From ozizka at redhat.com Wed May 4 15:55:35 2016 From: ozizka at redhat.com (Ondrej Zizka) Date: Wed, 4 May 2016 21:55:35 +0200 Subject: [windup-dev] New fernflower fork project In-Reply-To: <57236207.1060305@redhat.com> References: <57227F6A.5050706@redhat.com> <79cb0635-402b-c2f5-2dc6-76490d08b219@redhat.com> <57236207.1060305@redhat.com> Message-ID: <572A53B7.1050201@redhat.com> Could this be outside windup/windup repo? It makes the build take longer. Ondra On 29.4.2016 15:30, Jess Sightler wrote: > Sort of. The code is all directly from the upstream repo (with history). > The pom is a slightly modified version of the one we have in > windup/forks/fernflower. > > On 04/29/2016 03:58 AM, Marek Novotny wrote: >> Just to confirm for myself, that is based on what we have here >> https://github.com/windup/windup/tree/master/forks/fernflower, right? >> >> On 28.4.2016 23:23, Jess Sightler wrote: >>> I have created a new project within Windup for maintaining a fork of >>> Fernflower with Java 7 compatibility and a Maven pom. Maybe we can start >>> releasing and keeping this up to date separately from windup core? >>> >>> It is here: >>> https://github.com/windup/windup-fernflower >>> >>> I think we can switch Windup to use this as part of 2.6.0, if noone >>> objects to that. >>> >>> >>> _______________________________________________ >>> windup-dev mailing list >>> windup-dev at lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/windup-dev >>> > _______________________________________________ > windup-dev mailing list > windup-dev at lists.jboss.org > https://lists.jboss.org/mailman/listinfo/windup-dev From jsightle at redhat.com Wed May 4 15:56:39 2016 From: jsightle at redhat.com (Jess Sightler) Date: Wed, 4 May 2016 15:56:39 -0400 Subject: [windup-dev] New fernflower fork project In-Reply-To: <572A53B7.1050201@redhat.com> References: <57227F6A.5050706@redhat.com> <79cb0635-402b-c2f5-2dc6-76490d08b219@redhat.com> <57236207.1060305@redhat.com> <572A53B7.1050201@redhat.com> Message-ID: <ae194efd-c8c7-d1da-c21d-ccd2c738489e@redhat.com> Yes. That was the entire point of this move after all. :) On 05/04/2016 03:55 PM, Ondrej Zizka wrote: > Could this be outside windup/windup repo? It makes the build take longer. > > Ondra > > > On 29.4.2016 15:30, Jess Sightler wrote: >> Sort of. The code is all directly from the upstream repo (with history). >> The pom is a slightly modified version of the one we have in >> windup/forks/fernflower. >> >> On 04/29/2016 03:58 AM, Marek Novotny wrote: >>> Just to confirm for myself, that is based on what we have here >>> https://github.com/windup/windup/tree/master/forks/fernflower, right? >>> >>> On 28.4.2016 23:23, Jess Sightler wrote: >>>> I have created a new project within Windup for maintaining a fork of >>>> Fernflower with Java 7 compatibility and a Maven pom. Maybe we can start >>>> releasing and keeping this up to date separately from windup core? >>>> >>>> It is here: >>>> https://github.com/windup/windup-fernflower >>>> >>>> I think we can switch Windup to use this as part of 2.6.0, if noone >>>> objects to that. >>>> >>>> >>>> _______________________________________________ >>>> windup-dev mailing list >>>> windup-dev at lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/windup-dev >>>> >> _______________________________________________ >> windup-dev mailing list >> windup-dev at lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/windup-dev > _______________________________________________ > windup-dev mailing list > windup-dev at lists.jboss.org > https://lists.jboss.org/mailman/listinfo/windup-dev From ozizka at redhat.com Wed May 4 22:48:33 2016 From: ozizka at redhat.com (Ondrej Zizka) Date: Thu, 5 May 2016 04:48:33 +0200 Subject: [windup-dev] New fernflower fork project In-Reply-To: <ae194efd-c8c7-d1da-c21d-ccd2c738489e@redhat.com> References: <57227F6A.5050706@redhat.com> <79cb0635-402b-c2f5-2dc6-76490d08b219@redhat.com> <57236207.1060305@redhat.com> <572A53B7.1050201@redhat.com> <ae194efd-c8c7-d1da-c21d-ccd2c738489e@redhat.com> Message-ID: <572AB481.2030306@redhat.com> All right I didn't read the whole thread... sorry for the noise ;) On 4.5.2016 21:56, Jess Sightler wrote: > Yes. That was the entire point of this move after all. :) > > > On 05/04/2016 03:55 PM, Ondrej Zizka wrote: >> Could this be outside windup/windup repo? It makes the build take longer. >> >> Ondra >> >> >> On 29.4.2016 15:30, Jess Sightler wrote: >>> Sort of. The code is all directly from the upstream repo (with history). >>> The pom is a slightly modified version of the one we have in >>> windup/forks/fernflower. >>> >>> On 04/29/2016 03:58 AM, Marek Novotny wrote: >>>> Just to confirm for myself, that is based on what we have here >>>> https://github.com/windup/windup/tree/master/forks/fernflower, right? >>>> >>>> On 28.4.2016 23:23, Jess Sightler wrote: >>>>> I have created a new project within Windup for maintaining a fork of >>>>> Fernflower with Java 7 compatibility and a Maven pom. Maybe we can start >>>>> releasing and keeping this up to date separately from windup core? >>>>> >>>>> It is here: >>>>> https://github.com/windup/windup-fernflower >>>>> >>>>> I think we can switch Windup to use this as part of 2.6.0, if noone >>>>> objects to that. >>>>> >>>>> >>>>> _______________________________________________ >>>>> windup-dev mailing list >>>>> windup-dev at lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/windup-dev >>>>> >>> _______________________________________________ >>> windup-dev mailing list >>> windup-dev at lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/windup-dev >> _______________________________________________ >> windup-dev mailing list >> windup-dev at lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/windup-dev > _______________________________________________ > windup-dev mailing list > windup-dev at lists.jboss.org > https://lists.jboss.org/mailman/listinfo/windup-dev