Hi

I am writing to this list because I am currently trying to make a debian
package for openfire [1], a jabber server written java, for which a RFP
has already been filed [2].

I would like to make this package suitable for inclusion in debian and I
am willing to maintain it.

So I am looking for a debian developper to review this package to help
me put it in a good shape.

I tried to use jar files provided by debian packages instead of the ones
provided in the archive when possible.

However I may have some license problem with some files, see my last
mail on the RFP bug or in the upstream bug [3].

You can find the packages I made at the following urls:
http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1-1.diff.gz
http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1-1.dsc
http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1-1_all.deb
http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1-1_i386.changes
http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1.orig.tar.gz

Yann

[1] http://www.igniterealtime.org/projects/openfire/
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429914
[3] http://www.igniterealtime.org/issues/browse/JM-765


--
To UNSUBSCRIBE, email to debian-java-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Thu, June 12, 2008 19:14, Yann Rouillard wrote:
> Hi
>
> I am writing to this list because I am currently trying to make a debian
> package for openfire [1], a jabber server written java, for which a RFP
> has already been filed [2].
>
> I would like to make this package suitable for inclusion in debian and I
> am willing to maintain it.
>
> So I am looking for a debian developper to review this package to help
> me put it in a good shape.
>
> I tried to use jar files provided by debian packages instead of the ones
> provided in the archive when possible.
>
> However I may have some license problem with some files, see my last
> mail on the RFP bug or in the upstream bug [3].
>
> You can find the packages I made at the following urls:
> http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1-1.diff.gz
> http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1-1.dsc
> http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1-1_all.deb
> http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1-1_i386.changes
> http://debian.pleiades.fr.eu.org/unstable/openfire_3.5.1.orig.tar.gz
>
> Yann
>
> [1] http://www.igniterealtime.org/projects/openfire/
> [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429914
> [3] http://www.igniterealtime.org/issues/browse/JM-765
>

Hi Yann,

I'm not a DD so I would not be able to help you upload the package, but
there are others on the list who could do that when you are ready. A few
comments to be going on with...

1) You build openfire using Sun Java. Does it fail to build with a free
Java implementation? If it could be built with a free Java more people
would probably be interested in helping.

2) If it can't be built with a free Java, then openfire would have to go
into contrib (not part of the core debian distro). You'd need to amend
your debian/control for this.

3) The orig.tar.gz is almost 50Mb, and includes what looks to be a Java
runtime (I'd guess a Sun one). This would should be removed from the
upstream tarball.

4) There are many other jars in the tarball, and these should be removed
as well (even though you have included their copyrights/licenses in
debian/copyright). Generally binaries are not allowed in the orig.tar.gz
files (because of potential licensing issues, concerns about if the
package [and its dependencies] can be built from free source, size of
archive etc). You would normally also prune the Javadocs etc and
regenerate them in your debian build.

5) The compiled Jars should normally live in /usr/share/java (symlinked
from elsewhere if necessary). I think you have got them the other way
around. The Jars are also normally versioned as well (e.g. junit.jar ->
junit-3.8.1.1.jar).

6) Are you sure the postinst is necessary? The mkdirs / chowns etc could
be done as part of debian/rules.

I hope this helps,

Paul


--
To UNSUBSCRIBE, email to debian-java-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Fri Jun 13 12:53, Paul Cager wrote:

> I'm not a DD so I would not be able to help you upload the package, but
> there are others on the list who could do that when you are ready. A few
> comments to be going on with...

I am a DD and would be happy to sponsor this. If you can send me a link
to the source package once you've addressed the issues that Paul raised
I can review it.

Matt
--
Matthew Johnson

Paul Cager a écrit :
> Hi Yann,
>
> I'm not a DD so I would not be able to help you upload the package, but
> there are others on the list who could do that when you are ready. A few
> comments to be going on with...
>
> 1) You build openfire using Sun Java. Does it fail to build with a free
> Java implementation? If it could be built with a free Java more people
> would probably be interested in helping.

I didn't yet try to build openfire with a free jvm, that's on my todo
list but I want first to produce a working and compliant package that
uses sun java jvm.

But I suspect I will have some problem with free jvm, quoting one
openfire developper:
"Openfire uses at least one thing that's specifically a "sun proprietary
library" ... which may or may not be in this IceaTea build."

