`travis/default.yml` doesn't work with sbt 1.4.8

[SethTisue]

the travis/default.yml in this repo, which lots of repos inside and outside the Scala org use, doesn't work with sbt 1.4.8

thus many of the Scala Steward's sbt 1.4.8 upgrade PRs are failing

[SethTisue]

I assume the problem here is that Travis-CI provides an outdated version of sbt-extras

one thing we could do is report that upstream and hope they fix it, but actually I think we ought not to be using sbt-extras at all, we ought to be using the official sbt launch script

[eed3si9n]

I assume the problem here is that Travis-CI provides an outdated version of sbt-extras

Detected sbt version 1.4.8
Downloading sbt launcher for 1.4.8:
  From  https://repo.scala-sbt.org/scalasbt/maven-releases/org/scala-sbt/sbt-launch/1.4.8/sbt-launch-1.4.8.jar
    To  /home/travis/.sbt/launchers/1.4.8/sbt-launch.jar
Downloading sbt launcher 1.4.8 md5 hash:
  From  https://repo.scala-sbt.org/scalasbt/maven-releases/org/scala-sbt/sbt-launch/1.4.8/sbt-launch-1.4.8.jar.md5
    To  /home/travis/.sbt/launchers/1.4.8/sbt-launch.jar.md5
cat: /home/travis/.sbt/launchers/1.4.8/sbt-launch.jar.md5: No such file or directory

@xuwei-k fixed this already! https://github.com/paulp/sbt-extras/pull/305

ok so you're right. It's a problem with sbt-extras, which is now fixed.

[SethTisue]

perhaps I ought to first do a more minimal fix where I grab the latest sbt-extras and overwrite the Travis-CI one

and then separately consider whether to get off sbt-extras. if sbt-extras is the Travis default, then it might be surprising and/or breaking for some downstream users for us to have a different default here

[SethTisue]

I verified at https://github.com/lightbend/scala-sculpt/pull/142 that the fix works

[SethTisue]

I thought about just always using the latest sbt-extras, but it seems better to me to stick with a fixed version unless/until a need for an upgrade arises. partly for predictability/stability reasons, and partly because compromising paulp/sbt-extras is a potential attack vector

[SethTisue]

@eed3si9n I don't know if this is the "best" fix, but I wanted to get some kind of fix out there right away

you might want to publicize some kind of recommended fix? not sure if this is the one you want to publicize.

[SethTisue]

It doesn't seem to be enough to hit "restart" in the Travis-CI web UI for the new version to be picked up. Adding an empty commit works. 🤷

[eed3si9n]

I've updated https://eed3si9n.com/sbt-1.4.8 with the instruction on how to swap out sbt similar to what you did but with the genuine stuff.

[dwijnand]

As we control https://repo.scala-sbt.org/scalasbt/maven-releases/, can't we get that to redirect the GET for 1.4.8 to maven central, thus avoiding that breakage?

[eed3si9n]

That's true. https://repo.scala-sbt.org/scalasbt/maven-releases/ can just redirect anything under it to Maven Central.

[SethTisue]

@eed3si9n I like that your solution uses the official launch script rather than sbt-extras, but I'm a bit uncomfortable with how it grabs an entire tarball just to extract one file from it. That's not the worst thing in the world, but if the launch script were independently downloadable, that would be advantageous. Overall I'm not an sbt-extras booster, but it's pretty nice that you can just get the script by itself.

[eed3si9n]

The official launcher includes Bash script, sbt-launch.jar, sbtn binary, all in one tar ball. This eliminates the "where is sbt-launcher this month" problem.

[SethTisue]

oh, I see, sorry. okay, yours is better, then.

[SethTisue]

I've opened https://github.com/scala/scala-dev/issues/766 proposing we adopt your solution.

[dwijnand]

This eliminates the "where is sbt-launcher this month" problem.

Just like the tar ball is at https://github.com/sbt/sbt/releases/ (now), sbt-extras is at https://github.com/paulp/sbt-extras/ and has been for more than a few months. The problem is that the new sbt release changed its publishing while Travis CI is using an old version of sbt-extras.

[dwijnand]

I've used the following to deal with the breakage:

before_install:
  - |
    curl -Ls https://git.io/sbt -o sbt || travis_terminate 1
    chmod 0755 sbt || travis_terminate 1
    sudo mv sbt /usr/local/bin/sbt || travis_terminate 1

[dwijnand]

That's true. repo.scala-sbt.org/scalasbt/maven-releases can just redirect anything under it to Maven Central.

So I had a look and tried about 6 different interesting/weird modules under maven-releases and found them on Maven Central, but I wanted to ask you: do you think there's anything under maven-releases that isn't on maven central? That way I can ask internally to setup the redirect.

[SethTisue]

(as for the likelihood of getting Travis-CI on a newer sbt-extras, Dale notes that:

• although this 2018 PR was ignored:
  • https://github.com/travis-ci/travis-build/pull/1423
• this 2020 PR was merged:
  • https://github.com/travis-ci/travis-build/pull/1946

so there is at least some grounds for optimism that another version bump PR would be merged. perhaps the 2018 PR would have been merged too if we'd done a bit more upvoting and nagging)

[eed3si9n]

do you think there's anything under maven-releases that isn't on maven central? That way I can ask internally to setup the redirect.

No. I've never used maven-releases on Bintray as actual repo. They should all be synced to Maven Central.