From ozizka at redhat.com Wed May 4 22:58:21 2016 From: ozizka at redhat.com (Ondrej Zizka) Date: Thu, 5 May 2016 04:58:21 +0200 Subject: [windup-dev] Performance potential improvement - file pattern match, all paterns at once? Message-ID: <572AB6CD.9090402@redhat.com> Instead of scanning the files with every new rule with <filematches>, we could collect the patterns upfront and then iterate over all files and try all the patterns whose filename pattern matches for that file. The idea is that the system could keep this file cached / open for all passes. WDYT? And aren't we already doing it? (I didn't check) Ondra From jsightle at redhat.com Wed May 4 23:24:36 2016 From: jsightle at redhat.com (Jess Sightler) Date: Wed, 4 May 2016 23:24:36 -0400 Subject: [windup-dev] Performance potential improvement - file pattern match, all paterns at once? In-Reply-To: <572AB6CD.9090402@redhat.com> References: <572AB6CD.9090402@redhat.com> Message-ID: <e18a6bfd-ecd2-6052-b640-645130090659@redhat.com> I'm not sure how that would work with the stream-based regex solution that we are using? On 05/04/2016 10:58 PM, Ondrej Zizka wrote: > Instead of scanning the files with every new rule with <filematches>, we > could collect the patterns upfront and then iterate over all files and > try all the patterns whose filename pattern matches for that file. > The idea is that the system could keep this file cached / open for all > passes. > > WDYT? And aren't we already doing it? (I didn't check) > > Ondra > _______________________________________________ > windup-dev mailing list > windup-dev at lists.jboss.org > https://lists.jboss.org/mailman/listinfo/windup-dev From ozizka at redhat.com Thu May 5 23:18:07 2016 From: ozizka at redhat.com (Ondrej Zizka) Date: Fri, 6 May 2016 05:18:07 +0200 Subject: [windup-dev] <javaclass> docs Message-ID: <572C0CEF.5080907@redhat.com> Hi Andrea, I suggest that we refer to elements using the <element> notation so it's more clear that it's an element. I've made few changes to the wiki with that regard, see https://github.com/windup/windup/wiki/Rules-XML-Rule-When-Condition-Syntax WDYT? Ondra From ahoffer at redhat.com Fri May 6 08:23:49 2016 From: ahoffer at redhat.com (Andrea Hoffer) Date: Fri, 6 May 2016 08:23:49 -0400 (EDT) Subject: [windup-dev] <javaclass> docs In-Reply-To: <572C0CEF.5080907@redhat.com> References: <572C0CEF.5080907@redhat.com> Message-ID: <1435700971.44435193.1462537429734.JavaMail.zimbra@redhat.com> Ondra, I think your changes look good, thanks! I'll update other instances as well when I see them going through the docs. Andrea ----- Original Message ----- > From: "Ondrej Zizka" <ozizka at redhat.com> > To: "Andrea Hoffer" <ahoffer at redhat.com>, "Windup-dev List" <windup-dev at lists.jboss.org> > Sent: Thursday, May 5, 2016 11:18:07 PM > Subject: <javaclass> docs > > Hi Andrea, > > I suggest that we refer to elements using the <element> notation so it's > more clear that it's an element. > I've made few changes to the wiki with that regard, see > > https://github.com/windup/windup/wiki/Rules-XML-Rule-When-Condition-Syntax > > WDYT? > > Ondra > From ozizka at redhat.com Mon May 16 10:20:28 2016 From: ozizka at redhat.com (Ondrej Zizka) Date: Mon, 16 May 2016 16:20:28 +0200 Subject: [windup-dev] Fwd: [wildfly-dev] update on WildFly NoSQL prototype integration... In-Reply-To: <bf184686-ccbb-f6bf-3ce5-db00cb54bf6c@redhat.com> References: <bf184686-ccbb-f6bf-3ce5-db00cb54bf6c@redhat.com> Message-ID: <5739D72C.8060608@redhat.com> -------- Forwarded Message -------- Subject: [wildfly-dev] update on WildFly NoSQL prototype integration... Date: Wed, 4 May 2016 14:16:31 -0400 From: Scott Marlow <smarlow at redhat.com> To: WildFly Dev List <wildfly-dev at lists.jboss.org> Hi, Below is an update on the WildFly NoSQL integration project. The goal is for deployed applications to have access to NoSQL databases (via Hibernate OGM or native APIs). Items 1-4, should be finished in our first pass, with as much of the others items as we can do as well. 1. connection management will deal with obtaining NoSQL connections for application use. - borrow/share Hibernate OGM connection configuration setup code - authentication integration - support transport level security 2. CDI programming simplifications will make it easy to inject NoSQL data into your application classes. - https://github.com/antoinesd/javaee-nosql is initial idea 3. You will easily get a native NoSQL connection from the specified NoSQL profile and use the native NOSQL (Cassandra/MongoDB/other) API in your application. 4. You will also be able to easily use Hibernate OGM with the defined NoSQL profiles (exactly how is TBD but will be awesome :-). - Hibernate OGM static module is included. - need to align with OGM dependencies (e.g. Hibernate ORM + other dependencies). - as mentioned above, OGM already has some connection setup code, which might be good to share for WildFly + standalone NoSQL use. - once WildFly has a common NoSQLSource (not a DataSource) that OGM can use, OGM will be enhanced to use it. 5. How best for the WildFly NoSQL subsystem to be optional? - Is it enough to not run the wildfly/testsuite/nosql tests by default? - Or do we need to start a separate https://github.com/wildfly/nosql project for the NoSQL subsystems? 6. transaction enlistment 7. compensating transactions 8. runtime application monitoring 9. How soon can we make an evaluation distribution available for use on OpenStack/OpenShift? - Would be great if we could do some load testing with all NoSQL components. - Would be great if we could enable others to also test. 10. Are there any problems with our WildFly NoSQL subsystem injecting MongoDatabase connections via: @Resource(lookup = "java:jboss/mongodb/test") MongoDatabase db; - No @Resource support expected for standalone Java, TBD is whether a runtime library can be used. - Any problems expected on other EE application servers if this approach becomes popular? 