[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Best practices writing custom Java programs deployed on Debian


On Mon, 15. Dec 12:31 Jacob Anawalt <jlanawalt@gmail.com> wrote:
> Hello,
> I'm exploring writing some custom programs in Java that will be
> deployed on Debian stable systems and I am reaching out for some
> advice on best practices.
> At the moment I am dipping my toe into the Maven waters. I've worked
> through their getting started guides and have read all I can find
> under Java at the Debian Wiki.
> I'm not ready to jump into making everything we create into a local
> Debian package, but I would like to take advantage of the security net
> for things like DSA 3065-1 libxml-security-java so that if I am using
> that jar and the server gets the security update, my program has the
> updated jar available.

I feel you should look more into Debian packaging and ways how you can deploy
personal packages to your stable systems (e.g. with reprepro). From Debian's
point of view Maven is just another build system, like Ant or Gradle.
We don't make use of the deployment aspect of Maven in order to comply
with the DFSG. In fact we even have to disable this feature while
building packages for Debian because we must ensure that all packages
can be built offline from sources in main.

> At first I came across /usr/share/maven-repo and explored using that
> as a "remote" repository via file access, update policy always, and
> checksum policy ignore for version "debian" of my dependencies that
> were available in Debian. This seemed like a good start, but when
> Maven copied the jars to ~/.m2 I thought it wasn't quite what I was
> looking for.

/usr/share/mave-repo is the Debian specific way to store Maven
artifacts and we use tools like maven-debian-helper to achieve that. In
sum Maven's view is version-centric whereas Debian's view is broader and
release-centric. We never use Maven manually (with ~/.m2 as the local
repository) but always offline with helper tools.

> Then I learned more about the Maven dependency scopes of provided and
> system and wondered if that wasn't a better way of using the Debian
> packaged jars.
> I realize the most integrated way would be to package my code as well
> and use the package manager's dependency management system, but I am
> not ready to go that far.
> Is there a write-up about best practices developing custom local Java
> programs on Debian systems? I tried searching the mailing list for
> maven-repo and dependency scope but didn't find anything.

I'm not aware of an "official" best practice guide for developing Java
programs with Debian. However you are completely free to use any
available means to develop your software with Eclipse, Netbeans, vim,
Maven, ant, Gradle, you name it.

I think the way to go is:

- Develop your program
- Find out what libraries are already packaged for Debian and which ones
  are available in stable
- Test and build your program against those libraries.
- Package additional libraries which are not available (optional)
- Bundle all missing libraries/your program in one package and depend on
  the available libraries in stable. Adjust your classpath, use reprepro
  to deploy your package and add your custom repository to

Debian packaging isn't hard to learn:

- apt install packaging-tutorial or

I suggest to use existing Java packages as templates for your own packaging and learn
from them. Robocode uses Maven, MediathekView Ant and there are much
simpler packages like libpicocontainer-java which just use javahelper for
building the software.

If you have specific packaging questions, feel free to ask them on this list.



Attachment: signature.asc
Description: Digital signature

Reply to: