Comment by karteum

2 days ago

I don't fully understand: aren't gradle and aapt2 open-source ?

If you want to build buildroot or openwrt, the first thing it will do is compiling your own toolchain (rather than reusing the one from your distro) so that it can lead to predictable results. I would have the same rationale for f-droid : why not compile the whole toolchain from source rather than using a binary gradle/aapt2 that uses unsupported instructions?

3 comments

karteum

Reply
mid-kid  2 days ago

I agree, this should be the case, but Gradle specifically relies on downloading prebuilt java libraries and such to build itself and anything you build with it, and sometimes these have prebuilt native code inside. Unlike buildroot and any linux distribution, there's no metadata to figure out how to build each library, and the process for them is different between each library (no standards like make, autotools and cmake), so building the gradle ecosystem from source is very tedious and difficult.

  • 1oooqooq  2 days ago

    having worked with both mvn and gradle, i always have a good chuckle when i hear about npm "supply chain" hacks.