11. WIP topic branch is at https://github.com/scottmarlow/wildfly/tree/nosql-dev9. Note that every once in a while, commits are squashed and pushed to nosql-devN+1. 12. Add proper unit tests - multi-threaded NoSQL access to show that works at all. - use NoSQL from different EE components (e.g. JAX-RS). - other use cases that represent how NoSQL could be used from WildFly. Feedback/help is welcome! Thanks, Scott _______________________________________________ wildfly-dev mailing list wildfly-dev at lists.jboss.org https://lists.jboss.org/mailman/listinfo/wildfly-dev -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.jboss.org/pipermail/windup-dev/attachments/20160516/1a022d6f/attachment-0001.html From ozizka at redhat.com Thu May 19 22:22:11 2016 From: ozizka at redhat.com (Ondrej Zizka) Date: Fri, 20 May 2016 04:22:11 +0200 Subject: [windup-dev] Docs for duplicated archives handling Message-ID: <573E74D3.7090303@redhat.com> Hi Andrea, there's a new feature - dupl archives handling. Story 120 in Taiga https://tree.taiga.io/project/rdruss-jboss-migration-windup-v3/us/120 PR: https://github.com/windup/windup/pull/936 There's no Jira so I am not sure where to put the documentation notes, so at least letting you know this way. It will need a note in the Report Index description like this: For non-source mode (when scanning an app archives), the aggregated issue counts and story points in tables and charts are taking duplicated sub-archives into account, so that an application module which appears in multiple applications or more than once in one application is only counted once into the migration effort. Ondra From ozizka at redhat.com Thu May 19 22:38:09 2016 From: ozizka at redhat.com (Ondrej Zizka) Date: Fri, 20 May 2016 04:38:09 +0200 Subject: [windup-dev] Docs for duplicated archives handling In-Reply-To: <573E74D3.7090303@redhat.com> References: <573E74D3.7090303@redhat.com> Message-ID: <573E7891.9030007@redhat.com> I forgot - the discussion is at https://docs.google.com/document/d/1L8ztKgg5t33VTnt1xiisDZlavYX8ozQyo0xqVSk1a9Y/edit#heading=h.qwu6qlmk26cg but I think for the docs purposes, the paragraph (updated) below is just enough. Team - do you agree? Ondra On 20.5.2016 04:22, Ondrej Zizka wrote: > Hi Andrea, > > there's a new feature - dupl archives handling. > Story 120 in Taiga > https://tree.taiga.io/project/rdruss-jboss-migration-windup-v3/us/120 > PR: https://github.com/windup/windup/pull/936 > There's no Jira so I am not sure where to put the documentation notes, > so at least letting you know this way. > > It will need a note in the Report Index description like this: > > For non-source mode (when scanning an app archives), the aggregated > issue counts and story points in tables and charts are taking duplicated > sub-archives into account, so that an application module which appears > in multiple applications or more than once in one application is only > counted once into the migration effort. For binary mode (when scanning an app archives), the aggregated incident counts and story points in tables and charts are taking the duplicated sub-archives into account. So an application module which appears in multiple applications or more than once in one application is only counted once into the migration effort. Therefore, the totals on this page may be lower than simple sums of all individual applications. > > Ondra > _______________________________________________ > windup-dev mailing list > windup-dev at lists.jboss.org > https://lists.jboss.org/mailman/listinfo/windup-dev From dansmit at redhat.com Fri May 20 06:40:36 2016 From: dansmit at redhat.com (Dan Smith) Date: Fri, 20 May 2016 06:40:36 -0400 Subject: [windup-dev] Docs for duplicated archives handling In-Reply-To: <573E7891.9030007@redhat.com> References: <573E74D3.7090303@redhat.com> <573E7891.9030007@redhat.com> Message-ID: <CAHBrnA=r+TgKmpKZgmDoZdcVt+xTBBaAYTtdhpE_a5qQBKirtw@mail.gmail.com> I created WINDUP-1037 for documenting this feature, just linked it back to WINDUP-963. On Thu, May 19, 2016 at 10:38 PM, Ondrej Zizka <ozizka at redhat.com> wrote: > I forgot - the discussion is at > > https://docs.google.com/document/d/1L8ztKgg5t33VTnt1xiisDZlavYX8ozQyo0xqVSk1a9Y/edit#heading=h.qwu6qlmk26cg > but I think for the docs purposes, the paragraph (updated) below is just > enough. > > Team - do you agree? > > Ondra > > On 20.5.2016 04:22, Ondrej Zizka wrote: > > Hi Andrea, > > > > there's a new feature - dupl archives handling. > > Story 120 in Taiga > > https://tree.taiga.io/project/rdruss-jboss-migration-windup-v3/us/120 > > PR: https://github.com/windup/windup/pull/936 > > There's no Jira so I am not sure where to put the documentation notes, > > so at least letting you know this way. > > > > It will need a note in the Report Index description like this: > > > > For non-source mode (when scanning an app archives), the aggregated > > issue counts and story points in tables and charts are taking duplicated > > sub-archives into account, so that an application module which appears > > in multiple applications or more than once in one application is only > > counted once into the migration effort. > > For binary mode (when scanning an app archives), the aggregated > incident counts and story points in tables and charts are taking the > duplicated > sub-archives into account. So an application module which appears > in multiple applications or more than once in one application is only > counted once into the migration effort. > Therefore, the totals on this page may be lower than simple sums of all > individual applications. > > > > > Ondra > > _______________________________________________ > > windup-dev mailing list > > windup-dev at lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/windup-dev > > _______________________________________________ > windup-dev mailing list > windup-dev at lists.jboss.org > https://lists.jboss.org/mailman/listinfo/windup-dev > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.jboss.org/pipermail/windup-dev/attachments/20160520/1c0357e1/attachment.html From ahoffer at redhat.com Fri May 20 08:24:31 2016 From: ahoffer at redhat.com (Andrea Hoffer) Date: Fri, 20 May 2016 08:24:31 -0400 (EDT) Subject: [windup-dev] Docs for duplicated archives handling In-Reply-To: <CAHBrnA=r+TgKmpKZgmDoZdcVt+xTBBaAYTtdhpE_a5qQBKirtw@mail.gmail.com> References: <573E74D3.7090303@redhat.com> <573E7891.9030007@redhat.com> <CAHBrnA=r+TgKmpKZgmDoZdcVt+xTBBaAYTtdhpE_a5qQBKirtw@mail.gmail.com> Message-ID: <1782021627.48374977.1463747071428.JavaMail.zimbra@redhat.com> Thanks Ondra for the information and Dan for the docs JIRA. Ondra, are there any pieces of this functionality that are not yet completed? I see the PR has been merged, but WINDUP-963 is still open. Thanks! Andrea ----- Original Message ----- > From: "Dan Smith" <dansmit at redhat.com> > To: "Windup-dev List" <windup-dev at lists.jboss.org> > Cc: "Andrea Hoffer" <ahoffer at redhat.com> > Sent: Friday, May 20, 2016 6:40:36 AM > Subject: Re: [windup-dev] Docs for duplicated archives handling > > I created WINDUP-1037 for documenting this feature, just linked it back to > WINDUP-963. > > On Thu, May 19, 2016 at 10:38 PM, Ondrej Zizka <ozizka at redhat.com> wrote: > > > I forgot - the discussion is at > > > > https://docs.google.com/document/d/1L8ztKgg5t33VTnt1xiisDZlavYX8ozQyo0xqVSk1a9Y/edit#heading=h.qwu6qlmk26cg > > but I think for the docs purposes, the paragraph (updated) below is just > > enough. > > > > Team - do you agree? > > > > Ondra > > > > On 20.5.2016 04:22, Ondrej Zizka wrote: > > > Hi Andrea, > > > > > > there's a new feature - dupl archives handling. > > > Story 120 in Taiga > > > https://tree.taiga.io/project/rdruss-jboss-migration-windup-v3/us/120 > > > PR: https://github.com/windup/windup/pull/936 > > > There's no Jira so I am not sure where to put the documentation notes, > > > so at least letting you know this way. > > > > > > It will need a note in the Report Index description like this: > > > > > > For non-source mode (when scanning an app archives), the aggregated > > > issue counts and story points in tables and charts are taking duplicated > > > sub-archives into account, so that an application module which appears > > > in multiple applications or more than once in one application is only > > > counted once into the migration effort. > > > > For binary mode (when scanning an app archives), the aggregated > > incident counts and story points in tables and charts are taking the > > duplicated > > sub-archives into account. So an application module which appears > > in multiple applications or more than once in one application is only > > counted once into the migration effort. > > Therefore, the totals on this page may be lower than simple sums of all > > individual applications. > > > > > > > > Ondra > > > _______________________________________________ > > > windup-dev mailing list > > > windup-dev at lists.jboss.org > > > https://lists.jboss.org/mailman/listinfo/windup-dev > > > > _______________________________________________ > > windup-dev mailing list > > windup-dev at lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/windup-dev > > > From dansmit at redhat.com Fri May 20 08:32:24 2016 From: dansmit at redhat.com (Dan Smith) Date: Fri, 20 May 2016 08:32:24 -0400 Subject: [windup-dev] Docs for duplicated archives handling In-Reply-To: <1782021627.48374977.1463747071428.JavaMail.zimbra@redhat.com> References: <573E74D3.7090303@redhat.com> <573E7891.9030007@redhat.com> <CAHBrnA=r+TgKmpKZgmDoZdcVt+xTBBaAYTtdhpE_a5qQBKirtw@mail.gmail.com> <1782021627.48374977.1463747071428.JavaMail.zimbra@redhat.com> Message-ID: <CAHBrnA=-73qS5bHDFMueus+RK_CUqUkLwW58RB7O0K8roaOkXg@mail.gmail.com> If I understand correctly as the last merged PR just finishes 1 of the 3 reports and the other 2 are still in progress. But I could be out of date, things seem to start and finish quickly :) On Fri, May 20, 2016 at 8:24 AM, Andrea Hoffer <ahoffer at redhat.com> wrote: > Thanks Ondra for the information and Dan for the docs JIRA. Ondra, are > there any pieces of this functionality that are not yet completed? I see > the PR has been merged, but WINDUP-963 is still open. > > Thanks! > > Andrea > > ----- Original Message ----- > > From: "Dan Smith" <dansmit at redhat.com> > > To: "Windup-dev List" <windup-dev at lists.jboss.org> > > Cc: "Andrea Hoffer" <ahoffer at redhat.com> > > Sent: Friday, May 20, 2016 6:40:36 AM > > Subject: Re: [windup-dev] Docs for duplicated archives handling > > > > I created WINDUP-1037 for documenting this feature, just linked it back > to > > WINDUP-963. > > > > On Thu, May 19, 2016 at 10:38 PM, Ondrej Zizka <ozizka at redhat.com> > wrote: > > > > > I forgot - the discussion is at > > > > > > > https://docs.google.com/document/d/1L8ztKgg5t33VTnt1xiisDZlavYX8ozQyo0xqVSk1a9Y/edit#heading=h.qwu6qlmk26cg > > > but I think for the docs purposes, the paragraph (updated) below is > just > > > enough. > > > > > > Team - do you agree? > > > > > > Ondra > > > > > > On 20.5.2016 04:22, Ondrej Zizka wrote: > > > > Hi Andrea, > > > > > > > > there's a new feature - dupl archives handling. > > > > Story 120 in Taiga > > > > > https://tree.taiga.io/project/rdruss-jboss-migration-windup-v3/us/120 > > > > PR: https://github.com/windup/windup/pull/936 > > > > There's no Jira so I am not sure where to put the documentation > notes, > > > > so at least letting you know this way. > > > > > > > > It will need a note in the Report Index description like this: > > > > > > > > For non-source mode (when scanning an app archives), the aggregated > > > > issue counts and story points in tables and charts are taking > duplicated > > > > sub-archives into account, so that an application module which > appears > > > > in multiple applications or more than once in one application is only > > > > counted once into the