Re: Fwd: FOSDEM 19 Debian Java talk
On Tue, 12 Feb 2019 12:34:56 +0100, Markus Koschany <apo@debian.org> wrote:
Hello,
Dalibor Topic (Oracle) and Robert Scholte (Apache Maven) contacted me
and were so kind to agree to make this discussion public, so that others
can chime in too. I would like to use the opportunity to answer the
initial question "what we are interested in seeing better supported from
build tools" and give some general feedback about integrating Java into
Debian.
First of all Ant and Maven are most likely the best supported build
systems at the moment. We carry only two patches for Maven, one because
we use a newer version of SLF4j [1] and the second one is to make Maven
builds reproducible. [2] It looks like [1] has been already merged
upstream but [2] has not been forwarded yet. It would be great of
course, if Maven builds would be reproducible out-of-the-box. In general
I would like to see reproducible builds everywhere.
Hi Markus,
first of all thanks for the insights, it is important for us to know how
Maven is used and in which way we can improve that way-of-work. Hervé is
already working hard on the reproducible builds specs with your team in
order to find out how we can improve our maven-plugins to get reproducible
artifacts.
Maven itself is not 100% reproducible. We've learned that some Linux
vendors rebuild Maven and the presentation confirmed that Debian is one of
those vendors. What we've seen in the past is that sometimes people are
having issues with Maven and after a while we discovered that they were
not using the official Apache Maven distribution[1]. For us it is quite
easy to say: sorry, not our official distribution, please contact your
Linux distributor.
In such case we have 3 losers: the user, the Apache Maven project and the
Linux Distributor. If only the official Maven distribution was used, then
we would have had 3 winners.
When you decide to rebuild Maven, you're also taking all related
responsibilities. I'm also wondering how you build Maven, since Maven is
being built with Maven. That should be a challenge to also rebuild all
plugins, etc.
And how do you test this and confirm that it works as the official
distribution?
Sure, *IF* Maven is 100% reproducible then you can rely on our test-infra,
but that's not the situation.
So here are my main questions:
- Are you making clear that you're not using the official Maven
distribution, e.g. by adjust the info from 'mvn --version'?
- What is the optimum way of distributing Maven sources? For example: also
providing compile and package scripts (instead of calling maven-plugins)?
[1] https://maven.apache.org/download.cgi
Otherwise we have two build tools / Maven plugins called
maven-debian-helper [3] and maven-repo-helper [4] that do all the Debian
specific operations. Maven already supports local repositories and
offline mode but I would like to see native support for unversioned jar
files and dependencies too. At the moment we create our own local
repository in /usr/share/maven-repo and in addition to the normal
version, we have a so called "debian" version. Other Java projects in
Debian only reference the debian version, so that we have to maintain
only one library or application and when we decide to upgrade a package,
reverse-depdencies continue to work because they use the unversioned
"debian" instead of a specific version. In my experience other languages
like Perl or Python, which are less version-centric, support this use
case better.
Regarding javadoc generation we would like to see an option that
basically reverts to pre OpenJDK8 and simply is less strict than the
current implementation. We currently use the undocumented and
unsupported --ignore-source-errors option when we build javadoc. It is
not feasible for us to fix all those syntax errors ourselves and we will
rather ditch our documentation packages should --ignore-source-errors go
away.
Our biggest challenge is Gradle. If Robert wants to help us then he
should never rewrite parts of Maven in Kotlin or encourage developers to
use a specific prebuilt version of Maven and to ship a script in every
project that downloads it from the internet (gradle-wrapper). ;)
Interesting :) We've been discussing how we could get more contributors
and Kotlin was one idea, but that one didn't make it.
Even though we as Maven developers don't like the wrapper, the community
is asking for it, so we're seriously considering to add it as part of
Maven Core.
regards,
Robert
That is all off the top of my head. Maybe someone else on the list wants
to chime in here.
Regards,
Markus
[1]
https://sources.debian.org/src/maven/3.6.0-1/debian/patches/slf4j-compatibility.patch/
[2]
https://sources.debian.org/src/maven/3.6.0-1/debian/patches/reproducible-build-timestamp.patch/
[3] https://tracker.debian.org/pkg/maven-debian-helper
[4] https://tracker.debian.org/pkg/maven-repo-helper
Reply to: