diff --git a/Gemfile b/Gemfile index 58ca556d6ee..d0373fe1b22 100644 --- a/Gemfile +++ b/Gemfile @@ -1,3 +1,4 @@ source 'https://rubygems.org' gem 'jekyll', '~> 4.2' -gem 'rouge', '~> 3.26' \ No newline at end of file +gem 'rouge', '~> 3.26' +gem 'jekyll-gfm-admonitions', '~> 1.2' diff --git a/conf/_config.yml b/conf/_config.yml index 3349aa68742..17b7fb85f9e 100644 --- a/conf/_config.yml +++ b/conf/_config.yml @@ -48,6 +48,9 @@ keep_files: [".git", ".svn", "wiki-images", "images", "downloads"] lsi: false # don't produce an index for related posts safe: false # disables plugins +plugins: + - jekyll-gfm-admonitions + markdown: kramdown highlighter: rouge diff --git a/www/_data/releases.yml b/www/_data/releases.yml new file mode 100644 index 00000000000..283a6ccc9ff --- /dev/null +++ b/www/_data/releases.yml @@ -0,0 +1,414 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# The "customName" attribute is temporary. +# It is expected to be removed once all packages are released +# and follow the naming convention based on the repository name. +# +# The packages in question are those uploaded to the ASF file +# server, not package managers. +# +# Once a package has been published using the new release +# process, uncomment the "type: source" entries for that package, +# as it should have been created. +# +# Once all packages contain source artifacts and follow the +# proper naming convention, this comment block can be removed. + +- package: cordova-common + version: 6.0.0 + downloadDir: tools + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-common + +- package: cordova-create + version: 6.0.0 + downloadDir: tools + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-create + +- package: cordova-eslint + version: 6.0.0 + downloadDir: tools + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-eslint-config + +- package: cordova-fetch + version: 5.0.0 + downloadDir: tools + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-fetch + +- package: cordova-js + version: 6.1.0 + downloadDir: tools + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-js + +- package: cordova-lib + version: 13.0.0 + downloadDir: tools + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-lib + +- package: cordova-serve + version: 4.0.1 + downloadDir: tools + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-serve + +- package: cordova-plugman + version: 3.0.1 + downloadDir: tools + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: plugman + +- package: cordova-node-xcode + version: 3.0.1 + downloadDir: tools + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: xcode + +- package: cordova-app-hello-world + version: 7.0.0 + downloadDir: templates + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-app-hello-world + +- package: cordova-android + version: 14.0.1 + downloadDir: platforms + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-android + +- package: cordova-browser + version: 7.0.0 + downloadDir: platforms + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-browser + +- package: cordova-electron + version: 4.0.0 + downloadDir: platforms + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-electron + +- package: cordova-ios + version: 8.0.0 + downloadDir: platforms + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-ios + +- package: cordova-plugin-battery-status + version: 2.0.3 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-battery-status + +- package: cordova-plugin-camera + version: 7.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-camera + +- package: cordova-plugin-device-motion + version: 1.0.0. + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-device-motion + +- package: cordova-plugin-device-orientation + version: 3.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-device-orientation + +- package: cordova-plugin-device + version: 3.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-device + +- package: cordova-plugin-dialogs + version: 8.1.3 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-dialogs + +- package: cordova-plugin-file-transfer + version: 2.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-file-transfer + +- package: cordova-plugin-file + version: 1.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-file + +- package: cordova-plugin-geolocation + version: 4.1.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-geolocation + +- package: cordova-plugin-inappbrowser + version: 6.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-inappbrowser + +- package: cordova-plugin-media-capture + version: 6.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-media-capture + +- package: cordova-plugin-media + version: 7.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-media + +- package: cordova-plugin-network-information + version: 3.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-network-information + +- package: cordova-plugin-screen-orientation + version: 3.0.4 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-screen-orientation + +- package: cordova-plugin-splashscreen + version: 6.0.2 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-splashscreen + +- package: cordova-plugin-statusbar + version: 4.0.0 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-statusbar + +- package: cordova-plugin-vibration + version: 3.1.1 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-vibration + +- package: cordova-plugin-test-framework + version: 1.1.6 + downloadDir: plugins + tarballs: + # - type: source + # extension: tar.gz + # - type: source + # extension: zip + - type: npm + extension: tgz + customName: cordova-plugin-test-framework diff --git a/www/_includes/footer_contents.html b/www/_includes/footer_contents.html index 63b52a1e0d8..ab0178d7884 100644 --- a/www/_includes/footer_contents.html +++ b/www/_includes/footer_contents.html @@ -9,7 +9,7 @@

General

Apache Project Page
  • - Source Distribution + Downloads
  • License diff --git a/www/_layouts/downloads.html b/www/_layouts/downloads.html new file mode 100644 index 00000000000..415e7b73b2b --- /dev/null +++ b/www/_layouts/downloads.html @@ -0,0 +1,24 @@ +--- +layout: page +license: > + Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. +--- + +
    + {{ content }} +
    diff --git a/www/downloads/index.md b/www/downloads/index.md new file mode 100644 index 00000000000..38f9b162fcc --- /dev/null +++ b/www/downloads/index.md @@ -0,0 +1,198 @@ +--- +layout: downloads +title: Downloads +license: > + Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. +--- + +# Downloads + +- [Downloads](#downloads) + - [Package List](#package-list) + - [Verifying Package Integrity](#verifying-package-integrity) + - [1. Import the Apache Cordova Public Keys](#1-import-the-apache-cordova-public-keys) + - [2. Verify the SHA-512 Checksum](#2-verify-the-sha-512-checksum) + - [3. Verify the GPG Signature](#3-verify-the-gpg-signature) + - [Building from Sources](#building-from-sources) + +All Apache Cordova packages are published to the npmjs registry for convenience. Source downloads are also available, allowing you to create and use custom consumable packages. + +Below is a link to all Apache Cordova packages from our download server. You must verify the integrity of the downloaded files using the signatures downloaded from our [distribution directory](https://dlcdn.apache.org/cordova/). The signatures can be verified with our [KEYS](https://dlcdn.apache.org/cordova/KEYS) file. + +The distribution directory will only provide our current recommended releases while you are able to retrieve the older, historical, versions from the [archive download site](https://archive.apache.org/dist/cordova/). + +## Package List + +
    + {% for release in site.data.releases %} +
    +
    +

    {{ release.package }}@{{ release.version }}

    +
    + +
      + {% for tarball in release.tarballs %} + {% assign base_download_url = "https://dlcdn.apache.org/cordova/" | append: release.downloadDir | append: "/" %} + {% if tarball.customName %} + {% assign filename = tarball.customName + | append: "-" + | append: release.version + | append: "." + | append: tarball.extension + %} + {% else %} + {% assign filename = release.package + | append: "-" + | append: tarball.type + | append: "-" + | append: release.version + | append: "." + | append: tarball.extension + %} + {% endif %} +
    • + + + {{ tarball.type }} ({{ tarball.extension }}) + + + + + ASC + SHA512 + +
      • + {% endfor %} +
    +
    + {% endfor %} +
    + +## Verifying Package Integrity + +To verify package integrity, tools capable of performing GPG signature verification and SHA-512 checksum validation are required. Some operating systems include these tools by default, while others may require additional setup. + +**Linux:** + +These tools are typically available by default. If they are missing, they can usually be installed via the system package manager (such as `apt`, `dnf`, `pacman`, or `yum`). For GPG, the package name is typically `gnupg`. + +**macOS:** + +[Homebrew](https://brew.sh/) can be used to install the required tools. The `gpg` command is provided by the Homebrew package `gnupg`, and the `sha512sum` command is provided by `coreutils`. + +**Windows:** + +The `gpg` and `sha512sum` commands are not provided by default and must be installed separately. + +One of the simplest ways to obtain both tools is by installing [**Git for Windows**](https://git-scm.com/install/windows), which typically includes **Git Bash** along with several useful binaries such as `gpg` and `sha512sum`. + +When **Git for