migration effort. > > > > > > For binary mode (when scanning an app archives), the aggregated > > > incident counts and story points in tables and charts are taking the > > > duplicated > > > sub-archives into account. So an application module which appears > > > in multiple applications or more than once in one application is only > > > counted once into the migration effort. > > > Therefore, the totals on this page may be lower than simple sums of all > > > individual applications. > > > > > > > > > > > Ondra > > > > _______________________________________________ > > > > windup-dev mailing list > > > > windup-dev at lists.jboss.org > > > > https://lists.jboss.org/mailman/listinfo/windup-dev > > > > > > _______________________________________________ > > > windup-dev mailing list > > > windup-dev at lists.jboss.org > > > https://lists.jboss.org/mailman/listinfo/windup-dev > > > > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.jboss.org/pipermail/windup-dev/attachments/20160520/6b889136/attachment.html From jsightle at redhat.com Fri May 20 10:52:30 2016 From: jsightle at redhat.com (Jess Sightler) Date: Fri, 20 May 2016 10:52:30 -0400 Subject: [windup-dev] Docs for duplicated archives handling In-Reply-To: <1782021627.48374977.1463747071428.JavaMail.zimbra@redhat.com> References: <573E74D3.7090303@redhat.com> <573E7891.9030007@redhat.com> <CAHBrnA=r+TgKmpKZgmDoZdcVt+xTBBaAYTtdhpE_a5qQBKirtw@mail.gmail.com> <1782021627.48374977.1463747071428.JavaMail.zimbra@redhat.com> Message-ID: <cdabf9c7-9636-b4b8-e1d2-92ccd4d2f456@redhat.com> Yes, there are more significant changes to the reports surrounding this. The application details report changes are more extensive and more complicated. It might be worth waiting on that to start the documentation? On 05/20/2016 08:24 AM, Andrea Hoffer wrote: > Thanks Ondra for the information and Dan for the docs JIRA. Ondra, are there any pieces of this functionality that are not yet completed? I see the PR has been merged, but WINDUP-963 is still open. > > Thanks! > > Andrea > > ----- Original Message ----- >> From: "Dan Smith" <dansmit at redhat.com> >> To: "Windup-dev List" <windup-dev at lists.jboss.org> >> Cc: "Andrea Hoffer" <ahoffer at redhat.com> >> Sent: Friday, May 20, 2016 6:40:36 AM >> Subject: Re: [windup-dev] Docs for duplicated archives handling >> >> I created WINDUP-1037 for documenting this feature, just linked it back to >> WINDUP-963. >> >> On Thu, May 19, 2016 at 10:38 PM, Ondrej Zizka <ozizka at redhat.com> wrote: >> >>> I forgot - the discussion is at >>> >>> https://docs.google.com/document/d/1L8ztKgg5t33VTnt1xiisDZlavYX8ozQyo0xqVSk1a9Y/edit#heading=h.qwu6qlmk26cg >>> but I think for the docs purposes, the paragraph (updated) below is just >>> enough. >>> >>> Team - do you agree? >>> >>> Ondra >>> >>> On 20.5.2016 04:22, Ondrej Zizka wrote: >>>> Hi Andrea, >>>> >>>> there's a new feature - dupl archives handling. >>>> Story 120 in Taiga >>>> https://tree.taiga.io/project/rdruss-jboss-migration-windup-v3/us/120 >>>> PR: https://github.com/windup/windup/pull/936 >>>> There's no Jira so I am not sure where to put the documentation notes, >>>> so at least letting you know this way. >>>> >>>> It will need a note in the Report Index description like this: >>>> >>>> For non-source mode (when scanning an app archives), the aggregated >>>> issue counts and story points in tables and charts are taking duplicated >>>> sub-archives into account, so that an application module which appears >>>> in multiple applications or more than once in one application is only >>>> counted once into the migration effort. >>> For binary mode (when scanning an app archives), the aggregated >>> incident counts and story points in tables and charts are taking the >>> duplicated >>> sub-archives into account. So an application module which appears >>> in multiple applications or more than once in one application is only >>> counted once into the migration effort. >>> Therefore, the totals on this page may be lower than simple sums of all >>> individual applications. >>> >>>> Ondra >>>> _______________________________________________ >>>> windup-dev mailing list >>>> windup-dev at lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/windup-dev >>> _______________________________________________ >>> windup-dev mailing list >>> windup-dev at lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/windup-dev >>> > _______________________________________________ > windup-dev mailing list > windup-dev at lists.jboss.org > https://lists.jboss.org/mailman/listinfo/windup-dev From ahoffer at redhat.com Fri May 20 11:11:09 2016 From: ahoffer at redhat.com (Andrea Hoffer) Date: Fri, 20 May 2016 11:11:09 -0400 (EDT) Subject: [windup-dev] Docs for duplicated archives handling In-Reply-To: <cdabf9c7-9636-b4b8-e1d2-92ccd4d2f456@redhat.com> References: <573E74D3.7090303@redhat.com> <573E7891.9030007@redhat.com> <CAHBrnA=r+TgKmpKZgmDoZdcVt+xTBBaAYTtdhpE_a5qQBKirtw@mail.gmail.com> <1782021627.48374977.1463747071428.JavaMail.zimbra@redhat.com> <cdabf9c7-9636-b4b8-e1d2-92ccd4d2f456@redhat.com> Message-ID: <492760523.48458189.1463757069072.JavaMail.zimbra@redhat.com> Thanks Jess, that's what I'm thinking. You guys can just let me know when the functionality is complete, and then I'll look to update the docs. Andrea ----- Original Message ----- > From: "Jess Sightler" <jsightle at redhat.com> > To: windup-dev at lists.jboss.org > Sent: Friday, May 20, 2016 10:52:30 AM > Subject: Re: [windup-dev] Docs for duplicated archives handling > > Yes, there are more significant changes to the reports surrounding this. > The application details report changes are more extensive and more > complicated. It might be worth waiting on that to start the documentation? > > > On 05/20/2016 08:24 AM, Andrea Hoffer wrote: > > Thanks Ondra for the information and Dan for the docs JIRA. Ondra, are > > there any pieces of this functionality that are not yet completed? I