10

Kotlin is gaining widespread attention as being a great programming language, and is now officially supported e.g. for Android development. But the options I see for installing it aren't clear about security issues. I don't know if sdkman checks (or even supports) signatures on packages, I don't know if it automatically tracks security updates on Kotlin and other installed packages (like apt-get does), I don't know how big the install is going to be, etc.

So to sum up

Is there an installation approach for Kotlin that is relatively secure (with package signatures, auto-update etc)?

E.g., is there a PPA for it? (Is anyone even working to package it for Debian/Ubuntu?).

Or does sdkman have the necessary properties?

Or is there some other approach?

Update: I see that ubuntu-make (umake) is an option. For IDEA and Kotlin, it seems the version from their ppa is still needed, as explained at Ubuntu Make 16.03 Released With Eclipse JEE And IntelliJ IDEA EAP Support, More

But I'm surprised that I can't easily find any information on the security aspects of umake, and it seems that they don't do updates yet (updating tools · Issue #74), so my question remains open.

  • @Alban Thanks for nudging me to clarify the underlying question. – nealmcb May 20 '17 at 21:40
2

The command line Kotlin compiler developed by JetBrains can be installed as a snap package in all currently supported versions of Ubuntu. To install it, open the terminal and type:

sudo apt install snapd  
sudo snap install kotlin --classic 

Available tools:

  • kotlinc
  • kotlinc-jvm
  • kotlinc-js
  • kotlin-dce-js

Example

  1. Create a simple application in Kotlin that displays Hello, World!. Create a new file with executable permission called hello.kt with the following:

    fun main(args: Array<String>) {
        println("Hello, World!")
    }
    
  2. Compile the application using the Kotlin compiler.

    kotlinc hello.kt -include-runtime -d hello.jar  
    
  3. Run the application.

    java -jar hello.jar
    
| improve this answer | |
  • 1
    Ahh thanks! It also seems that with 14.04, you need to install the new backport of snapd to trusty: sudo apt install snapd before you can run snap. – nealmcb Apr 4 '18 at 20:34
  • Snap install worked fine. However "man does" doesn't work. When I look under /snap/kotlin I see a bunch of man pages. Should snap have also installed these? – steven smith Dec 8 '18 at 15:27
  • kotlin -h works OK for starters. The -h option also works for all snaps. After that I use online tutorials and documentation. – karel Dec 8 '18 at 15:31
  • 1
    Thanks. I just discovered that man install is also bug #1575593 for snap. – steven smith Dec 8 '18 at 15:37
  • Thanks! Link for latest status of man page bug for snap: bugs.launchpad.net/snapd/+bug/1575593 – nealmcb Aug 27 '19 at 18:23
2

I don't know about umake. I've just written a little bash script to generate a minimal deb package out of the distributed zip archive.

Create a new kotlinc-deb file:

#!/usr/bin/env bash
if [ -z "$1" ]; then echo "Error: no input zip file is specified"; exit 1; fi
version=${1#kotlin-compiler-}
version=${version%.zip}
unzip $1 -d kotlinc_${version}_all/
cd kotlinc_${version}_all/
mkdir -v opt
mv -v kotlinc opt/
rm -rv 'opt/kotlinc/bin/'*.bat
mkdir -vp usr/{bin,share/doc}
mv -v opt/kotlinc/license usr/share/doc/kotlinc
sed -i $'s/\r$//' 'opt/kotlinc/bin/'* #The new 1.2.0 version has shell scripts in
                                      # CRLF format. That causes issues when running
                                      # them. So I added this CRLF to LF conversion
cd usr/bin
ln -svt . '../../opt/kotlinc/bin/'*
cd ../..
mkdir -v DEBIAN
cat >DEBIAN/control <<EOF
Package: kotlinc
Version: ${version}
Section: java
Priority: optional
Maintainer: ${LOGNAME} <${LOGNAME}@localhost>
Architecture: all
Description: The Kotlin compiler
 The compiler for the Kotlin programming language.
EOF
dpkg-deb -b ../kotlinc_${version}_all{,.deb}

And then run:

$ chmod +x kotlinc-deb
$ ./kotlinc-deb kotlin-compiler-1.1.51.zip

After that, you can install the generated kotlinc_1.1.51_all.deb as a usual deb package.

| improve this answer | |
  • Thanks! That sounds like a great starting point for a real Debian package, or at least an Ubuntu ppa, which some organization could commit to keeping updated. But my main goal is to install it in a way that is and remains secure, and that requires both signatures and a packaging approach backed by a trustworthy and credible commitment to keep it up-to-date. – nealmcb Dec 3 '17 at 15:42
  • 1
    OK, this answer gives a way to install. OP's question was "Is there an installation approach for Kotlin that is relatively secure". So...how exactly making a bed package out of zip file secure ? This answer doesn't address that part. Don't want to downvote, but the answer isn't addressing the core of the question – Sergiy Kolodyazhnyy Dec 4 '17 at 7:32
  • @SergiyKolodyazhnyy, maybe we define "security" differently. He wrote "RELATIVE secure". And I believe that my approach is more secure than doing curl -s https://get.sdkman.io | bash && sdk install kotlin. When generating a .deb package myself, I get a package directly from an upstream, without a middle man (sdkman). Thus I see it as safer. Of couse the approach in the current form lacks fully automatic (incl. secure) updates but it won't be hard to automate it further. – Des Nerger Dec 4 '17 at 8:57
  • 1
    @DesNerger OK, getting it from upstream is OK, however fact is that 1) you failed to mention where zip package comes from; 2) there is zero mention of security in your answer; it just talks about script you made. It's cool and all, but the site is question-answer type,so you have to adhere to specific format. OP asked one thing, you provided a script and no explanation how it relates to original questions. Don't get frustrated, just edit your answer, you could probably include stuff from your comment there. – Sergiy Kolodyazhnyy Dec 4 '17 at 9:09
  • 1
    @DrBeco, they usually publish it there: github.com/JetBrains/kotlin/releases/latest – Des Nerger Oct 19 '19 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.