Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 472850 - =dev-java/maven-bin-3.1.0 - Sort out dependencies more appropriately. (Was: Version bump.)
Summary: =dev-java/maven-bin-3.1.0 - Sort out dependencies more appropriately. (Was: V...
Status: RESOLVED OBSOLETE
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Java (show other bugs)
Hardware: All Linux
: Normal enhancement (vote)
Assignee: Java team
URL:
Whiteboard:
Keywords: EBUILD
: 476966 477442 (view as bug list)
Depends on:
Blocks:
 
Reported: 2013-06-10 11:57 UTC by Joerg Schaible
Modified: 2018-08-04 11:57 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Ebuild for Maven-bin 3.1.0_alpha1 in new slot 3.1. (maven-bin-3.1.0_alpha1.ebuild,1.42 KB, text/plain)
2013-06-10 11:57 UTC, Joerg Schaible
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Joerg Schaible 2013-06-10 11:57:36 UTC
Created attachment 350626 [details]
Ebuild for Maven-bin 3.1.0_alpha1 in new slot 3.1.

Version bump. Generate wider audience for the upcoming release.
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2013-06-10 12:13:23 UTC
Comment on attachment 350626 [details]
Ebuild for Maven-bin 3.1.0_alpha1 in new slot 3.1.

--- maven-bin-3.0.4-r1.ebuild   2012-12-25 18:55:44.068723177 +0100
+++ -   2013-06-10 14:13:12.972236026 +0200
@@ -7,7 +7,8 @@
 inherit java-pkg-2
 
 MY_PN=apache-${PN%%-bin}
-MY_P="${MY_PN}-${PV}"
+MY_PV=${PV/_alpha/-alpha-}
+MY_P="${MY_PN}-${MY_PV}"
 MY_MV="${PV%%.*}"
 
 DESCRIPTION="Project Management and Comprehension Tool for Java"
@@ -15,7 +16,7 @@
 HOMEPAGE="http://maven.apache.org/"
 
 LICENSE="Apache-2.0"
-SLOT="3.0"
+SLOT="3.1"
 KEYWORDS="amd64 ppc x86"
 IUSE=""
Comment 2 Jeroen Roovers (RETIRED) gentoo-dev 2013-07-15 20:59:22 UTC
*** Bug 476966 has been marked as a duplicate of this bug. ***
Comment 3 Tom Wijsman (TomWij) (RETIRED) gentoo-dev 2013-07-19 23:58:45 UTC
+  19 Jul 2013; Tom Wijsman <TomWij@gentoo.org> +maven-bin-3.1.0.ebuild:
+  Version bump to 3.1.0. Fixes bug #472850, reported by Joerg Schaible. Also
+  fixes up some missing dependencies, remaining dependencies are listed in bug
+  #477436.
Comment 4 wojtek 2013-07-20 02:10:29 UTC
I'm not sure what's going on but maven-bin-3.1.0 have a lot of redundant (and strande to me) dependencies.

from ebuild

DEPEND="|| ( app-admin/eselect-java app-admin/eselect-maven )
 	dev-java/avalon-framework:4.1
 	dev-java/avalon-logkit:2.0
 	dev-java/commons-io:1
 	dev-java/juel:0
 	dev-java/log4j:0
 	dev-java/osgi-core-api:0
 	java-virtuals/servlet-api:2.4"

avalon-* -> this framework is deprecated since 2002.
maven-3.1.0 depends on slf4j-api and slf4j is only facade (runtime can use log4j, logback, java.util.logging, etc)

commons-io -> this is only test dependency

osgi-core-api -> Not needed because it is only test dependency and don't make any sense (it's only API)
juel -> it's only EL implementation and I'm almost sure this dependency is not needed
servlet-api -> not make sense at all. Maven is not using any Servlet API (or implementation)
Comment 5 Tom Wijsman (TomWij) (RETIRED) gentoo-dev 2013-07-20 09:43:01 UTC
It lists these as needed at the end of an emerge for Java developers, when you set JAVA_PKG_STRICT="yes" in /etc/portage/make.conf _and_ `emerge dev-java/java-dep-check`.

(In reply to wojtek from comment #4)
> avalon-* -> this framework is deprecated since 2002.

It does list it, needs org/apache/avalon/framework/logger/Logger.class

> maven-3.1.0 depends on slf4j-api and slf4j is only facade (runtime can use
> log4j, logback, java.util.logging, etc)

slf4j* is bundled; but agreed, we could try to unbundle it and then make this a dependency on a virtual (or || ( slf4j log4j logback avalon-* jdk/jre )). See bug #477436 for logback.
 
> commons-io -> this is only test dependency
> osgi-core-api -> Not needed because it is only test dependency and don't
> make any sense (it's only API)

If you can confirm these (Where does it list those as such?) I'll remove them; for the second one, osgi-compendium also satisfies as a dependency so I'm not so sure about the API part.

> juel -> it's only EL implementation and I'm almost sure this dependency is
> not needed

It does list it, needs javax/el/ExpressionFactory.class.