Windows** is installed, these binaries can also be made available in **Command Prompt** or **PowerShell** by configuring the system `PATH` environment variable to point to the Git `usr\bin` directory. By default, this directory is typically located at `C:\Program Files\Git\usr\bin`, though the exact path may vary depending on the installation. + +For SHA-512 checksum verification, Windows users can alternatively use the built-in `certutil` command. + +### 1. Import the Apache Cordova Public Keys + +The `KEYS` file contains all of the known developer's public keys that are used for signing official releases. It is recommended to import these keys into your local GPG keyring. + +Download the `KEYS` file from the official Apache Downloads directory then run: + +```zsh +gpg --import KEYS +``` + +To list the imported keys: + +```zsh +gpg --list-keys +``` + +### 2. Verify the SHA-512 Checksum + +> [!NOTE] +> In the steps below, the file name `file.tgz.sha512` and `file.tgz` are used as a placeholder and should be replaced with the name of the actual files that were downloaded. The exact file names will vary depending on the selected package. + +Use the **provided checksum file** to confirm that the downloaded package matches the official release: + +```zsh +sha512sum -c file.tgz.sha512 +``` + +If the package is valid, you should see: + +```log +file.tgz: OK +``` + +> [!NOTE] +> Windows environment can alternatively verify the the SHA-512 checksum with the following command: +> +> ```cmd +> certutil -hashfile C:\path\to\file.tgz {SHA512} +> ``` +> +> Replace `{SHA512}` with the SHA512 string. + +(Optional) +If you want to manually double-check, you may generate your own checksum: + +```zsh +sha512sum file.tgz +``` + +After generating your own checksum, compare it against the authoritative checksum, `file.tgz.sha512`, to confirm that they match. + +> [!TIP] +> Generating your own checksum is useful for confirming the file was downloaded correctly. +> The **authoritative** checksum is the one we provide. + +### 3. Verify the GPG Signature + +> [!NOTE] +> In the steps below, the file name `file.tgz.asc` and `file.tgz` are used as a placeholder and should be replaced with the name of the actual files that were downloaded. The exact file names will vary depending on the selected package. + +Use the `.asc` signature file to confirm that the tarball was signed by an authorized Apache Cordova developer. + +Run: + +```zsh +gpg --verify file.tgz.asc file.tgz +``` + +If the signature is valid and the signer's public key exists in your keyring, you'll see output similar to: + +```log +gpg: Good signature from "Developer Name " +``` + +If GPG warns about trust levels, this is normal unless you manually set owner trust. What matters is that the signature matches a key from the official `KEYS` file. + +## Building from Sources + +After downloading one of the **source** packages from the list above and completing the steps in **Verifying Package Integrity**, follow these steps: + +1. Extract the package contents. +2. Change your working directory to the root of the extracted contents. +3. Run `npm install` to install the package dependencies. +4. Run `npm update` to update sub-dependencies, as the `package-lock.json` may become stale over time. +5. Run `npm pack` to generate the consumable tarball. + +This will create a `.tgz` package file, which you can install into your project using: + +```zsh +npm install /path/to/the/newly/created/file.tgz +``` diff --git a/www/static/css-src/_downloads.scss b/www/static/css-src/_downloads.scss new file mode 100644 index 00000000000..1bf38f6d593 --- /dev/null +++ b/www/static/css-src/_downloads.scss @@ -0,0 +1,45 @@ +.page > .downloads { + .releases { + display: grid; + gap: 1em; + grid-auto-columns: max-content; + grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); + } + + .release-card { + border-radius: 4px; + padding: 10px; + margin: 5px; + } + + .release-header h2 { + color: #333; + font-weight: bold; + font-size: 1.1em; + margin: 0; + margin-bottom: 10px; + } + + .download-list { + list-style: none; + padding: 0; + margin: 0; + } + + .download-row { + display: flex; + justify-content: space-between; + align-items: center; + border: 1px solid #f1f1f1; + border-radius: 4px; + padding: 4px; + background-color: #f1f1f1; + margin: 5px; + } + + .download-actions a { + margin-left: 0.6em; + font-size: 0.9em; + white-space: nowrap; + } +} diff --git a/www/static/css-src/main.scss b/www/static/css-src/main.scss index 7cc08860420..3b9c40b4465 100644 --- a/www/static/css-src/main.scss +++ b/www/static/css-src/main.scss @@ -280,6 +280,7 @@ code { @import 'home'; @import 'blog'; @import 'plugins'; +@import 'downloads'; @import 'docs'; @import 'contribute'; @import 'contact';