From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1FkHE9-0004Ey-8d for garchives@archives.gentoo.org; Sun, 28 May 2006 09:06:25 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.13.6/8.13.6) with SMTP id k4S94usB030139; Sun, 28 May 2006 09:04:56 GMT Received: from rasmus.uib.no (rasmus.uib.no [129.177.13.13]) by robin.gentoo.org (8.13.6/8.13.6) with ESMTP id k4S94uVE009605 for ; Sun, 28 May 2006 09:04:56 GMT Received: from nille.uib.no (smtp.student.uib.no) [129.177.13.20] by rasmus.uib.no with esmtp (Exim 4.34) id 1FkHCg-0006UJ-My; Sun, 28 May 2006 11:04:55 +0200 Received: from 217-127-206.5001.adsl.tele2.no ([192.168.2.67]) [193.217.127.206] by smtp.student.uib.no with asmtp (Exim 4.34) id 1FkHCf-0007BH-VT; Sun, 28 May 2006 11:04:54 +0200 Message-ID: <44796856.1030605@gentoo.org> Date: Sun, 28 May 2006 11:07:34 +0200 From: Karl Trygve Kalleberg Organization: Genoo Foundation User-Agent: Mozilla Thunderbird 1.0.7 (X11/20051013) X-Accept-Language: en-us, en Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-java@gentoo.org MIME-Version: 1.0 To: Calvin Austin CC: Krzysiek Pawlik , gentoo-java@lists.gentoo.org, java@gentoo.org Subject: Re: [gentoo-java] Split migration-packages References: <4470DE21.3070809@gentoo.org> <447606BB.50600@spikesource.com> In-Reply-To: <447606BB.50600@spikesource.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-checked-clean: by exiscan on rasmus X-Scanner: 1c948ac9dd06bbd4c2345efc7ac3bc8b http://tjinfo.uib.no/virus.html X-UiB-SpamFlag: NO UIB: -9 hits, 8.0 required X-UiB-SpamReport: spamassassin found; -9.0 Message received from UIB X-Archives-Salt: 78cf447d-be2e-492b-8c28-e32d31153812 X-Archives-Hash: 795a5fb2b80a95fde1d49b334d73fa35 Calvin Austin wrote: > 1. source vs jars ebuilds. > I built everything from source minus one jar file. I had to drop to > source 1.4 or patch the code in some cases. However some projects are > based on maven jar repositories, getting a source version of these can > be a huge project in itself. That's true, but we'll of course never include any .jars from Maven in our tree, since we cannot know which evil backdoors they put into their code: we don't have the source code. Also, we can never know if we need to do a security update, since the versions of the jars in the maven repo do not always correspond to an actual upstream release of anything. In conclusion: binary .jars are banned. > 2. Using open source components vs certified binary components. > Downloading certified jars from Sun or other vendors was a pain, however > picking up a free implementation that may have never been certified may > be just as bad if you don't know what you are doing (and caused a long > tail of dependencies of cause) The long tail of dependencies is at best a minor nuisance for the user: Java apps and libraries are tiny. Also, the fact that they can now do emerge -uD world should weigh up for any minor inconvenience related to a long dep chain. A better argument is that maintaining such a long chain of deps is more cumbersome than just one binary library. However, with proper open source packages, at least we have a decent shot at making them available permanently, instead of this eternal catch-up with have to play with Sun. > > 3. Varying dependencies > I ended up with a very simple hibernate 3.1 ebuild for example, the > current migration ebuild essentially pulls in the rest of jboss Cool! Show us the source:) Cheers, -- Karl T -- gentoo-java@gentoo.org mailing list