see > > the PR has been merged, but WINDUP-963 is still open. > > > > Thanks! > > > > Andrea > > > > ----- Original Message ----- > >> From: "Dan Smith" <dansmit at redhat.com> > >> To: "Windup-dev List" <windup-dev at lists.jboss.org> > >> Cc: "Andrea Hoffer" <ahoffer at redhat.com> > >> Sent: Friday, May 20, 2016 6:40:36 AM > >> Subject: Re: [windup-dev] Docs for duplicated archives handling > >> > >> I created WINDUP-1037 for documenting this feature, just linked it back to > >> WINDUP-963. > >> > >> On Thu, May 19, 2016 at 10:38 PM, Ondrej Zizka <ozizka at redhat.com> wrote: > >> > >>> I forgot - the discussion is at > >>> > >>> https://docs.google.com/document/d/1L8ztKgg5t33VTnt1xiisDZlavYX8ozQyo0xqVSk1a9Y/edit#heading=h.qwu6qlmk26cg > >>> but I think for the docs purposes, the paragraph (updated) below is just > >>> enough. > >>> > >>> Team - do you agree? > >>> > >>> Ondra > >>> > >>> On 20.5.2016 04:22, Ondrej Zizka wrote: > >>>> Hi Andrea, > >>>> > >>>> there's a new feature - dupl archives handling. > >>>> Story 120 in Taiga > >>>> https://tree.taiga.io/project/rdruss-jboss-migration-windup-v3/us/120 > >>>> PR: https://github.com/windup/windup/pull/936 > >>>> There's no Jira so I am not sure where to put the documentation notes, > >>>> so at least letting you know this way. > >>>> > >>>> It will need a note in the Report Index description like this: > >>>> > >>>> For non-source mode (when scanning an app archives), the aggregated > >>>> issue counts and story points in tables and charts are taking duplicated > >>>> sub-archives into account, so that an application module which appears > >>>> in multiple applications or more than once in one application is only > >>>> counted once into the migration effort. > >>> For binary mode (when scanning an app archives), the aggregated > >>> incident counts and story points in tables and charts are taking the > >>> duplicated > >>> sub-archives into account. So an application module which appears > >>> in multiple applications or more than once in one application is only > >>> counted once into the migration effort. > >>> Therefore, the totals on this page may be lower than simple sums of all > >>> individual applications. > >>> > >>>> Ondra > >>>> _______________________________________________ > >>>> windup-dev mailing list > >>>> windup-dev at lists.jboss.org > >>>> https://lists.jboss.org/mailman/listinfo/windup-dev > >>> _______________________________________________ > >>> windup-dev mailing list > >>> windup-dev at lists.jboss.org > >>> https://lists.jboss.org/mailman/listinfo/windup-dev > >>> > > _______________________________________________ > > windup-dev mailing list > > windup-dev at lists.jboss.org > > https://lists.jboss.org/mailman/listinfo/windup-dev > > _______________________________________________ > windup-dev mailing list > windup-dev at lists.jboss.org > https://lists.jboss.org/mailman/listinfo/windup-dev > From ozizka at redhat.com Tue May 31 11:08:38 2016 From: ozizka at redhat.com (Ondrej Zizka) Date: Tue, 31 May 2016 17:08:38 +0200 Subject: [windup-dev] [JBoss Migration Community of Practice] New message: "JBoss EAP Migration: discovering unsupported application libraries" In-Reply-To: <CA+Bbw+YeMdi2M3p5=Wqy4tqN+zdbRX8hYiOMH=OfSGD3KvpDpg@mail.gmail.com> References: <31DC2180-FE64-442E-949E-BE47C8E46A9A@redhat.com> <562B98C5-ABCA-4103-B03E-AEB1DA45E068@redhat.com> <CAJ=9Mxc2dpY4PSYfyfnn7hMJn54rW7Svk-8P=5t-Bsm0USVG1Q@mail.gmail.com> <BCF6FE9C-79F3-4025-A5BC-4A36912D7286@redhat.com> <56D87A62.8040900@redhat.com> <56DD9FAE.5080702@redhat.com> <EE092AF5-48EE-4102-981A-16E5D505052F@redhat.com> <56DF8D51.2020303@redhat.com> <DF5E9929-C7E9-4FBC-8BB0-D04359CAE670@redhat.com> <56E03EBD.8040600@redhat.com> <CA+Bbw+Z9ai4Jp7+vWVWbvsuC+nsFRzPswTkL_P+fPhrq-BzjQg@mail.gmail.com> <56FD448F.1040902@redhat.com> <CA+Bbw+YeMdi2M3p5=Wqy4tqN+zdbRX8hYiOMH=OfSGD3KvpDpg@mail.gmail.com> Message-ID: <574DA8F6.6070102@redhat.com> Hi Jason, I have looked closer at V?ctims. I have few questions/issues. Could you please help resolving those? Note: I'm adding a PUBLIC mailing list, Windup developers. Feel free to add some Victims list (is there one?) 1) Hashes are not real checksums As someone wrote in https://github.com/victims/victims-cve-db/issues/45 the hashes used by Victims are not just SHA512 hashes of the file content, but something else. I'd like to be able to either find CVE's by a normal file content hash, or create the Victims hash. a) Is there a Java impl? b) Could you add the plain SHA512 (or other, I'm okay with just CRC32) hash to the data? 2) Victims Java client API The Java API doesn't match the needs much. From what I can see, it can a) Sync with the server b) Give me a list of CVE for given SHA512 hash. What I would like to have is: * Have some offline data distributed with our app, provide these data * Search the database by Maven coordinates, classes, * Get a short description of the CVE and date of appearance and how/where it was fixed Is there a plan for extending the Java API? Also I guess not all these are covered in the Victims database, right? 3) Configuration The configuration is done through system properties, that's not too fortunate. For instance it doesn't allow to run multiple clients at once in the same JVM. Could that be done through an API? 4) Data structure The data structure of the JSON is not obvious. Is there some docs for it? 5) Data storage The data are only stored in a database. Could it be simply stored in a JSON or XML file? The file is just 165 KB and not growing too fast, so I think rather than bringing an embedded DB as a dependency, I'd prefer to process a XML file into a HashMap or a Lucene index and use that. Thanks, Ondra On 4.4.2016 02:16, Jason Shepherd wrote: > Hi Ondra, > > The architecture of Victims is such that you should never need to > 'download' the database. The client is designed to connect to the > central http://victi.ms API to get the latest vulnerabilities. > > That being said, the authors also have a 'backup' of the data in the > form of a Github repository, [1]. In fact some members of the > community have built a tool which just uses this repository, and does > not use the API at all. Recently we've built a tool to rebuild the > database from the Github repository, but it still needs some work, > [3]. > > [1] https://github.com/victims/victims-cve-db > [2] https://github.com/h3xstream/maven-security-versions > [3] https://github.com/jasinner/victims-db-builder > > Let me know if you need any further information. > Regards, > Jason Shepherd > > On Fri, Apr 1, 2016 at 1:38 AM, Ondrej Zizka <ozizka at redhat.com> wrote: >> Great to know it goes on, last time I talked to someone (I think djorm), he >> said the development was stagnant. >> >> Jason, is there a way to download a single big file with all data in the >> database? >> >> Thanks, >> Ondra >> >> >> >> >> On 10.3.2016 03:49, Jason Shepherd wrote: >> >> Hello Rodney, >> >> The Product Security team are still maintaining that project. It's part of >> our process to add new CVEs to the Victims Database when they are found. >> >> Also, if we've missed anything, you can add a library to the database >> yourself using the web interface at https://victim.ms >> >> Regards, >> Jason Shepherd >> >> On Thu, Mar 10, 2016 at 1:18 AM, Marek Novotny <mnovotny at redhat.com> wrote: >>> Why do you think nobody picked it up? >>> I can see there at least Stephen Milner, Jason Shepherd from RH. Are >>> they responsible for the data? I added them to CC. >>> >>> Also even from non-redhatter member there is the latest commit from 4th >>> January this year https://github.com/victims/victims-cve-db so it is not >>> really dead ;) >>> >>> >>> On 9.3.2016 16:07, Rodney Russ wrote: >>>> So, interestingly enough, this project was started from the security >>>> team within Red Hat. I believe the guy who started left Red Hat and no >>>> one has picked it up since. >>>> >>>> On 8 Mar 2016, at 19:41, Ondrej Zizka wrote: >>>> >>>>> Right, I think the lack of fresh data is the issue with it. I think it >>>>> needs someone at Red Hat adopting it and feeding with CVE's. Maybe GSS >>>>> could take care? Try to push it higher, that's a company-wide thing. >>>>> >>>>> Ondra >>>>> >>>>> >>>>> On 8.3.2016 00:06, Rodney Russ wrote: >>>>>> >>>>>> On 7 Mar 2016, at 8:35, Ondrej Zizka wrote: >>>>>> >>>>>>> We could use the same mechanism as with the Victims addon. Currently >>>>>>> it's not in the distribution, though. >>>>>> Was victims support something we wanted to move forward with? It >>>>>> doesn't look as active as it once was. >>>>>> >>>>>>> Ondra >>>>>>> >>>>>>> >>>>>>> On 3.3.2016 18:54, Jess Sightler wrote: >>>>>>>> We have a condition that can add application level messages for >>>>>>>> this. I think that would be better than a generic org.apache.axis >>>>>>>> catchall rule. For example, I think Axis2 uses the same packages >>>>>>>> but would not necessarily have the same issues. >>>>>>>> >>>>>>>> On 03/03/2016 03:38 AM, Rodney Russ wrote: >>>>>>>>> I agree that for the specific issue of Axis discussed, a rule >>>>>>>>> should be added to the catch-all rules. What I outlined below was >>>>>>>>> an answer to the question posed by Benjamin: >>>>>>>>> >>>>>>>>> "Aside from updating Windup with a new rule to scan for Axis in >>>>>>>>> particular, how can we discover these unsupported libraries up >>>>>>>>> front on future applications?". >>>>>>>>> >>>>>>>>> -Rodney >>>>>>>>> >>>>>>>>> On 2 Mar 2016, at 18:05, Robb Greathouse wrote: >>>>>>>>> >>>>>>>>>> We should add AXIS to the blacklist. Do the packages in Axis have >>>>>>>>>> a >>>>>>>>>> signature (such as .axis.) that we could add to the Catch-All >>>>>>>>>> rules? >>>>>>>>>> >>>>>>>>>> On Wed, Mar 2, 2016 at 4:12 PM, Rodney Russ <rruss at redhat.com> >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>>> I believe the conclusion we came to on irc earlier today was >>>>>>>>>>> that these >>>>>>>>>>> types of situations are what we need the field to contribute >>>>>>>>>>> back to the >>>>>>>>>>> Windup project through: >>>>>>>>>>> >>>>>>>>>>> 1) creating rules themselves >>>>>>>>>>> 2) creating a JIRA in the WINDUPRULE project >>>>>>>>>>> 3) providing feedback through the link in the reports >>>>>>>>>>> >>>>>>>>>>> Does this seem like a reasonable approach? I'm not sure there >>>>>>>>>>> is anything >>>>>>>>>>> we can realistically do to identify all unsupported libraries >>>>>>>>>>> unless >>>>>>>>>>> someone is aware of a comprehensive list. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> -Rodney >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On 29 Feb 2016, at 0:50, Tobias Hartwig wrote: >>>>>>>>>>> >>>>>>>>>>> See below - >>>>>>>>>>>> Begin forwarded message: >>>>>>>>>>>> >>>>>>>>>>>> From: Benjamin Meiseles <mojo-notify at redhat.com> >>>>>>>>>>>>> Date: 26. Februar 2016 um 20:58:30 MEZ >>>>>>>>>>>>> To: Tobias Hartwig <thartwig at redhat.com> >>>>>>>>>>>>> Subject: [JBoss Migration Community of Practice] New message: >>>>>>>>>>>>> "JBoss EAP >>>>>>>>>>>>> Migration: discovering unsupported application libraries" >>>>>>>>>>>>> Reply-To: >>>>>>>>>>>>> jive-1245489557-6qh-2-kv7c at redhatinc.hosted.jivesoftware.com >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Mojo >>>>>>>>>>>>> >>>>>>>>>>>>> JBoss EAP Migration: discovering unsupported application >>>>>>>>>>>>> libraries >>>>>>>>>>>>> created by Benjamin Meiseles in JBoss Migration Community of >>>>>>>>>>>>> Practice - >>>>>>>>>>>>> View the full discussion >>>>>>>>>>>>> >>>>>>>>>>>>> Hello all, >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On a migration project at The Hartford, Satish Irrinki, Guy >>>>>>>>>>>>> Bianco and I >>>>>>>>>>>>> ran into an issue in which our Support Relationship Manager >>>>>>>>>>>>> luckily spotted >>>>>>>>>>>>> our use of an unsupported library (Axis 1.4). We went through >>>>>>>>>>>>> a minor >>>>>>>>>>>>> ordeal breaking this news to the customer and working to >>>>>>>>>>>>> maintain our >>>>>>>>>>>>> project deadlines without putting the application at risk. We >>>>>>>>>>>>> were under >>>>>>>>>>>>> the impression that Windup would have flagged any unsupported >>>>>>>>>>>>> libraries in >>>>>>>>>>>>> the application, but there was no trace of Axis in the report, >>>>>>>>>>>>> so this came >>>>>>>>>>>>> as a surprise to us. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Aside from updating Windup with a new rule to scan for Axis in >>>>>>>>>>>>> particular, how can we discover these unsupported libraries up >>>>>>>>>>>>> front on >>>>>>>>>>>>> future applications? >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Our initial thought is to couple our automated Windup analysis >>>>>>>>>>>>> with a >>>>>>>>>>>>> manual dive into the application, and ensure that all >>>>>>>>>>>>> libraries are on the >>>>>>>>>>>>> list of supported configurations. I am curious if anyone else >>>>>>>>>>>>> can suggest >>>>>>>>>>>>> alternate approaches. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Thanks, >>>>>>>>>>>>> >>>>>>>>>>>>> Ben Meiseles >>>>>>>>>>>>> >>>>>>>>>>>>> Reply to this message by replying to this email, or go to the >>>>>>>>>>>>> message on >>>>>>>>>>>>> Mojo >>>>>>>>>>>>> Start a new discussion in JBoss Migration Community of >>>>>>>>>>>>> Practice by email >>>>>>>>>>>>> or at Mojo >>>>>>>>>>>>> Following JBoss Migration Community of Practice in these >>>>>>>>>>>>> streams: Email >>>>>>>>>>>>> Watches >>>>>>>>>>>>> Put Mojo in your pocket! Get Jive for iOS or Jive for Android. >>>>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> -- >>>>>>>>>> Robb Greathouse >>>>>>>>>> Middleware BU >>>>>>>>>> 505-507-4906 >>> >>> -- >>> Marek Novotny >>> -- >>> Windup team member and Seam Project Lead >>> >>> Red Hat Czech s.r.o. >>> Purkynova 99 >>> 612 45 Brno >> >> >> >> -- >> Regards, >> Jason Shepherd >> Product Security >> >> > > From ozizka at redhat.com Tue May 31 13:09:29 2016 From: ozizka at redhat.com (Ondrej Zizka) Date: Tue, 31 May 2016 19:09:29 +0200 Subject: [windup-dev] Victims Java API, data, features In-Reply-To: <CA+Bbw+YeMdi2M3p5=Wqy4tqN+zdbRX8hYiOMH=OfSGD3KvpDpg@mail.gmail.com> References: <31DC2180-FE64-442E-949E-BE47C8E46A9A@redhat.com> <562B98C5-ABCA-4103-B03E-AEB1DA45E068@redhat.com> <CAJ=9Mxc2dpY4PSYfyfnn7hMJn54rW7Svk-8P=5t-Bsm0USVG1Q@mail.gmail.com> <BCF6FE9C-79F3-4025-A5BC-4A36912D7286@redhat.com> <56D87A62.8040900@redhat.com> <56DD9FAE.5080702@redhat.com> <EE092AF5-48EE-4102-981A-16E5D505052F@redhat.com> <56DF8D51.2020303@redhat.com> <DF5E9929-C7E9-4FBC-8BB0-D04359CAE670@redhat.com> <56E03EBD.8040600@redhat.com> <CA+Bbw+Z9ai4Jp7+vWVWbvsuC+nsFRzPswTkL_P+fPhrq-BzjQg@mail.gmail.com> <56FD448F.1040902@redhat.com> <CA+Bbw+YeMdi2M3p5=Wqy4tqN+zdbRX8hYiOMH=OfSGD3KvpDpg@mail.gmail.com> Message-ID: <574DC549.6000107@redhat.com> Hi Jason, (I'm seding 2nd mail to start a new thread, please ignore the previous one.) I have looked closer at V?ctims. I have few questions/issues. Could you please help resolving those? Note: I'm adding a PUBLIC mailing list, Windup developers. Feel free to add some Victims list (is there one?) 1) Hashes are not real checksums As someone wrote in https://github.com/victims/victims-cve-db/issues/45 the hashes used by Victims are not just SHA512 hashes of the file content, but something else. I'd like to be able to either find CVE's by a normal file content hash, or create the Victims hash. a) Is there a Java impl? b) Could you add the plain SHA512 (or other, I'm okay with just CRC32) hash to the data? 2) Victims Java client API The Java API doesn't match the needs much. From what I can see, it can a) Sync with the server b) Give me a list of CVE for given SHA512 hash. What I would like to have is: * Have some offline data distributed with our app, provide these data * Search the database by Maven coordinates, classes, * Get a short description of the CVE and date of appearance and how/where it was fixed Is there a plan for extending the Java API? Also I guess not all these are covered in the Victims database, right? 3) Configuration The configuration is done through system properties, that's not too fortunate. For instance it doesn't allow to run multiple clients at once in the same JVM. Could that be done through an API? 4) Data structure The data structure of the JSON is not obvious. Is there some docs for it? 5) Data storage The data are only stored in a database over JDBC. Could it be simply stored in a JSON or XML file? The file is just 165 KB and not growing too fast, so I think rather than bringing an embedded DB as a dependency, I'd prefer to process a XML file into a HashMap or a Lucene index and use that. Thanks, Ondra On 4.4.2016 02:16, Jason Shepherd wrote: > Hi Ondra, > > The architecture of Victims is such that you should never need to > 'download' the database. The client is designed to connect to the > central http://victi.ms API to get the latest vulnerabilities. > > That being said, the authors also have a 'backup' of the data in the > form of a Github repository, [1]. In fact some members of the > community have built a tool which just uses this repository, and does > not use the API at all. Recently we've built a tool to rebuild the > database from the Github repository, but it still needs some work, > [3]. > > [1] https://github.com/victims/victims-cve-db > [2] https://github.com/h3xstream/maven-security-versions > [3] https://github.com/jasinner/victims-db-builder > > Let me know if you need any further information. > Regards, > Jason Shepherd > > On Fri, Apr 1, 2016 at 1:38 AM, Ondrej Zizka <ozizka at redhat.com> wrote: >> Great to know it goes on, last time I talked to someone (I think djorm), he >> said the development was stagnant. >> >> Jason, is there a way to download a single big file with all data in the >> database? >> >> Thanks, >> Ondra