search

terl / lazysodium-java

A Java implementation of the Libsodium crypto library. For the lazy dev.
https://github.com/terl/lazysodium-java/wiki
Mozilla Public License 2.0
134 stars 46 forks source link

Find alternative to jcenter #94

Closed kakawait closed 3 years ago

kakawait commented 3 years ago

You may know or not but jcenter/bintray will shutdown on 1st may 2021

https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/

Maybe publish to sonatype maven central?

AndroidDeveloperLB commented 3 years ago

Same issue of the Android version of here: https://github.com/terl/lazysodium-android/issues/43

gurpreet- commented 3 years ago

Hi all, thanks for raising this with me.

I was hoping that GitHub will step up and will finally allow us to use its package distribution system without signing in. If that doesn't happen then I'll raise a request to MavenCentral at the beginning of March.

gurpreet- commented 3 years ago

Do you know of any other alternatives to Bintray/JCenter (other than MavenCentral)?

AndroidDeveloperLB commented 3 years ago

Well, I use Jitpack as it's very easy and free. If you provide the Github URL, it will auto-generate things for whoever wishes to use the repository. Example for this tiny library I've made a long time ago: https://github.com/AndroidDeveloperLB/AutoFitTextView

So this is what you get: https://jitpack.io/#AndroidDeveloperLB/AutoFitTextView

No need to register. No need to pay. Just one step and that's it.

kakawait commented 3 years ago

Do you know of any other alternatives to Bintray/JCenter (other than MavenCentral)?

Any reason why not MavenCentral? Could help to propose alternative with other design

AndroidDeveloperLB commented 3 years ago

@kakawait What are the advantages of using MavenCentral? Is it free? Is it easy ?

kakawait commented 3 years ago

@kakawait What are the advantages of using MavenCentral? Is it free? Is it easy ?

It's free and a bit the de facto standard. First time it's not easy and you've to sign your jar. But when is automated is ok

AndroidDeveloperLB commented 3 years ago

@kakawait Is there a lot to configure per each new repository and/or update ? On Jitpack, I can't find any way for it to be easier.

kenyee commented 3 years ago

I'd strongly recommend Maven Central...it's a more professional thing to use than stuff like Jitpack....

AndroidDeveloperLB commented 3 years ago

@kenyee I've seen recommendations for both. Jitpack doesn't seem bad at all. Maven-central seem to be way too complex to even begin working with it.

kenyee commented 3 years ago

Maven isn't bad...Marton wrote up a decent article on the steps: https://proandroiddev.com/publishing-android-libraries-to-mavencentral-in-2021-8ac9975c3e52

The main issue w/ jitpack is the changeability...e.g., you can release a new version and then within six hours release it again w/ the same version. This is something that is a bit worrisome for a security library obviously...

gurpreet- commented 3 years ago

Lazysodium for Java has been migrated away from Bintray and is now on MavenCentral 🥳 Please visit the readme on how to install it.

The more rigorous steps for submitting a project into the Sonatype repository meant that the groupId had to unfortunately change 😔 That's the only breaking change.

AndroidDeveloperLB commented 3 years ago

@gurpreet- Please update the repositories' main websites here and for Android. On Android, it still says we should use "jcenter()" :

https://github.com/terl/lazysodium-android#1-install

There is even a link to here:

https://bintray.com/terl/lazysodium-maven/lazysodium-android/4.3.2

gurpreet- commented 3 years ago

@AndroidDeveloperLB I'm still in the progress of moving Lazysodium Android away from Bintray so that's why that hasn't been updated

AndroidDeveloperLB commented 3 years ago

@gurpreet- Can you please update me when it's completely ready, and what to write in gradle file (for Android) ?

gurpreet- commented 3 years ago

@AndroidDeveloperLB Sure, I'll update here.

Currently, Azure Pipelines is being a pain even though it is a great CI tool. With Azure Pipelines not building no matter what I try (I think they have a problem), I can't release Lazysodium.

I'm switching to GitHub Actions.

kenyee commented 3 years ago

Lazysodium for Java has been migrated away from Bintray and is now on MavenCentral 🥳 Please visit the readme on how to install it.

The more rigorous steps for submitting a project into the Sonatype repository meant that the groupId had to unfortunately change 😔 That's the only breaking change.

Thanks...well worth it :-)

gurpreet- commented 3 years ago

Good news. The move to GitHub Actions has been completed for:

All the above repos now support SNAPSHOTs. In other words, that means that the latest master branch is compiled and uploaded to Sonatype's Snapshot Repository for usage in your projects. One might want to do this if you want to test something in master that's not in a formal release yet.

gurpreet- commented 3 years ago

Further good news: Lazysodium Android version 5.0.0 has now been moved away from Bintray and is now on MavenCentral!

To now use Lazysodium in your projects, ensure you are using mavenCentral as a repository rather than jCenter or Bintray. Further info can be found on the Installation page.

CC: @AndroidDeveloperLB

AndroidDeveloperLB commented 3 years ago

@gurpreet- Nice. I think the jna one has a more updated version though:

    implementation 'net.java.dev.jna:jna:5.8.0@aar'

Maybe you should just link to it instead:

https://mvnrepository.com/artifact/net.java.dev.jna/jna https://github.com/java-native-access/jna/releases

gurpreet- commented 3 years ago

@AndroidDeveloperLB I tried linking to it but some developers complained that the newer versions of JNA broke their builds. Therefore it has remained hardcoded for now.

AndroidDeveloperLB commented 3 years ago

@gurpreet- It did? How odd. What was the error?

gurpreet- commented 3 years ago

Not sure, please open a new issue if you want to investigate that further. I want to keep this issue on the topic of moving away from Bintray

AndroidDeveloperLB commented 3 years ago

@gurpreet- OK sorry. Can you at least show the issue they complained about? Maybe if reproduced, it's an error with IDE/gradle.

gurpreet- commented 3 years ago

@AndroidDeveloperLB please see https://github.com/terl/lazysodium-java/issues/103

kenyee commented 3 years ago

Further good news: Lazysodium Android version 5.0.0 has now been moved away from Bintray and is now on MavenCentral!

Nice work..thanks :-)

AndroidDeveloperLB commented 3 years ago

@gurpreet- Weird. For me those work fine (use canary/beta version of the IDE and the gradle version of it too) :

    implementation "com.goterl:lazysodium-android:5.0.0@aar"
    implementation 'net.java.dev.jna:jna:5.8.0@aar'

But then I've noticed some build errors for these imports:

import com.goterl.lazycode.lazysodium.LazySodiumAndroid
import com.goterl.lazycode.lazysodium.SodiumAndroid
import com.goterl.lazycode.lazysodium.interfaces.PwHash.Alg
import com.goterl.lazycode.lazysodium.interfaces.SecretStream

Seems the packages changed a bit. Should be:

import com.goterl.lazysodium.*
import com.goterl.lazysodium.interfaces.*
gurpreet- commented 3 years ago

Now that I have migrated to Maven Central, it's now time to remove jCenter from the projects.

Lazysodium Java

This has been done in the following commits/PRs for Lazysodium Java https://github.com/terl/lazysodium-java/commit/72b4cee997e3c02cf759db1ab05ee21df4f4143c and is in release 5.0.1.

Lazysodium Android

For Lazysodium Android it is currently a work in progress in this PR https://github.com/terl/lazysodium-android/pull/48. It's blocked due to trove4j not being found.

Could not find org.jetbrains.trove4j:trove4j:20160824.

There are issues already raised to get it in Maven Central: https://youtrack.jetbrains.com/issue/IDEA-261387, https://youtrack.jetbrains.com/issue/KT-44730

The recommended solution of adding the following is not unreasonable but I would rather not do this:

jcenter {
    content {
        // https://youtrack.jetbrains.com/issue/IDEA-261387
        includeModule("org.jetbrains.trove4j", "trove4j")
    }
}
AndroidDeveloperLB commented 3 years ago

@gurpreet- I think that if you use the canary (or beta) version of the IDE, together with a newer version of gradle, you can avoid jcenter completely. That's what I did: https://github.com/terl/lazysodium-android/issues/15#issuecomment-813214466

gurpreet- commented 3 years ago

I think it's unfeasible to ask developers to upgrade to the latest canary versions of their IDEs. Some crazy people might not even use an IDE and may just use the command line 😄

With jFrog now keeping their jCenter repository open till next year, I've made a decision to keep using jCenter for the trove4j dependency specifically till that linked issue above is resolved.

This is available in Lazysodium Android 5.0.1 👍

gurpreet- commented 3 years ago

With that being said, I think this issue has now been resolved as everything has been migrated away from jCenter (minus, of course, the above trove4j dependency for LS Android) in version 5.0.1.

I will keep this issue open for a little while longer. Let me know in here if you see any problems.

AndroidDeveloperLB commented 3 years ago

@gurpreet- That's true, but the gradle plugin will get updated to support it officially soon. If people want to avoid jcenter, they can't do it on stable version yet (with or without using your repository).

Salzian commented 3 years ago

Are you planning on uploading other major versions to Maven Central as well? We still require 3.8.0.

AndroidDeveloperLB commented 3 years ago

@Salzian If it's urgent, you can use beta/canary versions of Android Studio (with the update gradle plugin, of course) .

Salzian commented 3 years ago

Nevermind, I have misunderstood something. I'll have to triage if 3.8.0 -> 5.0.1 is a drop in replacement anyways and we'll just bump.

gurpreet- commented 3 years ago

@Salzian I could release older versions of lazysodium but with jCenter being deprecated it would mean that those older libraries that rely on jCenter would go defunct at some point.

Version 5 of lazysodium brings a lot of bug fixes anyway. The underlying library resource-loader is constantly improving to load native libraries under all kinds of circumstances in all kinds of environments. In fact, creating a wrapper over Libsodium was the easy part. It's actually the seamless loading of the native libraries (.so, .dll, .dylib) out of (nested) JARs and out of different operating system file structures that has proved to be a huge challenge.

It is indeed a drop in replacement. The only thing you will have to do is find and replace the package ID.

Salzian commented 3 years ago

I was not taking into account that a version bump is needed to update the dependencies of lazysodium itself. However the upgrade was easy and painless, only the namespace change was required, nothing has seemed to break since then. We simply bumped the version and are now running on 5.0.1 successfully without jCenter. Thanks for considering anyways! 👍

gurpreet- commented 3 years ago

Looks like we're fully migrated now. Closing...