vaadin / framework

Vaadin 6, 7, 8 is a Java framework for modern Java web applications.
http://vaadin.com/
Other
1.77k stars 729 forks source link

Vaadin 8.14.3 platform build instructions, or any forked projects to keep it secure now that it's no longer open source #12533

Open OpenESignForms opened 2 years ago

OpenESignForms commented 2 years ago

Since Vaadin 8 has reached a point where it is no longer being maintained as open source for bug, security and browser changes, does anybody have build instructions for Vaadin 8.14.3? This could at least give us a fighting chance to avoid having our users suffer from bug/security fixes in particular, and new browser version changes going forward.

Or is there anybody who has forked 8.14.3 with such plans that we could join forces for? We don't need more features, just insurance that our software won't be vulnerable because of bugs/security issues that remain in the platform.

TatuLund commented 2 years ago

The documentation is here: https://github.com/vaadin/framework/blob/master/README-DEV.md

It is referenced from main README.md file, see: https://github.com/vaadin/framework#developing-vaadin-framework

OpenESignForms commented 2 years ago

Is the Oxygen release of Eclipse required, or will a newer version still work?   I'm using Version: 2021-12 (4.22.0).

When I did the MAVEN INSTALL for vaadin-root, it seems like everything is okay, yet each project (other than vaadin-bom and vaadin-liferay) is marked with pom.xml errors.

The 'install' output success:

[INFO] Reactor Summary for vaadin-root 8.15-SNAPSHOT: [INFO] [INFO] vaadin-root ........................................ SUCCESS [  1.166 s] [INFO] vaadin-shared ...................................... SUCCESS [  5.063 s] [INFO] vaadin-push ........................................ SUCCESS [  1.562 s] [INFO] vaadin-server ...................................... SUCCESS [01:31 min] [INFO] vaadin-client ...................................... SUCCESS [ 13.757 s] [INFO] vaadin-client-compiler ............................. SUCCESS [  1.839 s] [INFO] vaadin-client-compiled ............................. SUCCESS [ 42.447 s] [INFO] vaadin-themes ...................................... SUCCESS [  4.162 s] [INFO] vaadin-compatibility-shared ........................ SUCCESS [  1.261 s] [INFO] vaadin-compatibility-server ........................ SUCCESS [ 28.401 s] [INFO] vaadin-compatibility-client ........................ SUCCESS [  3.680 s] [INFO] vaadin-compatibility-client-compiled ............... SUCCESS [ 48.187 s] [INFO] vaadin-compatibility-themes ........................ SUCCESS [  8.521 s] [INFO] vaadin-testbench-api ............................... SUCCESS [  2.787 s] [INFO] vaadin-uitest ...................................... SUCCESS [ 29.216 s] [INFO] vaadin-liferay ..................................... SUCCESS [  1.135 s] [INFO] vaadin-liferay-integration ......................... SUCCESS [  0.771 s] [INFO] vaadin-osgi-integration ............................ SUCCESS [  0.722 s] [INFO] vaadin-compatibility-server-gae .................... SUCCESS [  1.425 s] [INFO] vaadin-all ......................................... SUCCESS [  3.420 s] [INFO] Vaadin Framework (Bill of Materials) ............... SUCCESS [  0.033 s] [INFO]

[INFO] BUILD SUCCESS [INFO]

[INFO] Total time:  04:51 min [INFO] Finished at: 2022-04-11T13:49:32-07:00 [INFO]

Yet I seem to have issues with the pom.xml files with a lot of "Marker" errors, and when I open pom.xml files they all seem to highlight the elements and .  When I tried to update Maven plugin connectors, it fails during the software update step.

