[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Fwd: FOSDEM 19 Debian Java talk

On Tue, 12 Feb 2019 12:34:56 +0100, Markus Koschany <apo@debian.org> wrote:


Dalibor Topic (Oracle) and Robert Scholte (Apache Maven) contacted me
and were so kind to agree to make this discussion public, so that others
can chime in too. I would like to use the opportunity to answer the
initial question "what we are interested in seeing better supported from
build tools" and give some general feedback about integrating Java into

First of all Ant and Maven are most likely the best supported build
systems at the moment. We carry only two patches for Maven, one because
we use a newer version of SLF4j [1] and the second one is to make Maven
builds reproducible. [2] It looks like [1] has been already merged
upstream but [2] has not been forwarded yet. It would be great of
course, if Maven builds would be reproducible out-of-the-box. In general
I would like to see reproducible builds everywhere.

Hi Markus,

first of all thanks for the insights, it is important for us to know how Maven is used and in which way we can improve that way-of-work. Hervé is already working hard on the reproducible builds specs with your team in order to find out how we can improve our maven-plugins to get reproducible artifacts.

Maven itself is not 100% reproducible. We've learned that some Linux vendors rebuild Maven and the presentation confirmed that Debian is one of those vendors. What we've seen in the past is that sometimes people are having issues with Maven and after a while we discovered that they were not using the official Apache Maven distribution[1]. For us it is quite easy to say: sorry, not our official distribution, please contact your Linux distributor. In such case we have 3 losers: the user, the Apache Maven project and the Linux Distributor. If only the official Maven distribution was used, then we would have had 3 winners.

When you decide to rebuild Maven, you're also taking all related responsibilities. I'm also wondering how you build Maven, since Maven is being built with Maven. That should be a challenge to also rebuild all plugins, etc. And how do you test this and confirm that it works as the official distribution? Sure, *IF* Maven is 100% reproducible then you can rely on our test-infra, but that's not the situation.

So here are my main questions:
- Are you making clear that you're not using the official Maven distribution, e.g. by adjust the info from 'mvn --version'? - What is the optimum way of distributing Maven sources? For example: also providing compile and package scripts (instead of calling maven-plugins)?

[1] https://maven.apache.org/download.cgi

Otherwise we have two build tools / Maven plugins called
maven-debian-helper [3] and maven-repo-helper [4] that do all the Debian
specific operations. Maven already supports local repositories and
offline mode but I would like to see native support for unversioned jar
files and dependencies too. At the moment we create our own local
repository in /usr/share/maven-repo and in addition to the normal
version, we have a so called "debian" version. Other Java projects in
Debian only reference the debian version, so that we have to maintain
only one library or application and when we decide to upgrade a package,
reverse-depdencies continue to work because they use the unversioned
"debian" instead of a specific version. In my experience other languages
like Perl or Python, which are less version-centric, support this use
case better.

Regarding javadoc generation we would like to see an option that
basically reverts to pre OpenJDK8 and simply is less strict than the
current implementation. We currently use the undocumented and
unsupported --ignore-source-errors option when we build javadoc. It is
not feasible for us to fix all those syntax errors ourselves and we will
rather ditch our documentation packages should --ignore-source-errors go

Our biggest challenge is Gradle. If Robert wants to help us then he
should never rewrite parts of Maven in Kotlin or encourage developers to
use a specific prebuilt version of Maven and to ship a script in every
project that downloads it from the internet (gradle-wrapper). ;)

Interesting :) We've been discussing how we could get more contributors and Kotlin was one idea, but that one didn't make it. Even though we as Maven developers don't like the wrapper, the community is asking for it, so we're seriously considering to add it as part of Maven Core.


That is all off the top of my head. Maybe someone else on the list wants
to chime in here.





[3] https://tracker.debian.org/pkg/maven-debian-helper

[4] https://tracker.debian.org/pkg/maven-repo-helper

Reply to: