2016/03/01/how-to-support-java-6-8-9-in-a-single-api/ -- -- Aldrin Leal, / http://about.me/aldrinleal On Fri, Mar 24, 2017 at 11:01 AM, Andreas Sewe < s...@st.informatik.tu-darmstadt.de> wrote: > Hi, > > > I would have

Re: Requesting a single Monorepo enhancement for Maven

2017-01-23 Thread Aldrin Leal
Actually, I always wondered if it was interesting to have a tool to allow the modification of POM files from Command Line. Like setting a property, adding a dependency and/or, as you exposed, changing modules. -- -- Aldrin Leal, / http://about.me/aldrinleal On Tue, Jan 24, 2017 at 12:05 AM

Re: [jira] [Closed] (MWAR-350) Add Skip Parameter to Skip the process

2016-01-25 Thread Aldrin Leal
There are cases where one could use a profile to build a custom assembly of the war (say, like with jetty runner to run under a given paas), and attaching just the relevant classes / assets, thus saving time. -- -- Aldrin Leal, / http://about.me/aldrinleal On Mon, Jan 25, 2016 at 2:51 PM

Re: Jekyll experiment

2015-03-19 Thread Aldrin Leal
JBake supports both markdown and adoc btw :) -- -- Aldrin Leal, Master your EC2-fu! Get the latest ekaterminal public beta http://www.ingenieux.com.br/products/ekaterminal/ On Thu, Mar 19, 2015 at 1:27 PM, Manfred Moser wrote: > I agree with the suggestion to use asciidoctor as a for

Re: Jekyll experiment

2015-03-18 Thread Aldrin Leal
you seen JBake? I wrote its Maven Plugin http://docs.ingenieux.com.br/project/jbake/ -- -- Aldrin Leal, Master your EC2-fu! Get the latest ekaterminal public beta http://www.ingenieux.com.br/products/ekaterminal/ On Thu, Mar 19, 2015 at 12:32 AM, Jason van Zyl wrote: > Anyone interested

Re: Plugin and Maven Metrics

2014-11-21 Thread Aldrin Leal
Seems like Metrics - which is good. But I wonder if any of you guys ever had this need from a plugin development standpoint, and how you addressed it -- -- Aldrin Leal, Master your EC2-fu! Get the latest ekaterminal public beta http://www.ingenieux.com.br/products/ekaterminal/ On Fri, Nov 21

Plugin and Maven Metrics

2014-11-21 Thread Aldrin Leal
nder if there's something Open for Hosting usage for Plugin Developers. If not, could we consider it? (Of course, obeying all privacy statements and stuff) Thanks -- -- Aldrin Leal, Master your EC2-fu! Get the latest ekaterminal public beta http://www.ingenieux.com.br/products/ekaterminal/

Re: SPDX Maven Plugin

2014-01-20 Thread Aldrin Leal
I believe m2eclipse does have some built-in completion for that, and yes, I'm interested -- -- Aldrin Leal, Master your EC2-fu! Get the latest ekaterminal public beta http://www.ingenieux.com.br/products/ekaterminal/ On Mon, Jan 20, 2014 at 2:20 PM, Gary O'Neall wrote: > Greetin

Re: exclude on scope import

2014-01-20 Thread Aldrin Leal
(TL;DR: Use this repo and the versions on your dependencyMgmt: http://version99.qos.ch/) a hack, but works like a charm: http://day-to-day-stuff.blogspot.com.br/2007/10/announcement-version-99-does-not-exist.html -- -- Aldrin Leal, Master your EC2-fu! Get the latest ekaterminal public beta

Re: [DISCUSS] Converting site documentation to Markdown

2013-10-06 Thread Aldrin Leal
There's a great comprehensive list at http://staticsitegenerators.net (btw, I've wrote the jbake-maven-plugin, for jbake - https://github.com/jonbullock/JBake) -- -- Aldrin Leal, Master your EC2-fu! Get the latest ekaterminal public beta http://www.ingenieux.com.br/products/ekaterm

Re: github plugin?

2013-06-03 Thread Aldrin Leal
I wonder if commons-vfs does offer some scm functionality. If it doesn't, it would be just as amazing... -- -- Aldrin Leal, Master your EC2-fu! Get the latest ekaterminal public beta http://www.ingenieux.com.br/products/ekaterminal/ On Mon, Jun 3, 2013 at 10:00 AM, Romain Manni-Bucau

Re: github plugin?

2013-06-03 Thread Aldrin Leal
Wouldn't scm:bootstrap work? -- -- Aldrin Leal, Master your EC2-fu! Get the latest ekaterminal public beta http://www.ingenieux.com.br/products/ekaterminal/ On Mon, Jun 3, 2013 at 6:32 AM, Romain Manni-Bucau wrote: > Hi guys, > > is there any maven github plugin (or any plan)?

Re: [Committer School] I would like to become a committer

2012-07-14 Thread Aldrin Leal
Amazing to hear IBM has adopted Maven -- -- Aldrin Leal, / http://meadiciona.com/aldrinleal On Thu, Jul 12, 2012 at 10:16 AM, Chris Graham wrote: > He He. I'd emailed myself the link from Stephen's twitter blog link at the > same time he's posted this to the list. :-) &

Re: Maven plugin in ant/beanshell

2012-05-12 Thread Aldrin Leal
ant yes Sonatype's Book actually covers it<http://www.sonatype.com/books/mcookbook/reference/ch04s04.html> -- -- Aldrin Leal, / http://meadiciona.com/aldrinleal On Sat, May 12, 2012 at 6:36 PM, Olivier Lamy wrote: > Hi, > Do we still maintain those extractor ? > Do y

Re: 1.5 Annotations for Mojo

2012-04-27 Thread Aldrin Leal
Err, I did upload to central (the 1.4.1 release). http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22br.com.ingenieux.maven.annomojo%22 I wish those could be resolved. JFrog's solution is great and it works like a charm. -- -- Aldrin Leal, / http://meadiciona.com/aldrinleal On Fri, A

Re: substitute a repository with another one in pom.xml?

2012-03-27 Thread Aldrin Leal
You can create a mirror. If you supply the right id, it will simply work. http://maven.apache.org/guides/mini/guide-mirror-settings.html -- -- Aldrin Leal, / http://meadiciona.com/aldrinleal On Tue, Mar 27, 2012 at 11:17 AM, ryenus blatt wrote: > hello, > > in pom.xml, is it po

Best Practices for Proxy and Mojos

2011-09-23 Thread Aldrin Leal
Folks, Just a question: How do you deal with HTTP Proxies into your mojos. Is there an standard or sample source to point me to? Thank you -- -- Aldrin Leal, / http://meadiciona.com/aldrinleal

Re: Julia Antonova/Tumlare is out of office.

2011-02-22 Thread Aldrin Leal
Should I file a bug? The email says she's in vacation but the docs tell me the other way. What to do? I am unable to tell whether or not Julia Antonova Tumlare is in the office/vacation/whatever/ -- -- Aldrin Leal, / http://www.leal.eng.br/mnemetica/ On Tue, Feb 22, 2011 at 5:22 PM, A