> servlet-api -> not make sense at all. Maven is not using any Servlet API (or
> implementation)

It does list it, needs javax/servlet/ServletContextEvent.class.
Comment 6 Tom Wijsman (TomWij) (RETIRED) gentoo-dev 2013-07-20 09:43:37 UTC
*** Bug 477442 has been marked as a duplicate of this bug. ***
Comment 7 wojtek 2013-07-20 15:57:50 UTC
(In reply to Tom Wijsman (TomWij) from comment #5)
> It lists these as needed at the end of an emerge for Java developers, when
> you set JAVA_PKG_STRICT="yes" in /etc/portage/make.conf _and_ `emerge
> dev-java/java-dep-check`.

Ok looked into maven-bin bundled jars.


> (In reply to wojtek from comment #4)
> > avalon-* -> this framework is deprecated since 2002.
> 
> It does list it, needs org/apache/avalon/framework/logger/Logger.class
> 
> > maven-3.1.0 depends on slf4j-api and slf4j is only facade (runtime can use
> > log4j, logback, java.util.logging, etc)
> 
> slf4j* is bundled; but agreed, we could try to unbundle it and then make
> this a dependency on a virtual (or || ( slf4j log4j logback avalon-* jdk/jre
> )). See bug #477436 for logback.

> > juel -> it's only EL implementation and I'm almost sure this dependency is
> > not needed
> 
> It does list it, needs javax/el/ExpressionFactory.class.
> 
> > servlet-api -> not make sense at all. Maven is not using any Servlet API (or
> > implementation)
> 
> It does list it, needs javax/servlet/ServletContextEvent.class.

> > commons-io -> this is only test dependency

The whole mess with dependencies comes from wagon-http-2.4-shaded.jar

If you look in 
wagon-http-2.4-shaded.jar!/META-INF/maven/commons-logging/commons-loggin/pom.xml
you will find 

<jar basedir="${workdir}" destfile="${project.build.directory}/${target}.jar" manifest="${basedir}/src/conf/MANIFEST.MF">
                  <exclude name="org/apache/commons/logging/impl/Log4J*" />
                  <exclude name="org/apache/commons/logging/impl/Avalon*" />
                  <exclude name="org/apache/commons/logging/impl/Jdk13*" />
                  <exclude name="org/apache/commons/logging/impl/LogKit*" />
                  <exclude name="org/apache/commons/logging/impl/Servlet*" />
                </jar>

As you can see Avalon and Servlet classes should be excluded (jar in maven-3.0.4 doesn't have this classes). Probably bug in maven build system.

Anyway maven-bin ships all necessary jars. If not it is a upstream bug and I'm opposite to add this dependencies to ebuild because they are useless.

> > osgi-core-api -> Not needed because it is only test dependency and don't
> > make any sense (it's only API)
> 
> If you can confirm these (Where does it list those as such?) I'll remove
> them; for the second one, osgi-compendium also satisfies as a dependency so
> I'm not so sure about the API part.

Only org.eclipse.sisu.inject.jar *can* be OSGi Bundle and use OSGi API.
You will find in Manifest.mf activator class name.

Activator class have dependency to OSGi but it is not used within sisu and maven. This class can be loaded and properly initialized only in OSGi container (apache-felix, equinox, etc).
Probably upstream packed this class because this jar *can* be OSGi bundle but maven don't use it.
Comment 8 Tom Wijsman (TomWij) (RETIRED) gentoo-dev 2013-07-20 16:52:27 UTC
(In reply to wojtek from comment #7)
> <jar basedir="${workdir}"
> destfile="${project.build.directory}/${target}.jar"
> manifest="${basedir}/src/conf/MANIFEST.MF">
>                   <exclude name="org/apache/commons/logging/impl/Log4J*" />
>                   <exclude name="org/apache/commons/logging/impl/Avalon*" />
>                   <exclude name="org/apache/commons/logging/impl/Jdk13*" />
>                   <exclude name="org/apache/commons/logging/impl/LogKit*" />
>                   <exclude name="org/apache/commons/logging/impl/Servlet*" />
>                 </jar>
> 
> As you can see Avalon and Servlet classes should be excluded (jar in
> maven-3.0.4 doesn't have this classes). Probably bug in maven build system.

No, this solely means they are excluded from the jar; which means nothing with regards to whether they are expected as a dependency or not. The class files I mentioned above are listed in the class files, not in the manifest.

> Anyway maven-bin ships all necessary jars. If not it is a upstream bug and
> I'm opposite to add this dependencies to ebuild because they are useless.

I don't think so, the classes aren't listed in any of the jars.

> > > osgi-core-api -> Not needed because it is only test dependency and don't
> > > make any sense (it's only API)
> > 
> > If you can confirm these (Where does it list those as such?) I'll remove
> > them; for the second one, osgi-compendium also satisfies as a dependency so
> > I'm not so sure about the API part.
> 
> Only org.eclipse.sisu.inject.jar *can* be OSGi Bundle and use OSGi API.
> You will find in Manifest.mf activator class name.
> 
> Activator class have dependency to OSGi but it is not used within sisu and
> maven. This class can be loaded and properly initialized only in OSGi
> container (apache-felix, equinox, etc).
> Probably upstream packed this class because this jar *can* be OSGi bundle
> but maven don't use it.