Description    Resource    Path Location    Type Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-all    line 148    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-client    line 121    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-client-compiler    line 46    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-compatibility-client    line 62    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-compatibility-server    line 82    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-compatibility-server-gae    line 46    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-compatibility-shared    line 37    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-liferay-integration    line 77    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-osgi-integration    line 64    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-server    line 219    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-shared    line 109    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)    pom.xml /vaadin-testbench-api    line 42    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-dependency-plugin:3.0.1:unpack-dependencies (execution: copy-font-icons, phase: generate-sources) pom.xml    /vaadin-server    line 146    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-dependency-plugin:3.0.1:unpack-dependencies (execution: copy-font-icons, phase: process-resources) pom.xml    /vaadin-themes    line 66    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-all    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-client    line 5 Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-client-compiled line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-client-compiler line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml /vaadin-compatibility-client    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml /vaadin-compatibility-client-compiled    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml /vaadin-compatibility-server    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml /vaadin-compatibility-server-gae    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml /vaadin-compatibility-shared    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml /vaadin-compatibility-themes    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-liferay-integration line 9    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-osgi-integration line 9    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-push    line 5 Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-server    line 5 Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-shared    line 5 Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-testbench-api    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-themes    line 5 Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)    pom.xml    /vaadin-uitest    line 5 Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: initialize)    pom.xml /vaadin-all    line 134    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-client    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-client-compiled    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-client-compiler    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-compatibility-client    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-compatibility-client-compiled    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-compatibility-server    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-compatibility-server-gae    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-compatibility-shared    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-compatibility-themes    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-liferay-integration    line 9    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-osgi-integration    line 9    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-push    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-server    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-shared    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-testbench-api    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-themes    line 5    Maven Project Build Lifecycle Mapping Problem Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)    pom.xml /vaadin-uitest    line 5    Maven Project Build Lifecycle Mapping Problem Duplicating managed version 4.1.1 for maven-embedded-glassfish-plugin    pom.xml /vaadin-test-glassfish-server    line 40    Maven pom Loading Problem GroupId is duplicate of parent groupId    pom.xml /vaadin-bom    line 11    Maven pom Loading Problem GroupId is duplicate of parent groupId    pom.xml /vaadin-client    line 11    Maven pom Loading Problem GroupId is duplicate of parent groupId    pom.xml /vaadin-client-compiled    line 11    Maven pom Loading Problem Overriding managed version 2.0 for portlet-api    pom.xml /vaadin-compatibility-server    line 58    Maven pom Loading Problem Overriding managed version 2.4.30.vaadin4 for atmosphere-runtime    pom.xml    /vaadin-compatibility-server line 64    Maven pom Loading Problem Overriding managed version 3.0.1 for javax.servlet-api pom.xml    /vaadin-uitest    line 178    Maven pom Loading Problem Referenced file contains errors (http://www.gwtproject.org/doctype/2.8.2/gwt-module.dtd).  For more information, right click on the message in the Problems View and select "Show Details..."    TestingWidgetSet.gwt.xml /vaadin-uitest/src/main/resources/com/vaadin/tests/widgetset line 1    XML Problem

On 4/11/22 1:09 AM, Tatu Lund wrote:

The documentation is here: https://github.com/vaadin/framework/blob/master/README-DEV.md

— Reply to this email directly, view it on GitHub https://github.com/vaadin/framework/issues/12533#issuecomment-1094683400, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAJYLQAK67E2A2GKJHWQB73VEPM2ZANCNFSM5S5H247Q. You are receiving this because you authored the thread.Message ID: @.***>

TatuLund commented 2 years ago

Is the Oxygen release of Eclipse required, or will a newer version still work? I'm using Version: 2021-12 (4.22.0).

We have not tested every IDE version. In theory it should work with newer versions. Just noting, that building Vaadin 8 is compatible with JDK8, JDK11 wont work (at least if you want to run all the unit tests). This is good to remember as the newest Eclipse versions require JDK11 and hence workspace defaults to JDK11. However you can change this in settings. This is not limitation for application development, you can build apps using Vaadin 8 using JDK11 or JDK17.

OpenESignForms commented 2 years ago

Thanks. Yes, I confirmed the eclipse preferences and for JDK Compliance is 1.8, selected installed JRE "Java SE 8 [1.8.0_261], and Execution Environment for JavaSE-1.8 is also showing a perfect match.

Is it possible the 'target' folders are cleaned of the compiled Java .class files? For example, under my vaadin-root is vaadin-client, and it has a target file vaadin-client-8.15-SNAPSHOT.jar. I'm not sure why the forked code isn't showing 8.14.3, the last open source release on Vaadin 8, and instead shows 8.15-SNAPSHOT.

