On 03/17/2013 06:35 PM, Scott Howard wrote: > On Sun, Mar 17, 2013 at 4:59 PM, Emmanuel Bourg <ebourg@apache.org> wrote: >> Le 17/03/2013 16:47, Hilko Bengen a écrit : >> >>> I don't mean to offend anyone here nor belittle hard work that has gone >>> into the mentioned tools, but can't we do better than this? >> >> What about leveraging the Maven infrastructure and downloading the >> dependencies directly from the central Maven repository (or a Debian >> operated mirror) instead of repackaging every single jar into it's own >> deb file (as long as it's open source of course) ? >> >> Let say I'm building the package for NetClipse IDEA, the next big Java >> IDE, and it depends on Commons Collections 10. I would declare a >> dependency in the control file that might look like this: >> >> Depends: maven:org.apache.commons:commons-collections (>=10) >> >> And the dependency would be downloaded and installed by apt. >> >> Just a wild dream... > > There was a pretty good blog post from the Maven community about this > problem exactly one year ago [1] which was in response to another post > [2]. The general summary is that the two projects are philosophically > different (the "culture clash"), to the point where the popular > features of Maven (binary-only distribution, multiple versions of the > same libraries, libraries distributed as-needed over the Internet) are > explicitly prohibited in Debian. A Debian operated mirror wouldn't be > enough, we'd need volunteers scouring the licensing and source code of > all the libraries in that mirror (and infrastructure to support that > effort). It might be possible to work something out that is better, > but someone needs to do it and the best work so far has been done with > the maven-repo-helper and related spec. > > ~Scott > [1] http://kohsuke.org/2012/03/16/debian-and-maven-a-crash-of-culture/ > [2] http://discursive.com/2012/03/15/the-debian-java-package-team-futility-defined/ Hi Scott, Thank you for the post. I believe when this idea has been discussed previously that the only packages in the Debian maven repository would be those that were build from source packages in the Debian archive. This means that the contents of the Debian maven repo would adhere to the same licensing and redistribution constraints as we have on the current Java binary .debs in the archive. This could make it far easier to create Debian packages that use these libraries. However, I think the main issue with a proposal like this is that in order to build a package that utilized the Debian maven repository, the building machine would either need access to the repository, which isn't going to fly (because users need to be able to build the package from the source package in archive without requiring fetching external resources); or, the source package could use the maven repo for the "initial" build (sourceful upload) and then include them in the source package. But then we're kind of back to square one - rebuilding an application from the source package would depend on embedded binary JARs. Still, I think there is some merit to talking through the use cases given the prevalence of maven and how painful and time-consuming the packaging process is. Perhaps folks can poke some holes in issue I raised and offer alternative solutions. Cheers, tony
Attachment:
signature.asc
Description: OpenPGP digital signature