Hi, On Mon, 15. Dec 12:31 Jacob Anawalt <jlanawalt@gmail.com> wrote: > Hello, > > I'm exploring writing some custom programs in Java that will be > deployed on Debian stable systems and I am reaching out for some > advice on best practices. > > At the moment I am dipping my toe into the Maven waters. I've worked > through their getting started guides and have read all I can find > under Java at the Debian Wiki. > > I'm not ready to jump into making everything we create into a local > Debian package, but I would like to take advantage of the security net > for things like DSA 3065-1 libxml-security-java so that if I am using > that jar and the server gets the security update, my program has the > updated jar available. I feel you should look more into Debian packaging and ways how you can deploy personal packages to your stable systems (e.g. with reprepro). From Debian's point of view Maven is just another build system, like Ant or Gradle. We don't make use of the deployment aspect of Maven in order to comply with the DFSG. In fact we even have to disable this feature while building packages for Debian because we must ensure that all packages can be built offline from sources in main. > At first I came across /usr/share/maven-repo and explored using that > as a "remote" repository via file access, update policy always, and > checksum policy ignore for version "debian" of my dependencies that > were available in Debian. This seemed like a good start, but when > Maven copied the jars to ~/.m2 I thought it wasn't quite what I was > looking for. /usr/share/mave-repo is the Debian specific way to store Maven artifacts and we use tools like maven-debian-helper to achieve that. In sum Maven's view is version-centric whereas Debian's view is broader and release-centric. We never use Maven manually (with ~/.m2 as the local repository) but always offline with helper tools. > Then I learned more about the Maven dependency scopes of provided and > system and wondered if that wasn't a better way of using the Debian > packaged jars. > > I realize the most integrated way would be to package my code as well > and use the package manager's dependency management system, but I am > not ready to go that far. > > Is there a write-up about best practices developing custom local Java > programs on Debian systems? I tried searching the mailing list for > maven-repo and dependency scope but didn't find anything. I'm not aware of an "official" best practice guide for developing Java programs with Debian. However you are completely free to use any available means to develop your software with Eclipse, Netbeans, vim, Maven, ant, Gradle, you name it. I think the way to go is: - Develop your program - Find out what libraries are already packaged for Debian and which ones are available in stable - Test and build your program against those libraries. - Package additional libraries which are not available (optional) - Bundle all missing libraries/your program in one package and depend on the available libraries in stable. Adjust your classpath, use reprepro to deploy your package and add your custom repository to /etc/apt/sources.list.d. Debian packaging isn't hard to learn: - apt install packaging-tutorial or https://www.debian.org/doc/manuals/packaging-tutorial/packaging-tutorial I suggest to use existing Java packages as templates for your own packaging and learn from them. Robocode uses Maven, MediathekView Ant and there are much simpler packages like libpicocontainer-java which just use javahelper for building the software. If you have specific packaging questions, feel free to ask them on this list. Regards, Markus
Attachment:
signature.asc
Description: Digital signature