plugin-hub
plugin-hub copied to clipboard
runelite
Archipelago Multiworld Randomizer Plugin
Creates a plugin for interfacing with the Archipelago Multiworld randomizer. Players of dozens of games can all collectively submit seeds to have items placed randomly between all games. Plugin uses the same Archipelago MultiClient used by Minecraft and Slay The Spire.
Players submit a seed on the Archipelago Website, which will give them a URL and port to connect to. Players enter that information in the plugin settings and hit the server tells the player which map chunks and items they are allowed to use, as well as sending checks to the server when tasks are completed.
Includes non-plugin changes
New plugin osrs-archipelago: https://github.com/digiholic/osrs-archipelago/tree/fcb7899c1035c1ac980aa62c532bcb71243e8466
![runelite-github-app[bot] avatar](https://avatars.githubusercontent.com/u/13814776?v=4 "Published by a pub.dev verified publisher"){kind=small}
Reflection isn't used in this plugin, did you mean in the library it uses? Would that be a problem?
I'm not actually sure of the answer to that, my mistake if it does end up being okay :+1:
Our reply is going to be the same as the last time you submitted this plugin.
https://discord.com/channels/301497432909414422/419891709883973642/1130606782973223043
I closed the last one because it still required a lot of work. Even if it were accepted it would almost immediately need patches. This one should be stable.
Is there anything I can do to make the review process easier to review? I could see if we can get the multiclient plugin added to Gradle or some other tool chain so that it can be vetted somewhere?
Pulling the source files that you need into your plugin is the easiest/fastest.
So, including the plugin files directly in the project, rather than using a jar as a dependency? I can probably do that.
Right. If you can narrow down which sources you need, it is easier for the average reviewer. If it's going to be a huge amount of files, might as well wait on dependency review. I haven't taken a look at the source of Archipelago to know what's up.
So, I tried to untangle the stuff I need from the stuff I don't, and ended up keeping the entire plugin. I could swap out the jar for the source code if that would help? Maybe I can see if I can get them to rework it to not use reflection?
The reflection is for an annotation event listener, I don't think it can be removed, but I don't think it's much of a vulnerability. It lets the library run code from the plugin, not vice-versa, so it wouldn't be giving any access to data this plugin doesn't explicitly give it. Any changes that could potentially compromise anything would need to be approved. So, you'd just need to check that the code that's annotated isn't giving away any kind of account information or potential backdooring, and you can see that these event functions don't do any of that.
Sorry for the late review on this one; the build is failing. If this change is just vendoring the entire library, it's probably fine to just leave it as a dependency and we'll review it.
Sorry for the late response to the late review: I had another project that was higher priority than this one I had to dedicate my time to, but that's done and I can get back to working on this one.
I've fixed the build errors, as well as a few UI issues while I was at it. This one's properly compiling, and back to the jar. In the meantime, the version I was using has gotten actual release so it's a practical tagged release instead of me compiling from source to use a new feature that I required. You can see the build here, and check out the repository: https://github.com/ArchipelagoMW/Archipelago.MultiClient.Java/releases/tag/1.12
Is it at all possible to exclude the duplicate dependencies used in the Archipelago client? It brings along its own copies of gson, apache, hc, slf4j; most/all of which we already provide to plugins at build time. This would substantially help reduce the burden of reviewing it
Images that are packed with a plugin are blown up to their max size by Java when loaded into memory, meaning your panel_icon.png is astronomical in size (width * height * 4)
Turns out the plugin doesn't work without these requirements:
implementation 'org.apache.httpcomponents.client5:httpclient5:5.2.1'
implementation 'org.java-websocket:Java-WebSocket:1.5.2'
implementation 'com.google.code.gson:gson:2.8.9'
It was previously mentioned that apache and gson were already provided, but without these in the gradle, the plugin doesn't connect to the Archipelago API or parse the data from it, so I've had to add them back in. At least they're in this project instead of a dependency of it.
Hm, doesn't look like the build process liked that. I'll see what I can do tomorrow.
You add a nav button for your plugin's panel here but it is never removed. Please ensure it is removed on plugin shutDown().
Plugin code LGTM otherwise. I haven't yet reviewed the added dependency or the archipelago lib