[Android-tools-devel] 8.1.0 update

[Hans-Christoph Steiner]

No apologies necessary! Thanks for doing the too often thankless
foundational work with BND and Gradle!

AOSP requires BoringSSL, and they have it as a proper AOSP 'external'
repo with the same release tags as all the other repos.  It is also
included in the `repo` default.xml manifest.  So that means they are
also doing security maintenance there.  That git repo is unsurprisingly
named:
https://android.googlesource.com/platform/external/boringssl

The Security Team is opposed to exposing as a library, as you had
originally packaged it.  It wasn't an official part of AOSP yet.
BoringSSL is already included in Debian as an internal dependency of
Chromium.  Since security updates are guaranteed by Google for the
lifetime of the Debian release, we're not adding any load to the
security team as long as we publish security updates from Google.

I agree, switching the source package build to the AOSP build system is
definitely a good GSoC project.  Hopefully we won't have to use Clang,
but I fear we might have too, since Google is pushing hard to have all
of their software use Clang only.  They just ported Clang to Windows
towards that goal.

.hc

殷啟聰 | Kai-Chung Yan:
> Hello Hans,
> 
> Thank you for working on the updating! It is indeed a lot of work, though sadly I'm currently working on bringing up Gradle 4.x (which involves BND). Until after that will I be able to help you in my best. Sorry about that.
> 
> Why bringing up BoringSSL again? Does AOSP now reuqires code only in BoringSSL now? I remember last time we tried package it but only to got loads of voices [1] against it from the security team.
> 
> About our new concept utilizing Blueprint, maybe we can let the upcoming GSoC students help implement it. This would be a good project. I haven't started experimenting it either. I believe Chirayu is also too busy right now...
> 
> About Clang, do we really need to use it? Although we may have no ABI compatibility issues, but I'm not sure if changing the default C/C++ compiler is recommended in a Debian package.
> 
> [1]: https://lists.debian.org/debian-security/2016/05/msg00010.html
> 
> Hans-Christoph Steiner 於 2018年02月28日 星期三 07:49 下午 寫道:
>>
>> So just went through updating some core android-tools packages to
>> 8.1.0+r14.  Unfortuantely, there is too much work to do right now to get
>> it into Ubuntu/bionic, or at least for me to do by myself.  For example,
>> a new package, android-platform-external-boringssl, needs to be included.
>>
>> Based on trying to port new code in android-platform-system-core, it
>> seems like it would be worth trying to build everything using the new
>> Android.bp files.  Also, I think they're building most of the SDK with
>> clang now, which is something we also might want to do.
>>
>> .hc
>>
>> _______________________________________________
>> Android-tools-devel mailing list
>> Android-tools-devel at lists.alioth.debian.org
>> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/android-tools-devel
> 
> 
> 
> 
> _______________________________________________
> Android-tools-devel mailing list
> Android-tools-devel at lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/android-tools-devel
>