This is sad news. Alarming? Perhaps.
I guess most people using Ivy will be interested in knowing what's the best alternative to Ivy in the above scenario. I think for Ivy to live on you will need backing from organisations that are vested in using it in their critical projects and cannot afford to move to a different dependency management solution that easily i.e., there's a lock-in to it and additionally these orgs are willing to spare their own developers to maintain the Ivy codebase. On Tue, 22 Aug 2023, 23:52 Vladimir Grabarchuk, <vladc...@javango.net> wrote: > I'd like to second the first two opinions regarding Ant and Ivy. > > I can't say that I'm very familiar with Maven, but from what I know, Ivy is > way superior to it (in my opinion, of course). At the expense of being more > complex, it is terser, customizable and, generally, more capable. > I've used it professionally and personally and am really hopeful it would > not be sacked. I also use IveDE (yes, Eclipse!) and like it quite a lot. > That said, if Ivy continues to live on, it will be pretty simple to use > just it (no IvyDE). > > Sadly, to paraphrase the old adage - fashion over function... > > Regards, > Vladimir > > On Tue, Aug 22, 2023 at 10:29 AM D'Anjou, Martin <mdan...@ciena.com.invalid > > > wrote: > > > Hi, > > > > I'd like to say that we're seriously considering migrating our dependency > > management from Gradle to Ivy because of the lack of branch support in > > Gradle's dependency management, and because we can't find a way to modify > > Gradle's dependency management without also changing its core. We can > > create a custom resolver in Ivy that supports our branch scenarios, and > > apparently without touching its core. > > > > So I hope Ivy has a future. > > > > Martin > > > > -----Original Message----- > > From: s.an...@infass.com.INVALID <s.an...@infass.com.INVALID> > > Sent: Tuesday, August 22, 2023 12:45 PM > > To: ivy-u...@ant.apache.org; dev@ant.apache.org > > Cc: u...@ant.apache.org > > Subject: [**EXTERNAL**] RE: Future of Ivy and IvyDE > > > > Hi, > > > > I can't really discuss how many developers use Ivy and how it is > difficult > > to maintain this project if there is not enough maintainers... > > > > But I can give hints about our usage in our companies: > > * We love "ant", it's for us a clear language syntax that can achieve our > > build processes like we want (and we have a good expertise about it) > > * We had need to move on more modern way to handle dependencies > > * We use ivy for that > > * We have a tight integration inside our custom CI chain and in our IDE. > > We didn't use IvyDE > > > > For sure, we know that "ant" is an older daddy inside the building tools > > area > > > > Ivy have their caveats but we are able to integrate it nicely inside our > > build chain. > > We can have 2 orientations: > > * Move to another build tool and don't use anymore ant > > * Move to another dependency tool usable by ant (at this date, I'm not > > sure, we have real alternative to Ivy) > > * Continue to use Ant + Ivy as long as we can > > > > What I can say : we appreciate the couple of ant + ivy and if possible we > > would love to continue to use them ! > > > > Sébastien. > > > > > > > > -----Message d'origine----- > > De : Stefan Bodewig <bode...@apache.org> Envoyé : mardi 22 août 2023 > > 18:02 À : dev@ant.apache.org Cc : u...@ant.apache.org; > > ivy-u...@ant.apache.org Objet : Future of Ivy and IvyDE > > > > Hi all > > > > before I get to the actual content of this mail: > > > > * I'm cross-posting to three lists but I ask you to keep responses to > > dev@ant only (and join the list if necessary) if you want to respond. > > > > * what I write is my personal opinion and not shared by the PMC as a > > whole. The people on the PMC know I'd be writing a mail like this > > sooner or later, though. > > > > * this is a discussion, not a vote. > > > > phew > > > > I'm not quite sure what I hope to achieve with this email, but I'd like > to > > share my thoughts - and raise the awareness of an elephant being in the > > room. > > > > Over the past year we've had three security vulnerabilities discovered in > > Ivy and it took us much too long to get them fixed. The reason for this > is > > there are no people left around who are familiar with the Ivy code base. > > Most of the remaining developers around Ant are not even users of Ivy - I > > know I am not and have never been. > > > > When it comes to IvyDE things are probably even worse as nobody of us > uses > > Eclipse, either. But then again I've not managed to create an Eclipse > > update site for the last two Ivy releases so maybe nobody is using IvyDE > > anymore anyway. > > > > At least *I* don't see myself digging deeper into the Ivy code base in > > order to fix non-critical bugs. And even for the critical ones I feel we > > are not doing an adequate job. To me it looks as if Ivy and in particilar > > IvyDE are no longer really supported by the Ant project. > > > > TBH I'm not quite sure what to do about this. Even if people stepped up > to > > maintain Ivy, the rest of the Ant devs would probably be unable to verify > > the changes they want to make. At least I certainly am not willing to > > review bigger PRs/patches to a code base I don't understand well. > > > > Personally I believe we should send IvyDE to the Apache Attic > immediately, > > and this likely should be the destination for Ivy sooner or later as > well. > > In the case of Ivy we know there are people who depend on it (hi, Groovy > > folks) so maybe we should give a date in the future until which we are > > providing security bug fixes to give people time to move off. > > > > There may be the need for a dependency management system inside of Ant, > > I'm not sure. If so, then this should be driven by people who feel the > > actual need IMO. There may already be alternatives to Ivy I am not aware > of. > > > > Stefan > > > > >