Is it expected the .class files would be gone and the JAR would remain? I am using the Maven goal of 'install' and the console shows:

[INFO] --- maven-jar-plugin:2.6:jar (default-jar) @ vaadin-client ---
[INFO] Building jar: /Users/yozons/git/framework/client/target/vaadin-client-8.15-SNAPSHOT.jar
[INFO] 
[INFO] --- maven-install-plugin:2.5.2:install (default-install) @ vaadin-client ---
[INFO] Installing /Users/yozons/git/framework/client/target/vaadin-client-8.15-SNAPSHOT.jar to /Users/yozons/.m2/repository/com/vaadin/vaadin-client/8.15-SNAPSHOT/vaadin-client-8.15-SNAPSHOT.jar
[INFO] Installing /Users/yozons/git/framework/client/pom.xml to /Users/yozons/.m2/repository/com/vaadin/vaadin-client/8.15-SNAPSHOT/vaadin-client-8.15-SNAPSHOT.pom
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS

It may just be that I'm not familiar with the layout of bundled components under vaadin-root in Eclipse. If we had to make a change due to some security or browser bug, and then we did a RUN AS MAVEN BUILD ... with the goal of 'install' would we get updated JARs for us to use? I'm not sure what sort of change I can make to easily determine that I am in fact running on code I built versus that last supported release of 8.14.3, so if you have any suggestions, I'll give it a try.

I still have pom.xml errors showing. For example, under vaadin-server pom.xml the element on line 5 is highlighted and shows this error:

Multiple markers at this line
- Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:add-resource (execution: add-dependency-resources, phase: generate-resources)
- Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:build-helper-maven-plugin:1.10:parse-version (execution: parse-version, phase: validate)

And element on line 146 shows:

Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-dependency-plugin:3.0.1:unpack-dependencies (execution: copy-font-icons, phase: generate-sources)

And element on line 219 shows:

Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-checkstyle-plugin:2.17:checkstyle (execution: default, phase: process-sources)

It is not clear if those are issues I need to concern myself with or not since the overall build seems to succeed.

Thanks, David

OpenESignForms commented 2 years ago

It seems that I am able to build the primary JARs, but do you know why they all show version 8.15-SNAPSHOT rather than 8.14.3, the last open source version on the V8 line?

I have compiled and replaced the 8.14.3 JARs with those I built and so far I've not noted any issues, so this is a good start:

vaadin-client-8.15-SNAPSHOT.jar
vaadin-compatibility-server-8.15-SNAPSHOT.jar
vaadin-server-8.15-SNAPSHOT.jar
vaadin-compatibility-client-8.15-SNAPSHOT.jar
vaadin-compatibility-shared-8.15-SNAPSHOT.jar
vaadin-shared-8.15-SNAPSHOT.jar
vaadin-compatibility-client-compiled-8.15-SNAPSHOT.jar
vaadin-push-8.15-SNAPSHOT.jar
vaadin-themes-8.15-SNAPSHOT.jar

What would it take to build as version 8.14.3.1 instead of 8.15-SNAPSHOT? It seems that somehow those values are tied to items added to Maven (I see messages like "[ERROR] Failed to execute goal on project vaadin-themes: Could not resolve dependencies for project com.vaadin:vaadin-themes:jar:8.14.3.1: com.vaadin:vaadin-server:jar:8.14.3.1 was not found in https://repo.maven.apache.org/maven2/ during a previous attempt.").

TatuLund commented 2 years ago

but do you know why they all show version 8.15-SNAPSHOT

It is just convention in this kind of projects. The version is set when we do the release.

There is maven versions plugin in the project. So it should be possible to set the new version from command line, something like

mvn versions:set -DnewVersion=

OpenESignForms commented 2 years ago

Thanks. Is this something that can be configured into Eclipse's Maven Run Config? I don't use command line 'mvn' (yet).

OpenESignForms commented 2 years ago

It seems that after I compile 8.15-SNAPSHOT and release those JARs, and then I build my app pointing to 8.15-SNAPSHOT in my pom.xml element, my app starts fine, but on rendering, it flashes the screen, and the buttons are quite unresponsive, though it seem events do eventually get through (after a few seconds after clicking).

