Re: libitext-java and libbcprov-java in testing (wheezy)
On 2012-08-09 02:06, Julius Davies wrote:
> Hi, Debian-Java,
>
Hi,
Sorry for the very late answer.
> I've never posted to this list before. Probably I should also report
> this is as a bug, but first I wanted to ask a few questions.
>
> Question #1:
> ---
> When a package moves from Unstable to Testing, does it get rebuilt
> (from scratch) in Testing? Do packages ever get rebuilt from scratch
> for a target distribution?
>
>
> I suspect they don't, hence this bug (described below):
Package are not rebuilt when they migrate to testing. In fact, arch:all
packages (e.g. most Java packages) are not built on the Debian build
infrastructure at all.
We do have "rebuild tests"; usually they only happen in sid but during
freezes they are done in testing. Though they only test the packages
can be rebuilt, the resulting packages are discarded as I recall.
> ---
> In Wheezy the jar file (as currently built)
> "/usr/share/java/itext.jar" contains a dependency on
> "org.bouncycastle.asn1.ASN1ObjectIdentifier" in
> "/usr/share/java/bcprov.jar", but that class doesn't appear until
> newer versions of bcprov.jar compared to the one in Wheezy. This is
> due to bcprov.jar evolving in a non-reverse-compatible way from a
> runtime point of view, but it is reverse-compatible from a
> compile-time point of view.
>
> Specifically, bcprov-1.44 contains several static final constants like
> this one, and itext.jar references some of them:
>
> org.bouncycastle.asn1.x509.X509Extensions.AuthorityInfoAccess (type is
> DERObjectIdentifier).
>
> bcprov-1.46 contains the same static final constants, but their types
> have changed to the new ASN1ObjectIdentifier class not present in
> bcprov-1.44.
>
>
I suspect every rdep of bouncycastle in testing could be affected by
this...[0]
>
> To fix the bug I suspect you have two choices:
>
> 1.) Either rebuild itext.jar from scratch in Wheezy. No code changes
> are necessary. But recompiling in Testing will then cause the
> package to break in Unstable!
>
> 2.) Migrate the newer Bouncy-Castle into Wheezy.
>
>
Option 2 is probably not possible at this point. I guess we will have
to go with 1.
>
> Question #2:
> ---
> Why doesn't the libitext-java package make its runtime dependency on
> libbcprov-java explicit in the package meta-data?
>
Sounds like a(nother) bug to me.
>
>
> P.S./Off-Topic.... Any idea where this is at? "RFS:
> not-yet-commons-ssl".
> http://lists.debian.org/debian-mentors/2012/01/msg00640.html Just
> curious, since I'm upstream for that one, and happened to notice the
> RFS. :-) :-) :-)
>
>
Not entirely sure; I guess it hasn't been reviewed and slipped through
the "cracks". Dennis, are you still interested in maintaining the package?
~Niels
[0] dak (rm -s testing -nR -b libbcprov-java) suggests these might be:
Checking reverse dependencies...
# Broken Depends:
bouncycastle: libbcprov-java-gcj [amd64 ...]
jakarta-jmeter: jmeter
jenkins-instance-identity: jenkins-instance-identity
libitext5-java: libitext5-java
red5: libred5-java
voms-api-java: libvoms-api-java-java
# Broken Build-Depends:
ivy: libbcprov-java
jakarta-jmeter: libbcprov-java
jenkins-instance-identity: libbcprov-java
libcommons-openpgp-java: libbcprov-java
libitext-java: libbcprov-java
libitext5-java: libbcprov-java
libj2ssh-java: libbcprov-java
libjgroups-java: libbcprov-java
libjgroups2.6-java: libbcprov-java
libpdfbox-java: libbcprov-java
red5: libbcprov-java
voms-api-java: libbcprov-java
wagon2: libbcprov-java
wss4j: libbcprov-java
Reply to: