build-automation

I was just pointed to a very interesting article about a security problem called Cross Build Injection (XBI). Bascially it is a fancy name for smuggling bad code into an application at build time via automated build systems such as ant, maven or ivy. The problem could be alleviated by introducing a cryptographic signature validation für dependencies as it is currently in place with many operating systems for downloading packages. To be clear: I am not talking about simply providing md5 or sha1 hashes for the artifacts. That is already done, but those hashes are stored in the same location as

I have the following project structure -->Starnderd Location -->Project1 -->settings.gradle -->build.gradle -->Subproject11 -->build.gradle -->Subproject12 -->build.gradle -->Project2 -->settings.gradle -->build.gradle -->Subproject21 -->build.gradle -->Subproject22 -->build.gradle -->build.gradle -->settings.gradle Idea of above project structure is that we have multiple projects which contains subprojects, each project can have dependencies to other projects. Also subprojects inside the project can have dependencies to other subprojects within the same project. Projects will be specified in

When you build with maven on a multicore / multi-CPU machine it would often be possible to build different subprojects in parallel. Is there a way to do this with maven? Is there a plugin for this / whatever? Maven 3 (as of beta 1) now supports parallel builds as an experimental feature. For example, mvn -T 4 clean install # Builds with 4 threads mvn -T 1C clean install # 1 thread per cpu core mvn -T 1.5C clean install # 1.5 thread per cpu core Full documentation can be found on the Maven wiki. https://cwiki.apache.org/confluence/display/MAVEN/Parallel+builds+in+Maven+3 Some of the CI build

Most Stackoverflow answers that I have found in regards to the Perl build process and unit testing and code coverage simply point me to CPAN for the documentation there. There's absolutely nothing wrong with pointing to CPAN modules because that's where the full documentation is supposed to reside. I've had trouble finding complete working code examples in many cases, though. I've been searching all over the Internet for actual working code samples that I can download or paste into my IDE, like your typical tutorial "Hello World" example source code, but of an example that demonstrates the

I am looking into using git on a massive scale. I was hoping to increase adoption and make things easier by calling the master branch trunk. This can and will give SVN users some feelings of comfort. I know I can create a branch called trunk but that seems to deviate from the git norms and might cause some users to get confused. I know that I can also create and delete tags to my heart's content but when I checkout those tags it tells me it is a non local branch which is just fine with me but probably not what I want to be doing. I am a total git newb but a seasoned professional at release and

I'm working with a small (4 person) development team on a C# project. I've proposed setting up a build machine which will do nightly builds and tests of the project, because I understand that this is a Good Thing. Trouble is, we don't have a whole lot of budget here, so I have to justify the expense to the powers that be. So I want to know: What kind of tools/licenses will I need? Right now, we use Visual Studio and Smart Assembly to build, and Perforce for source control. Will I need something else, or is there an equivalent of a cron job for running automated scripts? What, exactly, will