Is there any idea what seems to be mismatched between my builds and then getting it to run normally? I know that there are JARs that you guys provide but aren't part of that build. Is that an issue? Like there's no builds for vaadin-sass-compiler-0.9.13.jar or vaadin-slf4j-jdk14-1.6.1.jar, atmosphere-runtime-2.4.30-vaadin4.jar, though it seems unlikely these changed from 8.14.3 to 8.15-SNAPSHOT.

thevaadinman commented 2 years ago

Yet I seem to have issues with the pom.xml files with a lot of "Marker" errors, and when I open pom.xml files they all seem to highlight the elements and . When I tried to update Maven plugin connectors, it fails during the software update step.

This is an Eclipse problem.

Is there any idea what seems to be mismatched between my builds and then getting it to run normally? I know that there are JARs that you guys provide but aren't part of that build. Is that an issue? Like there's no builds for vaadin-sass-compiler-0.9.13.jar or vaadin-slf4j-jdk14-1.6.1.jar, atmosphere-runtime-2.4.30-vaadin4.jar, though it seems unlikely these changed from 8.14.3 to 8.15-SNAPSHOT.

The dependencies are pulled in through Maven and get packaged with the framework as part of a full build. You can build Vaadin packages by running mvn -DskipTests=true clean package in the project root. You'll find the vaadin-all-<version>.zip package in the all/target directory.

OpenESignForms commented 1 year ago

Is there a way to be sure I only get the 8.14.3 release from GIT? It seems like the pom.xml files all show 8.14-SNAPSHOT. I am trying to get the last open source version compiled and I wonder if the retrieval of 8.15-SNAPSHOT was the original problem for me since that may already require a commercial license.

OpenESignForms commented 1 year ago

I tried to release the 8.14-SNAPSHOT JARs in place of the 8.14.3 JARs and views don't really load and I get this:

Aug 03, 2022 6:11:18 PM com.vaadin.server.communication.ServerRpcHandler checkWidgetsetVersion
WARNING: 
=================================================================
The widgetset in use does not seem to be built for the Vaadin
version in use. This might cause strange problems - a
recompile/deploy is strongly recommended.
 Vaadin version: 8.14-SNAPSHOT
 Widgetset version: 8.14.3
=================================================================
Aug 03, 2022 6:11:18 PM org.atmosphere.util.IOUtils guestRawServletPath

I still seem to be stuck on getting the 8.14.3 version of everything so it compiles to 8.14.3 JARs.

OpenESignForms commented 2 months ago

Has anybody outside of Vaadin built Vaadin 8.14 from the source repository using Eclipse? If so, can you provide the setup and steps? This open source project never seems to build a usable version so perhaps they never built it from scratch using Eclipse. It's odd because our code is open source and compiles fine every time using Eclipse.

TatuLund commented 2 months ago

When we are developing the framework locally we are just building the snapshots and do the releases in CI/CD pipeline (because we have very big amount unit and end-to-end tests in the project and build takes long).

You need to use version plugin to set the version of all modules to something else than 8.15-SNAPSHOT, I mentioned this earlier

https://github.com/vaadin/framework/issues/12533#issuecomment-1102973118

It is needed to be run from command line to root pom.xml. Just noting that root pom.xml is not visible when you import the project to IDE.

Alternatively you can manually edit all the pom.xml files to have the version number you want in your release.

I do not however understand why you have 8.14-SNAPSHOT there, since the default version number in all modules in master branch is 8.15-SNAPSHOT.

thevaadinman commented 2 months ago

When using Eclipse, you'll see a "vaadin-root" project.

To build a release, you need to right-click the root pom.xml file, select "Run as" -> "Maven build..." and set goals "clean package". It is highly recommended to check the "skip tests" checkbox. Make sure you're running with a Java 8 JDK.

image

It is recommended to only use a single thread for compilation due to custom build steps like widgetset and style compilers needing to run against class files that may not be present at the point when they're invoked if Maven is running on multiple threads.

After about 10 minutes (depending on the speed of your computer) the build should complete, and if you navigate to vaadin-root -> vaadin-all -> target and right click target -> Show in... -> system explorer you'll see the vaadin-all-8.15-SNAPSHOT.zip file, about 78 megabytes in size, containing the full build, and individual jars in the target directories of the sub-projects.

Go through the README-DEV.md file and make sure your workspace is set up correctly.

