Re: [gentoo-java] Split migration-packages

[Karl Trygve Kalleberg <karltk@gentoo.org>]

Calvin Austin wrote:

> 1. source vs jars ebuilds.
> I built everything from source minus one jar file. I had to drop to
> source 1.4 or patch the code in some cases. However some projects are
> based on maven jar repositories, getting a source version of these can
> be a huge project in itself.

That's true, but we'll of course never include any .jars from Maven in
our tree, since we cannot know which evil backdoors they put into their
code: we don't have the source code.

Also, we can never know if we need to do a security update, since the
versions of the jars in the maven repo do not always correspond to an
actual upstream release of anything.

In conclusion: binary .jars are banned.

> 2. Using open source components vs certified binary components.
> Downloading certified jars from Sun or other vendors was a pain, however
> picking up a free implementation that may have never been certified may
> be just as bad if you don't know what you are doing (and caused a long
> tail of dependencies of cause)

The long tail of dependencies is at best a minor nuisance for the user:
Java apps and libraries are tiny. Also, the fact that they can now do
emerge -uD world should weigh up for any minor inconvenience related to
a long dep chain.

A better argument is that maintaining such a long chain of deps is more
cumbersome than just one binary library. However, with proper open
source packages, at least we have a decent shot at making them available
 permanently, instead of this eternal catch-up with have to play with Sun.

> 
> 3. Varying dependencies
> I ended up with a very simple hibernate 3.1 ebuild for example, the
> current migration ebuild essentially pulls in the rest of jboss

Cool! Show us the source:)


Cheers,

-- Karl T
-- 
gentoo-java@gentoo.org mailing list