Real questions
Hi, Archie Cobbs wrote: Brian Jones wrote: I'm not following Harmony too closely (so let me talk out my ... a moment) but let me see if I understand it so far. Harmony is: 1) Writing their own class libraries (based on email about japi comparisons) 2) Writing their own JVM (which I think is based in some part on one of the current JVMs, but ok, sure, everyone seems to write one eventually) 3) Writing their own test suite (because Mauve doesn't use junit and has a different license, but I think that's going to be fixed) Here's a little bit more information re #2. I've Who? donated an interpreter-only version of JCVM to Harmony (called JC Harmony Edition) under the Apache license. Whether they'll end up using it or not, who knows. IBM has donated a class library (called, unfortunately, classlib). There is an effort underway to port that class library to JCHEVM, using the existing (Classapath-defined) Java/VM API. This effort has seen some initial success. So in theory, if all goes well, any combination of (classlib or Classpath) and (any VM that works with Classpath) will run. This would be great if it can be achieved. Does this library have (ie is in a perfect state) all the security and signing stuff that classpath lacks right now? How about the security audit? That would be so nice. and then if they have compatible licenses...we can very soon finish the webplugin... As for all the license stuff, I don't understand it all and don't care strongly enough to follow the debate. I do think it's a real irony that free software can't be packaged with other free software. keep talking... I don't in general like the idea of two competing class libraries nor two competing test frameworks (the latter being especially stupid). yes, that's it! So #1 is not really true: they're not writing new stuff, they've just accepted a pre-existing donation. They believe they can't just use Classpath for license reasons (this part I don't fully understand). Re #3 I've not been following it. I know you can do better! -Archie Archie, I never read any of your comics as a kid, but you sure are my hero :-) (I hope this works outside Canada...)
Re: Real questions
Philippe Laporte wrote: Does this library have (ie is in a perfect state) all the security and signing stuff that classpath lacks right now? How about the security audit? I'm not sure exactly what it has, as I've been too busy to take a good look at it. It's all visible for inspection via the Apache SVN server if you want to have a look. -Archie __ Archie Cobbs *CTO, Awarix* http://www.awarix.com
Re: Real questions
On Mar 9, 2006, at 8:54 AM, Philippe Laporte wrote: Does this library have (ie is in a perfect state) all the security and signing stuff that classpath lacks right now? How about the security audit? I don't understand (and have been largely ignoring this thread, so I may have missed some context). What do you think is missing from Classpath's security infrastructure?
Re: Real questions
Casey Marshall wrote: On Mar 9, 2006, at 8:54 AM, Philippe Laporte wrote: Does this library have (ie is in a perfect state) all the security and signing stuff that classpath lacks right now? How about the security audit? I don't understand (and have been largely ignoring this thread, so I may have missed some context). Unfortunate. Despite some people think I'm ugly, you'll come to like me with time...give me a chance What do you think is missing from Classpath's security infrastructure? support for signed jars, I was told
Re: Real questions
On Mar 9, 2006, at 1:35 PM, Philippe Laporte wrote: Casey Marshall wrote: On Mar 9, 2006, at 8:54 AM, Philippe Laporte wrote: Does this library have (ie is in a perfect state) all the security and signing stuff that classpath lacks right now? How about the security audit? I don't understand (and have been largely ignoring this thread, so I may have missed some context). Unfortunate. Despite some people think I'm ugly, you'll come to like me with time...give me a chance Not you in particular; I saw sablevm and license and that discussion is always pointless. What do you think is missing from Classpath's security infrastructure? support for signed jars, I was told Nope. Classpath has had support for *verifying* signed jar files for some time now; we do currently lack support for *creating* signed jar files (i.e., we don't have a replacement for `jarsigner' yet) but I think Raif said he would look into that. I kinda doubt Harmony has a `jarsigner' yet, unless they were able to panhandle one from IBM or Intel.
Re: Real questions
Casey == Casey Marshall [EMAIL PROTECTED] writes: Casey I don't understand (and have been largely ignoring this thread, so I Casey may have missed some context). What do you think is missing from Casey Classpath's security infrastructure? Some of the discussion involved gcjwebplugin. There's a number of thing missing from the security manager part of security -- see PR 13603 for the list of known issues. Tom
Re: Real questions
On Thu, 2006-03-09 at 13:54 -0800, Casey Marshall wrote: Nope. Classpath has had support for *verifying* signed jar files for some time now; we do currently lack support for *creating* signed jar files (i.e., we don't have a replacement for `jarsigner' yet) but I think Raif said he would look into that. Casey, have you seen https://jcewww.iaik.tu-graz.ac.at/mailarchive/iaik-jce/msg01600.html ? cheers, dalibor topic
Re: Real questions
On Mar 9, 2006, at 6:51 PM, Dalibor Topic wrote: On Thu, 2006-03-09 at 13:54 -0800, Casey Marshall wrote: Nope. Classpath has had support for *verifying* signed jar files for some time now; we do currently lack support for *creating* signed jar files (i.e., we don't have a replacement for `jarsigner' yet) but I think Raif said he would look into that. Casey, have you seen https://jcewww.iaik.tu-graz.ac.at/mailarchive/iaik-jce/msg01600.html ? No, I hadn't. The URL it references is dead, though, so it isn't clear that this code is still available.
Re: Real questions
On Thu, Mar 09, 2006 at 06:49:12PM -0800, Casey Marshall wrote: On Mar 9, 2006, at 6:51 PM, Dalibor Topic wrote: On Thu, 2006-03-09 at 13:54 -0800, Casey Marshall wrote: Nope. Classpath has had support for *verifying* signed jar files for some time now; we do currently lack support for *creating* signed jar files (i.e., we don't have a replacement for `jarsigner' yet) but I think Raif said he would look into that. Casey, have you seen https://jcewww.iaik.tu-graz.ac.at/mailarchive/iaik-jce/msg01600.html ? No, I hadn't. The URL it references is dead, though, so it isn't clear that this code is still available I believe the author is still around. I recall e-mailing with him about merging the code into Kaffe a while ago, but I think I dropped the ball eventually. cheers, dalibor topic
