If this happens I will donate and admin a new MySDK.org website for the ASF FOSS user group community. I am a major fan of ANT and see IVY and Eclipse IDE bridge as critical. I will set up an email contact for me tonight at r...@mysdk.org if you to reach me in the future. Kind regards. m...@craighunt.us
On Mon, Dec 4, 2023, 10:15 AM Eric Milles <emil...@apache.org> wrote: > Hello, > I was just made aware of this discussion and thought I would share a bit. > We use Ant+Ivy and Eclipse+IvyDE here (Thomson Reuters) to support dozens > of java projects. IvyDE has been working very well for the past many years > and I have only minor issues with it form time to time. Mostly an eclipse > restart and ivy refresh fixes it. So a big "thank you" to all the > maintainers over the years. Ant+Ivy has kept us out of Maven or Gradle > tangles. > > In terms of ongoing maintenance, I have picked up the Groovy Eclipse tools > (https://github.com/groovy/groovy-eclipse) and the Microsoft Team > Explorer tools (https://github.com/microsoft/team-explorer-everywhere), > so I do have experience with Eclipse IDE development. If someone wants > help getting builds run and update sites created and verified, I can help > with that. If there are bugs in IvyDE that need attention, I could help > with that as well. > > It sounds to me like Ivy and IvyDE -- even as a retired subproject -- > should move out from under Apache Ant. Just for my clarity, is Apache Ivy > a top-level project or a subproject of Apache Ant? > > Eric Milles > ASF member/contributor > Apache Groovy PMC member > > On 2023/09/05 16:52:38 Nicolas Lalevée wrote: > > Hi there, > > > > I used to be involved, especially in IvyDE, and as many, my build tools > and my IDE changed (for the IDE I am glad, not for the build tools…). So I > had no particular interest of doing any maintenance, so much that lost > track of the last releases of Ivy, where I could help. Many many thanks for > those still around keep things not completely stalled, especially for those > who doesn’t know the code base. > > > > For IvyDE, we wanted to retire it some years ago. The community raised > some interests, so we didn’t proceed. But many years later, the proof is > that is not maintained. Me too, I think it should be retired now. > > > > For the current IvyDE users, it shouldn’t be a concern that IvyDE is > retired as an Apache project. You will still be able to continue to use the > plugin. The released artifacts of the updatesite are archived [1] and won’t > disappear. We would just announcing officially what in practice happens: it > is not maintained anymore. > > > > And we tried our best to be opened on how to build and release the > plugin and the updatesite, it is documented [2]. On my machine which just > have Ant and Java installed, I just tried and I have been able to build of > the updatesite with the last release of Ivy without much effort. Doing a > proper Apache release of that is another subject, there are signatures, at > least verify that it actually works in a real Eclipse, votes, and so on. > And adding features and even fixing bugs is a very big step to get > involved, it requires a complete Eclipse SDK setup. But at least headless, > if it is required, I think anybody motivated enough should be able to re > build it locally, the updatesite too. It wouldn’t be as much user friendly > as it is today, but you should be able to work with your preferred IDE and > dependency manager for as long as Eclipse is having 4.x versions. > > > > Due to my particular former involvement in IvyDE (I know it well), and > my lack of involvement in the Ant community lately (I don’t read all > mailinglists), if you have issues with the build or the code of IvyDE, you > can mail on ant-dev@ and CC me directly. > > > > That’s for IvyDE. For Ivy, it kind of feels different due to the general > usage which continues to exists, as we can see people are searching > vulnerabilities in it. > > > > I am very sorry to read about missed opportunities to help new > contributors, I didn’t saw them, very sorry about that. > > > > Then, acknowledging that even fixing vulnerabilities is painful to the > community, I think we should accept to declare that we officially stop the > maintenance, stop the burden on people involved in the Ant project. > > > > I hear the user community that we should still try our best to keep > maintaining it, it is still worth it, I understand. > > > > So maybe we can declare a last call. The last maintenance window where > only vulnerabilities will be fixed. Months ? 6 ? And hope that before that > deadline, there are some interested parties that are willing to do proper > maintenance over the project, here at Apache or elsewhere. > > > > Nicolas > > > > [1] https://archive.apache.org/dist/ant/ivyde/updatesite/ > > [2] https://ant.apache.org/ivy/ivyde/history/latest-milestone/dev.html > > > > > Le 22 août 2023 à 18:02, Stefan Bodewig <bode...@apache.org> a écrit : > > > > > > Hi all > > > > > > before I get to the actual content of this mail: > > > > > > * I'm cross-posting to three lists but I ask you to keep responses to > > > dev@ant only (and join the list if necessary) if you want to respond. > > > > > > * what I write is my personal opinion and not shared by the PMC as a > > > whole. The people on the PMC know I'd be writing a mail like this > > > sooner or later, though. > > > > > > * this is a discussion, not a vote. > > > > > > phew > > > > > > I'm not quite sure what I hope to achieve with this email, but I'd like > > > to share my thoughts - and raise the awareness of an elephant being in > > > the room. > > > > > > Over the past year we've had three security vulnerabilities discovered > > > in Ivy and it took us much too long to get them fixed. The reason for > > > this is there are no people left around who are familiar with the Ivy > > > code base. Most of the remaining developers around Ant are not even > > > users of Ivy - I know I am not and have never been. > > > > > > When it comes to IvyDE things are probably even worse as nobody of us > > > uses Eclipse, either. But then again I've not managed to create an > > > Eclipse update site for the last two Ivy releases so maybe nobody is > > > using IvyDE anymore anyway. > > > > > > At least *I* don't see myself digging deeper into the Ivy code base in > > > order to fix non-critical bugs. And even for the critical ones I feel > we > > > are not doing an adequate job. To me it looks as if Ivy and in > > > particilar IvyDE are no longer really supported by the Ant project. > > > > > > TBH I'm not quite sure what to do about this. Even if people stepped up > > > to maintain Ivy, the rest of the Ant devs would probably be unable to > > > verify the changes they want to make. At least I certainly am not > > > willing to review bigger PRs/patches to a code base I don't understand > > > well. > > > > > > Personally I believe we should send IvyDE to the Apache Attic > > > immediately, and this likely should be the destination for Ivy sooner > or > > > later as well. In the case of Ivy we know there are people who depend > on > > > it (hi, Groovy folks) so maybe we should give a date in the future > until > > > which we are providing security bug fixes to give people time to move > > > off. > > > > > > There may be the need for a dependency management system inside of Ant, > > > I'm not sure. If so, then this should be driven by people who feel the > > > actual need IMO. There may already be alternatives to Ivy I am not > aware > > > of. > > > > > > Stefan > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: dev-unsubscr...@ant.apache.org > > > For additional commands, e-mail: dev-h...@ant.apache.org > > > > > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: dev-unsubscr...@ant.apache.org > For additional commands, e-mail: dev-h...@ant.apache.org > >
