Should OSGiRepo be able to use the name derived from the R5 index file

[rotty3000]

OSGiRepository only derives it's name from it's configuration.

Due to the mechanics of how standalone workspaces work, this leads to synthetic names being used which prove to be rather meaningless and possibly even lead to confusion.

I'm wondering if there's any use in, in the absence of a configured name, making the OSGiRepository able to lift the repository name out of the index file when only a single location is configured.

[bjhargrave]

Repo names in a workspace must be unique. Using a name supplied externally to the repo configuration does not offer any uniqueness property. Just because standalone uses OSGiRepository (now; it used to use FixedIndexRepo) does not mean we should change how an OSGiRepository is named. Also, getting the repo name from the index file means no one can reason about the repo’s name without loading the repo. Currently one can get the -plugin property and see the name of each repo. If the name is not in the configuration then you must load the repos and call their name methods to know the name of the repo. Such a change may break some code.

On Fri, Jun 8, 2018 at 08:56 Raymond Augé ***@***.***> wrote: OSGiRepository only derives it's name from it's configuration. Due to the mechanics of how standalone workspaces work, this leads to synthetic names being used which prove to be rather meaningless and possibly even lead to confusion. I'm wondering if there's any use in, in the absence of a configured name, making the OSGiRepository able to lift the repository name out of the index file when only a single location is configured. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#2464>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAQ8sj9kFDf96OPGx8NxkzuFGYENUqeBks5t6pCegaJpZM4UgdTM> .

-- BJ

[pkriens]

Good point BJ.

And it would not be trivial. An OSGi repo can have multiple urls. So which name to pick?

This code works in stream mode parsing all the provided urls in parallel. So picking out the first or last name is not straightforward because the return is List.

[pkriens]

it is also used as a cache directory name. Probably do not want to allow an external party to control file system access.

[bjhargrave]

Yes this is huge. What if someone sets the index name to “/something” and gets bnd to write into parts of the file system that was not intended?

On Fri, Jun 8, 2018 at 09:07 Peter Kriens ***@***.***> wrote: it is also used as a cache directory name. Probably do not want to allow an external party to control file system access. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2464 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAQ8spkDIfls-UPG_EjumwNVocMdALOgks5t6pMggaJpZM4UgdTM> .

-- BJ

[pkriens]

We could sanitize but sounds like a lot of work for little worth

[rotty3000]

@timothyjward if you are satisfied with the arguments against presented here I'm agreeable to drop this as well.