Finally, I recommend setting Projects Presentation to Hierarchical from the "three vertical dots" menu next to the Project Explorer tab (yes, my workspace says 8.21.0; it's slightly bugged, the source was just synched to 8.14.3):

image

Remember to import the Vaadin projects by using the "Import..." -> "Existing Maven Projects" when setting up your workspace so that Eclipse picks them up correctly.

Do note that even after all this, because of compiler settings and such, Eclipse is still showing multiple "classpath dependency validator messages", "HTML problems", "Java Problems", "Markdown Problems", "Maven Configuration Problems", "Maven Problems" and "XML Problems". This is normal - some warnings are from excess validation, some are caused by our code not being formatted quite like Eclipse expects, some from Eclipse not picking up on the peculiarities of GWT, etc.. You can either just ignore these or turn off the validations that aren't working correctly. I do not recommend trying to systematically "fix" these, as most of these will be problems with Eclipse's validators, not the code. At the end of the day, what matters is the output from the Maven build process.

While I do work at Vaadin, nothing in this process requires knowledge, tools or access that would be unavailable to me on the outside.

thevaadinman commented 2 months ago

We don't need more features, just insurance that our software won't be vulnerable because of bugs/security issues that remain in the platform.

This is what Vaadin Extended Maintenance is for. Aside from things like deprecation and removal of support for ancient technologies*, any features we add are strictly additive**. Any private or open source forks would need to be doing their own due diligence regarding security and bug fixes. You can see a list of forks on GitHub sorted by latest updated here, though at the time of writing it would appear that most of these exist only for product-specific support or custom features, not as a free/open source alternative to our Extended Maintenance program. I am currently not aware of any extenral repackaging effort for FW 6/7/8.

*) We've deprecated support for IE11 in the sense that we're not removing any support code for IE11, but we've ceased validation against it and new features will not get IE11 compatibility hacks. Any earlier IE versions are now considered "not supported", though you are of course always free to try and see if the application will run on them. We've also removed Adobe Flash support by removing the com.vaadin.ui.Flash widget and Flash applet embed support, which is a breaking change, but with no modern browsers supporting Flash anymore, its limited availability from Adobe and many security suites flagging any references to Flash as critical vulnerabilities, this was the right move.

**) The only added feature that has thus far required breaking existing projects has been the code separation required for Jakarta support, which saw the introduction of the vaadin-server-mpr-jakarta artifact along with the separation of portlet classes into their own vaadin-portlet artifact to support this change. All other improvements, security fixes and version bumps of supporting librarires should be transparent to users.

OpenESignForms commented 6 days ago

Thank you, thevaadinman. Your replies were very helpful. I think I have a working build finally for 8.14.3.

I started over using the info here: https://github.com/vaadin/framework/blob/master/README-DEV.md

I then made sure I did a GIT checkout of the 8.14.3 version. I already forget if I did one or both, but I then did a search-replace across it all to replace 8.14-SNAPSHOT and/or 8.15-SNAPSHOT with 8.14.3. Then I did Run As->Maven build... with goals 'clean install'. I saw all of the JARs as you made clear in the file vaadin-root->vaadin-all->target->vaadin-all-8.14.3.zip.

The JAR files in the ZIP are not exactly the same as the released Vaadin 8.14.3 JARs I have from the official release some time back, but at least it does seem to run, giving me at least the opportunity/possibility of fixing Vaadin to deal with anything that breaks for me. That provides some comfort, though it's a huge system to be sure.

What is odd is that GIT seems to show version 8.25.2, but it's my impression all the code after 8.14.3 isn't open source. A comparison seemed to show it was mostly updating copyright years in source files that really otherwise didn't change (and thus the copyright year change is insignificant). I'm not sure if the later versions also contains real fixes and whether we could incorporate any code changes in our build without violating copyright/license since those source files still show the Apache license.

Aside: Extended maintenance sounds good, but it moves us from open to closed source and is expensive for a small company to license as we originally were AGPL ourselves (and our commercial licenses are inexpensive in comparison). We are looking at this along with upgrading to Vaadin 23/24 (I think) using their migration tools, but we previously did a lot of work going from V6 to V7, and then again from V7 to V8 (even with the compatibility library and we're still using Table over Grid) and our CKEDITOR add-on plus integrating all the other V8 addons we use, and it was unclear if the effort/expense was worth it for us.

thevaadinman commented 6 days ago

Good to hear you got it working!

