Hi all, I already created a ticket for the approval/signing of plugins. I want to mention it here, beacuse the discussion started also about that part. https://issues.apache.org/jira/browse/NETBEANS-2331 IMHO there is no real reason to have 2 different workflows. If we want to have the signing process for NetBeans modules, we need to make it mandatory. No two ways, just one.
I have another question, why want we add all the Plugins to the Maven central repo? For what reason? Cheers Chris Von: arsi Gesendet: Samstag, 6. April 2019 11:29 An: dev@netbeans.incubator.apache.org Betreff: Re: plugins.netbeans.org / netbeans.org Hi, A sensible solution, we still have to think about thatwe need to do SPI or record in layer.xml to allow Netbeans platform developers to use custom URL for this new system. I think we could later add an automatic update of developer plugins records in his local copy of the repo through the NB Maven plugins autoupdate goal. Or add a new goal for this. Arsi ------------------------------------------------------------------------ *From:* Tushar Joshi <tusharvjo...@gmail.com> *Sent:* Saturday, April 06, 2019 10:08AM *To:* Dev <dev@netbeans.incubator.apache.org> *Subject:* Re: plugins.netbeans.org / netbeans.org > There are two main issues which need discussion for maintaining an approved > list of plugins which shall be available by default on the plugins dialog > box. > > 1) Approved plugins by Apache NetBeans Committers - Old process was to have > a manual verification step to approve plugins before they become available > by default in the plugin dialog box. I believe this is a necessary process > to eliminate malicious activity for plugins. > > 2) People can still define their own repositories and publish it as a > NetBeans plugin repository (we can have a starndard way of defining a > NetBeans Plugin repository in GIT). These repositories can be added to the > plugin dialog settings and be available as other repositories to be added > on user's own risk when they know the developers of the plugin. > > Regarding the updates.xml let me describe the way how Homebrew does this. > They have a GIT repository representing a plugin registry. This registry > is cloned on the user's machine (which can be updated using git commands > easily for updates), now the whole plugin registry is in user's local > machine to do processing listing and managing a common list to show on the > dialog. We can adopt similar way to maintain plugin registry. > > The addition of plugin files by PR has advantage of manual approval of that > PR when new plugin or update to existing plugin is requested. Before > merging the PR we can have committers first validate and verify the plugins > by installing them and making sanity checks regarding fair play. > > with regards > Tushar > > > On Sat, Apr 6, 2019 at 1:05 PM arsi <a...@chello.sk> wrote: > >> Hi, >> >> Well written, with my translator English I can't write it so.. ;( >> >> >> I see the problem in the file registration. >> I find it quite challenging a new PR will be required for each new >> version of plugin. >> >> Registering updates.xml seems easier to me. >> It would be enough to write a script that parses the list, downloads the >> updates.xml once a day and generates one resulting update file. >> (Travis-CI could be used ) >> >> Arsi >> >> >> ------------------------------------------------------------------------ >> *From:* Tushar Joshi <tusharvjo...@gmail.com> >> *Sent:* Saturday, April 06, 2019 2:53AM >> *To:* Dev <dev@netbeans.incubator.apache.org> >> *Subject:* Re: plugins.netbeans.org / netbeans.org >> >>> Regarding the plugin developers to register their plugins easily. I will >>> propose the Homebrew model for registering plugins. >>> >>> This means maintaining the list of plugins as files in a github >>> repository. This repository will be considered as the plugin registry. >> So >>> the plugin developers will just have to submit a PR to get their plugins >>> included or updated. We can still create the moderation process to >> verify >>> and validate the plugins before we approve the PR for addition or update >> of >>> the plugins. >>> >>> The plugins can be uploaded to the maven registry just as mentioned in >> the >>> email thread and only the metadata, and registration, SHA hashes can be >>> placed in the plugin registry github repository. >>> >>> I can provide more answers to the Homebrew process, as I have worked with >>> Homebrew casks and updates since quite a time. >>> >>> with regards >>> Tushar >>> >>> Tushar Joshi, Nagpur: http://www.tusharjoshi.com >>> >>> * MCSD_NET C#, SCJP, RHCE, ZCE, PMP, CSM, SAFe, PRINCE2 >>> >>> * Senior Architect @ Persistent Systems http://www.persistent.com >>> * LinkedIn: http://www.linkedin.com/in/tusharvjoshi >>> >>> >>> >>> On Sat, Apr 6, 2019 at 2:28 AM arsi <a...