From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id qMHEMG1ZmF+TFQAA0tVLHw (envelope-from ) for ; Tue, 27 Oct 2020 17:31:25 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id 4AOLLG1ZmF9PEAAAbx9fmQ (envelope-from ) for ; Tue, 27 Oct 2020 17:31:25 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 675FA9404E0 for ; Tue, 27 Oct 2020 17:31:25 +0000 (UTC) Received: from localhost ([::1]:59272 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kXSoe-0001am-1l for larch@yhetil.org; Tue, 27 Oct 2020 13:31:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:40174) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kXSoS-0001aa-6i for guix-devel@gnu.org; Tue, 27 Oct 2020 13:31:12 -0400 Received: from lepiller.eu ([89.234.186.109]:40650) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kXSoM-0002Yo-ED for guix-devel@gnu.org; Tue, 27 Oct 2020 13:31:11 -0400 Received: from lepiller.eu (localhost [127.0.0.1]) by lepiller.eu (OpenSMTPD) with ESMTP id eb64cb2b for ; Tue, 27 Oct 2020 17:30:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=lepiller.eu; h=date:from :to:subject:message-id:mime-version:content-type :content-transfer-encoding; s=dkim; bh=EDLPh+DqXISuQCuvndt4yJeU2 nJQkCi9RzYnCT3w1gY=; b=CmfDSFhShWBc4Q4pE/OmlpFno7vE2Oux4i4N7rT71 +x/YtC3Ayy4oP98k8A0FF75WV6id9u3EQH4qK4NjC6dY7ZrW4oJuHgQEbz7Kw/Za 96hPw4/uHKp6e2FYmV9F8nmNEADtYT6xky4pUnBqmEnSKMZNQF869UHpvty/3ncf chYEFkGDW7hie+aAENIKSuw2ZFThbQy771m+qjvw/OmTNPggjuqkIZObLhKMf+WO cOFUiq1KAm+x9hI4VKajpxH/HH37d8AXrBtUna0oXEqNIn1yzRGHvYMaOybgIZ9J AmUDjQLlSPwfKRJ0wApjsdRUf5+aEh68C6RjB4c6VVMgg== Received: by lepiller.eu (OpenSMTPD) with ESMTPSA id ee2adb2b (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO) for ; Tue, 27 Oct 2020 17:30:59 +0000 (UTC) Date: Tue, 27 Oct 2020 18:30:47 +0100 From: Julien Lepiller To: guix-devel@gnu.org Subject: [TALK PROPOSAL] Bootstrapping the Java Ecosystem Message-ID: <20201027183047.50b32995@tachikoma.lepiller.eu> X-Mailer: Claws Mail 3.17.7 (GTK+ 2.24.32; x86_64-unknown-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Received-SPF: pass client-ip=89.234.186.109; envelope-from=julien@lepiller.eu; helo=lepiller.eu X-detected-operating-system: by eggs.gnu.org: First seen = 2020/10/27 13:31:01 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Scanner: scn0 Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=lepiller.eu header.s=dkim header.b=CmfDSFhS; dmarc=pass (policy=none) header.from=lepiller.eu; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Spam-Score: -1.71 X-TUID: l6S7dsHkDRYZ Hi Guix! So, I guess we need to start collecting talk proposals for the online Guix Day in November. Here's mine :) I'd like to talk about the Maven bootstrap and the Maven Build System. Ensuring that software is built entirely from source is an essential practice to ensure user Freedom, as well as for auditability and security. Unfortunately, the Java ecosystem is very complex and presents some interesting challenges when building from source. One of these challenges is Maven, a build tool and package manager that is used by many if not most of the Java developpers nowadays. One key challenge is that Maven is itself a Java package, that is built with Maven and has a lot of dependencies, that themselves use Maven. My talk will present the current state of the bootstrap and how we break the various dependency cycles that occur. The recent addition of the maven build system is a major step towards a good support of the Java ecosystem in Guix. We will discuss how Maven works, what it expects, and how Guix can accomodate it to build offline, reproducibly, with no trusted binary. I hope this talk will not only give you a good overview of how maven's bootstrap is done, but also give you ideas and directions to implement similar bootstrap stories for other ecosystems.