ant-contrib security concerns

[RadekCap]

I have a problem using ant-contrib in build script. https://github.com/thinkingrock-gtd/tr-pc/blob/main/build.xml#L7

Not from "how to use" it in the project, but with the reliability of this source.

We are downloading it from source forge as a binary (https://ant-contrib.sourceforge.net/). This source is linked from Apache web sites (https://ant.apache.org/projects.html).

It's working properly but I dislike to use binary file which can contains anything.

It's here just for if in Ant task. It's used on the only one place to bundle JRE: https://github.com/thinkingrock-gtd/tr-pc/blob/main/build.xml#L65

I'm not at all experienced with Ant, but it looks like there are safer solutions for if like these:

• https://stackoverflow.com/questions/15912976/how-to-emulate-if-elseif-else-in-ant-without-using-ant-contrib
• https://gist.github.com/bcremer/6111530
• https://ant.apache.org/manual/Tasks/conditions.html

If there are no objections I would volunteer myself to rewrite it. Better than the external binary.

Maybe the easiest way now is to simply remove ant-contrib and jre condition. I have seen in the following plans "always include Java" (https://github.com/thinkingrock-gtd/tr-pc/wiki/TR-3.8)

WDYT?

[ursjoss]

@RadoslavCap I fully agree, keeping ant-contrib not only complicates the setup for new people, but also leaves a slightly uneasy feeling about the binary file.

In fact we currently only depend on ant-contrib for MacOS. For the other platforms, we simply don't bundle the JRE.

The very easiest would be to remove the dependency on ant-contrib and - for now - not bundle the JRE at all. This would keep it simple for everybody but of course leaves the responsibility of ensuring a properly set up system-JRE or JDK (of version 11 or 17 or maybe even beyond).

But if you prefer to start with always bundling it, that would be fine too. And yes, please don't hesitate to tackle the issue. Thank you.

[degrown]

@RadekCap I agree too; faith in opaque binaries sometimes has carried very bad news.
However could be useful for people like me, macOS users, clearly write the extra steps to be done to be on par of other platforms (install JRE, etc).
Thanks!

[RadekCap]

Well,

I'm going to remove ant-contrib in #38

I've created #39 to ensure that Mac users won't be affected.