Hmm, odd; perhaps we should house this under an osgi USE flag, when enabled it pulls the dependency and installs the class and otherwise it does neither.
Comment 9 wojtek 2013-07-20 17:44:56 UTC
(In reply to Tom Wijsman (TomWij) from comment #8)

> > 
> > As you can see Avalon and Servlet classes should be excluded (jar in
> > maven-3.0.4 doesn't have this classes). Probably bug in maven build system.
> 
> No, this solely means they are excluded from the jar; which means nothing
> with regards to whether they are expected as a dependency or not. The class
> files I mentioned above are listed in the class files, not in the manifest.

You are right. This is only "backup" file. It do nothing. But this file shows that something went wrong during build (jar).

{Avalon, Servlet}Logger classes were added accidentally (perhaps).

My point is: this dependencies are missing but everything works OK because default commons-logging don't use Avalon or Servlet logger (even if classes were added by mistake). You will add a lot of dependencies that are useless and don't fix anything besides warnings triggered by JAVA_PKG_STRICT="yes"

On my system this dependencies adds 17 new packages
Comment 10 wojtek 2013-08-07 14:22:43 UTC
(In reply to Tom Wijsman (TomWij) from comment #8)
> (In reply to wojtek from comment #7)
 

> > Only org.eclipse.sisu.inject.jar *can* be OSGi Bundle and use OSGi API.
> > You will find in Manifest.mf activator class name.
> > 
> > Activator class have dependency to OSGi but it is not used within sisu and
> > maven. This class can be loaded and properly initialized only in OSGi
> > container (apache-felix, equinox, etc).
> > Probably upstream packed this class because this jar *can* be OSGi bundle
> > but maven don't use it.
> 
> Hmm, odd; perhaps we should house this under an osgi USE flag, when enabled
> it pulls the dependency and installs the class and otherwise it does neither.

It isn't necessary because it make no sense.
BTW someone filled a bug http://jira.codehaus.org/browse/MNG-5499
Comment 11 Tom Wijsman (TomWij) (RETIRED) gentoo-dev 2013-08-10 11:16:56 UTC
After being away for two weeks, I came back to this; I've made a first commit fixing up the most obvious problem, I haven't managed to understand the rest here yet as I need to look into the whole issue again. I'm planning to do that as part of fixing up the missing dependencies and trying to unbundle more on the next version bump.

+  10 Aug 2013; Tom Wijsman <TomWij@gentoo.org> +maven-bin-3.1.0-r1.ebuild:
+  Revision bump, because package.env could possible change. A first step to fix
+  up dependencies for bug #472850, cuts 2 or more optional dependencies; after
+  which we need to deal with bug #477436 as well as unbundle more dependencies
+  where possible. Thanks to wojtek for reporting and researching the situation.

Also, thank you for mentioning the bug.
Comment 12 wojtek 2013-08-10 14:33:59 UTC
I'll try to explain :)

1. maven-bin is "binary" like oracle-jdk. It require only jdk.

2. maven-bin archive is common to all platforms (linux, windows, etc) and contains all necessary libs. If something is missing then it is broken on all platforms not only in gentoo.
I don't see a reason why we would fix missing libs (we can fix broken archive but portage and java doesn't play well in these days).

3. This issue appears for two reasons
a) something went wrong when maven-bin was released (there is a lot of unused libs in maven archive)
b) script that analyze dependencies doesn't fit these days to java world
in java there is API and implementation. javax.servlet package is useless without servlet container. You will get runtime exceptions or null pointers without container.

4. We don't build maven-bin but only extract from archive and these dependencies are only compile-time not runtime
Comment 13 wojtek 2013-10-07 15:48:20 UTC
maven-bin-3.1.1 is out :)

http://maven.apache.org/docs/3.1.1/release-notes.html
Comment 14 wojtek 2014-05-05 13:56:32 UTC
maven-bin-3.2.1 is out
http://maven.apache.org/docs/3.2.1/release-notes.html

according to dependencies discussion maybe something like USE="vanilla" will work?
Or control bundled dependencies like firefox (system-icu, system-cairo, etc)?
Comment 15 wojtek 2015-01-20 12:49:58 UTC
3.2.5 is out

I still believe that these dependencies are unneeded but some of missing deps are now bundled with maven so we can remove them


dev-java/aopalliance:1  -> aopalliance-1.0.jar
dev-java/commons-cli:1  -> commons-cli-1.2.jar
dev-java/commons-io:1 -> commons-io-2.2.jar
dev-java/javax-inject:0 -> javax.inject-1.jar
dev-java/jsoup:0   -> shaded within wagon-http-2.8-shaded.jar 
dev-java/jsr250:0  -> jsr250-api-1.0.jar


Probably dev-java/osgi-core-api:0 is not needed too but I can't test against JAVA_PKG_STRICT="yes" right now
Comment 16 Joerg Schaible 2018-08-04 11:57:25 UTC
5 years later I write still my own ebuilds, Maven 3.5.4 is current.