First of all, greeeeeat feedback. I usually ask for this kind of comments about the INSTALL and the DEV_GUIDE (but without to much success). El 01/09/11 11:36, Roberto Aragón escribió:
Hello everybody:
I would like to propose to add some kind of explanation in kune/INSTALL file concerning database passwords. This file says that database passwords must be changed to something different than the placeholder text "PUT_HERE_A_DB_PASSWD". This is the right thing (since passwords are a very sensitive security concern), but no warning exists explaining that database password must match the one in all these files in order to start kune successfully:
- src/main/resources/db/liquibase.properties - src/main/resources/META-INF/persistence.xml - script/liquibase-migrate.sh - script/liquibase-rollback.sh - pom.xml - src/main/webapp/WEB-INF/publicspace/config/database.yml
Can you send us a INSTALL/DEV_GUIDE patch with this kind of things?
So, shouldn't be the best (insecure) way to create the database to use the default ("db4kune") password?
For dev purposes, to use db4kune is the easiest way right now (also thinking in SVN commits). For production, I'm working with the generation of one jar and to get all the properties/configuration files as parameters. The ideal for me will be to generate a debian package, but I have no experience packaging java applications currently (in the pom.xml we started to test the deb-maven-plugin to help with this but is not finished).
Also, I found some problems with these project settings/dependencies:
- .project and .classpath are included in SVN repo, but Developer's Guide asks to generate this by making "mvn eclipse:eclipse". Couldn't be this a little contradictory/dangerous?
maybe this should be in the DEV_GUIDE. Because to install Kune currently it's a job! take into account that issue 113 only need to import the /intro/ project (a different and simplest project than the one in /trunk/) in eclipse. http://kune.ourproject.org/issues/ticket/113
- AspectJ nature is not needed but included in SVN's ".project" file. Is there a good reason for this?
Mmmmm, since .project is generated from our pom.xml I don't remember who add this. Maybe guice: $ mvn dependency:tree (...) [INFO] [dependency:tree {execution: default-cli}] (...) [INFO] +- com.google.inject:guice:jar:3.0:compile [INFO] | +- javax.inject:javax.inject:jar:1:compile [INFO] | \- aopalliance:aopalliance:jar:1.0:compile
Thank you very much for your time, and please don't take this as an urgent task, lets come back from holidays at a slooooow pace ;-)
Thank you indeed for your feedback. Bests, Vicente