Instead of search and replace, you can use Maven to set versions for you: mvn versions:set -DnewVersion=8.14.3 -DprocessAllModules

You will not be able to build zips or jars that match the hashes of the ones released by us, unless you use the exact same toolchain we used. At this point, it's unlikely that even we could do that with reasonable effort due to the amount of variables involved. Just know that the source code that was used to build Vaadin Framework 8.14.3 is all here, in this repository, in its entirety. You can get the exact tree by checking out the 8.14.3 tag.

And yes, we have made plenty of changes to the private branch of Framework, which you can read the highlights of here: https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md The changes are not added to the public repository, but because some organizations watch this repository we create "releases" out of the change logs in order to create release notifications that things like CI systems can watch. This creates a new tag every tlme we do it. However, the source code has (to my knowledge) not changed since 8.14.3.

As for the price of extended maintenance and migration, these are both services that Vaadin offers. I suggest you contact our sales department and explain your situation, they may well be able to work out a customized deal with you that makes both parties happy.

OpenESignForms commented 6 days ago

Yes, we are working with Vaadin now to see what the migration effort estimate and costs might be. Thanks again. I guess I can close this issue now.

OpenESignForms commented 5 days ago

Is there a way to do "Instead of search and replace, you can use Maven to set versions for you: mvn versions:set -DnewVersion=8.14.3 -DprocessAllModules" these via Eclipse? We're not using 'mvn' command line.

TatuLund commented 5 days ago

Yes

Select root pom.xml and use "Run As" / "Maven build..."

image

OpenESignForms commented 5 days ago

Thank you.

There always seems to be an additional step I'm missing. In this case, I wanted to rebuild 8.14.3 as 8.14.4 to show it's our own build, and the maven versions:set seemed to do this for the various JARs, but at runtime, I get a warning (though no known issue) about this not matching the widgetset version, which I'm not sure where that's set or how I can also upgrade it.

Jun 23, 2024 10:22:38 PM com.vaadin.server.communication.ServerRpcHandler checkWidgetsetVersion
WARNING: 
=================================================================
The widgetset in use does not seem to be built for the Vaadin
version in use. This might cause strange problems - a
recompile/deploy is strongly recommended.
 Vaadin version: 8.14.4
 Widgetset version: 8.14.3
=================================================================
thevaadinman commented 5 days ago

Add clean as the first goal to the Maven parameters when building. The widgetset is not recompiled unless source file changes are detected.

OpenESignForms commented 5 days ago

Ah, I presume that 'clean' part means when building my app's widgetset, or is that just for the Vaadin framework compilation? I think I've used clean on the Vaadin framework maven build because I first ran it as 8.14.3 (just a pure rebuild), but now prepping for any future possible bug/patch release we'd want to create.

If it's my app that needs to be set to 8.14.4, this will bring up my next "issue" since there is no actual 8.14.4 version available via Maven (and our JARs are in maven, though perhaps we should?). Since we don't expect to ever change any Vaadin 8.14 API/method names/params, we still have been building our app with 8.14.3 setup in our pom.xml:

        <vaadin.version>8.14.3</vaadin.version>
        <vaadin.plugin.version>8.14.3</vaadin.plugin.version>

Is there a way to trick my app's build to think it's using 8.14.4 for the widgetset while actually just doing the maven builds on the official 8.14.3 version? Or will I need to put my build of 8.14.4 JARs into my app's fixed set of JARs (those without access via maven -- or find a way to add to maven with our own groupid) and then update my pom.xml to remove references to the Vaadin JARs, which I think are these entries:

        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-compatibility-server</artifactId>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-push</artifactId>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-compatibility-client</artifactId>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-compatibility-client-compiled</artifactId>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-compatibility-shared</artifactId>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-themes</artifactId>
        </dependency>

At this point, I think I'm just looking for the right strategy to try out so my app's that actually will always use the API/methods of Vaadin framework 8.14.3, but running with our patched JARs (that will have incremented point version numbers). Thanks for your help!