On 8/16/11 11:29 AM, Andrew Lee Rubinger wrote:
On 08/16/2011 09:33 AM, Jason T. Greene wrote:
> On 8/16/11 2:51 AM, Andrew Lee Rubinger wrote:
>> In short:
>>
>>
https://issues.jboss.org/browse/AS7-1489
>>
https://issues.jboss.org/browse/AS7-1479
>>
https://issues.jboss.org/browse/AS7-1478
>>
https://issues.jboss.org/browse/AS7-1493
>>
>> ...are the issues I uncovered after moving to a restricted dependency
>> chain. With the status quo in place, issues like these go unnoticed.
>
> Yeah but no one made any attempt to verify this pom was correct.
Thanks for making my point for me. :) It's about maintenance. No one is
going to be verifying that these POMs are complete.
Even if we make some extra suite, who is going to think to go in there and add
@SecurityDomain to it? It was the testsuite which exposed that this was
needed, not a manual review.
No actually I didn't :) You do admit that the indirect process proposal
has holes (e.g. it does not catch a leaked API)? Right?
--
Jason T. Greene
JBoss AS Lead / EAP Platform Architect
JBoss, a division of Red Hat