@chello.sk> wrote: >>> >>>> Hi, >>>> >>>> Would not be easier to allow plug-in developers to register their >>>> updates center "on the fly". >>>> >>>> We would do a git repository on github. >>>> There plug-in developer would add an xml file with a link, name, etc., >>>> to his update center via PR. >>>> The approval process would remain preserved... >>>> >>>> >>>> And on the Settings tab, the "Show Available Update Centers" button >>>> would be added. >>>> >>>> This would download the current list of update centers from the git >>>> repository and allow to add it... >>>> >>>> >>>> Then it will be up to the developer preference to use >>>> raw.githubusercontent.com or any other server... >>>> >>>> Arsi >>>> >>>> ------------------------------------------------------------------------ >>>> *From:* Geertjan Wielenga <geertjan.wiele...@googlemail.com.INVALID> >>>> *Sent:* Friday, April 05, 2019 8:31PM >>>> *To:* Dev <dev@netbeans.incubator.apache.org> >>>> *Subject:* Re: plugins.netbeans.org / netbeans.org >>>> >>>>> Here's the rough proposal: >>>>> >>>>> 1. Move all the plugins to Maven Central. Blockers: we don't know how >> to >>>> do >>>>> that, if someone can advise, that will help. >>>>> >>>>> 2. Refactor the plugins.netbeans.org application so that (1) NBM files >>>>> cannot be uploaded anymore and (2) instead of uploading, references >> need >>>> to >>>>> be registered to the location of the NBM on Maven Central. Blockers: >> this >>>>> is being investigated at the moment, timelines not known yet. This is >>>>> doable because the plugins.netbeans.org application has been donated >> to >>>>> Apache as part of the 3rd donation. >>>>> >>>>> 3. Deploy the plugins.netbeans.org application from the Apache >> NetBeans >>>> VM. >>>>> There should be no problem with that since we'll not be distributing >> the >>>>> NBMs from Apache (which would have been a problem since Apache >>>> distributes >>>>> source code only) but only pages or references to Maven Central. >>>>> >>>>> 4. Enable the Plugin Manager inside Apache NetBeans to install NBM >> files >>>>> directly from Maven Central, based on the references retrieved via the >>>>> Update Center from the plugins.netbeans.org application running on the >>>>> Apache NetBeans VM. >>>>> >>>>> 5. Continue using the plugins.netbeans.org URL, except that this will >>>> now >>>>> be running at Apache and pointing to the plugins.netbeans.org >>>> application >>>>> running on the Apache NetBeans VM. >>>>> >>>>> So, the above would mean that nothing is running on Oracle servers >>>> anymore, >>>>> all NBMs that we care about are on Maven Central (and source code could >>>>> mostly be on GitHub, except where plugin owners don't want their source >>>>> code exposed, in which case they'd have it in their local proprietary >>>>> backends), and we have the plugins.netbeans.org application refactored >>>> and >>>>> simply showing Maven co-ordinated to the plugins on Maven Central. >>>>> >>>>> How does that sound? >>>>> >>>>> Gj >>>>> >>>>> On Fri, Apr 5, 2019 at 8:21 PM Antonio <anto...@vieiro.net> wrote: >>>>> >>>>>> Hi all, >>>>>> >>>>>> After the 11.0 release announcement, where we migrated most of >>>>>> bits.netbeans.org, shall we tackle the plugins.netbeans.org website >> and >>>>>> infrastructure for 12.0? Or is it too early? Also, what's missing in >>>>>> netbeans.apache.org that still exists in netbeans.org and we want to >>>> keep? >>>>>> I can't remember when the infra @ Oracle for plugins.netbeans.org is >>>>>> going to be shutdown, but the sooner we start thinking on hosting the >>>>>> plugins, the better. This is something that is going to take us long, >> I >>>>>> think. >>>>>> >>>>>> Thoughts? >>>>>> >>>>>> Thanks, >>>>>> Antonio >>>>>> >>>>>> --------------------------------------------------------------------- >>>>>> To unsubscribe, e-mail: dev-unsubscr...@netbeans.incubator.apache.org >>>>>> For additional commands, e-mail: >> dev-h...@netbeans.incubator.apache.org >>>>>> For further information about the NetBeans mailing lists, visit: >>>>>> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists >>>>>> >>>>>> >>>>>> >>>>>> >>>> >>>> >>>> >>>> >> >> >> >> >> >>
