[bisq-network/bisq-desktop] Cannot build 0.7.1 (#1603)

[Chris Beams]

/cc @ripcurlx 

The problem was that a previous attempt to build bisq-p2p:0.7.1 had failed due to tags for bisq-common not having been published. This failed build was cached at JitPack and needed to be purged in order for it to be rebuilt. I have done that purge, and checking out and build bisq-desktop `v0.7.1` from source works as expected now. If you do still have trouble, try passing `--refresh-dependencies` to ./gradlew and that should clear everything up.

@ripcurlx, the root problem here, I believe, is that when you're building the bisq-desktop binaries during the release process, you're doing so from the root `bisq` repository. This causes all bisq-* dependencies to be resolved internally by Gradle within the context of the composite build. This works very conveniently for development purposes, but it can (and in this case did) hide underlying problems with resolving dependencies by tag from JitPack.

I think we have two choices here. The first is to build bisq-desktop binaries without the composite build in play, such that all dependencies are resolved from JitPack, just as would happen if a user / contributor wanted to build from source. The downside of this approach is that we have an intermediary (JitPack) in the mix when building our binaries, and that opens up an attack vector. I know @ManfredKarrer has wanted to avoid this in the past, and I agree it's worth avoiding, especially since we don't verify the checksums of bisq-* dependencies.

The second option is to continue with the status quo of building bisq-desktop binaries from within the composite build, but to add a step to the release process where we verify that bisq-desktop can in fact be checked out by tag and built by resolving JitPack dependencies. Doing this will catch problems like the one @suvayu ran into here. Of course, this step should be done _before_ final bisq-desktop binaries are built and published from the composite build.

I think the second option is probably the way to go. WDYT @ripcurlx?

@suvayu, please confirm that you're now able to build from source as expected. Thanks for reporting this.

And @ripcurlx, please assign this issue to me, thanks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/bisq-network/bisq-desktop/issues/1603#issuecomment-403722757
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.bisq.network/pipermail/bisq-github/attachments/20180710/bac0d5fd/attachment.html>