> 2) If it can't be built with a free Java, then openfire would have to go
> into contrib (not part of the core debian distro). You'd need to amend
> your debian/control for this.

Ok I will do that.

> 3) The orig.tar.gz is almost 50Mb, and includes what looks to be a Java
> runtime (I'd guess a Sun one). This would should be removed from the
> upstream tarball.

I am currently maintaining the package in a version control system with
MergeWithUpstream enabled. I use bzr-builddeb.

Do you know how I can change the upstream tarballs with that configuration ?

> 4) There are many other jars in the tarball, and these should be removed
> as well (even though you have included their copyrights/licenses in
> debian/copyright). Generally binaries are not allowed in the orig.tar.gz
> files (because of potential licensing issues, concerns about if the
> package [and its dependencies] can be built from free source, size of
> archive etc).

So this means I have to make a debian package for all the jars that are
not in debian. Outch, this will really be a lot of work.
Openfire uses 30/40 java libraries that are not packaged in Debian.

> You would normally also prune the Javadocs etc and
> regenerate them in your debian build.

Ok I will do that.

> 5) The compiled Jars should normally live in /usr/share/java (symlinked
> from elsewhere if necessary). I think you have got them the other way
> around. The Jars are also normally versioned as well (e.g. junit.jar ->
> junit-3.8.1.1.jar).

Even jars only used by openfire should go in /usr/share/java ?

> 6) Are you sure the postinst is necessary? The mkdirs / chowns etc could
> be done as part of debian/rules.

Ok, i will change that.

> I hope this helps,

Definitely !
Thanks for your help.
I will soon produce a new package that will solves some of the issues
you raised.

Yann


--
To UNSUBSCRIBE, email to debian-java-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Fri Jun 13 19:52, Yann Rouillard wrote:
> >

Hi Yann,

> > 3) The orig.tar.gz is almost 50Mb, and includes what looks to be a Java
> > runtime (I'd guess a Sun one). This would should be removed from the
> > upstream tarball.
>
> I am currently maintaining the package in a version control system with
> MergeWithUpstream enabled. I use bzr-builddeb.
>
> Do you know how I can change the upstream tarballs with that configuration ?

You will need to repack the tarball with the non-dfsg material removed.
Typically this will entail changing the upstream version number to have
.dfsg at the end and providing a get-orig-source target in debian/rules
which will automatically take an upstream tarball, unpack it, remove all
the non-free stuff and re-pack it again, noting in the copyright file
that you have done this.
>
> > 4) There are many other jars in the tarball, and these should be removed
> > as well (even though you have included their copyrights/licenses in
> > debian/copyright). Generally binaries are not allowed in the orig.tar.gz
> > files (because of potential licensing issues, concerns about if the
> > package [and its dependencies] can be built from free source, size of
> > archive etc).
>
> So this means I have to make a debian package for all the jars that are
> not in debian. Outch, this will really be a lot of work.
> Openfire uses 30/40 java libraries that are not packaged in Debian.

Yes, this is the policy. If these libraries are simple then packaging
them is fairly quick and easy. Have a look at the javahelper package
which contains scripts to make your life a lot easier.

> > 5) The compiled Jars should normally live in /usr/share/java (symlinked
> > from elsewhere if necessary). I think you have got them the other way
> > around. The Jars are also normally versioned as well (e.g. junit.jar ->
> > junit-3.8.1.1.jar).
>
> Even jars only used by openfire should go in /usr/share/java ?

There's some discussion about this, but I think it is entirely
reasonable to put jars which aren't for public use under
/usr/share/openfire (and I do so with my packages). Changing the
debian-java policy to allow this is on my todo list.

Matt
--
Matthew Johnson

Hello,

On Fri, 2008-06-13 at 21:08 +0100, Matthew Johnson wrote:
> On Fri Jun 13 19:52, Yann Rouillard wrote:

> > > 4) There are many other jars in the tarball, and these should be removed
> > > as well (even though you have included their copyrights/licenses in
> > > debian/copyright). Generally binaries are not allowed in the orig.tar.gz
> > > files (because of potential licensing issues, concerns about if the
> > > package [and its dependencies] can be built from free source, size of
> > > archive etc).
> >
> > So this means I have to make a debian package for all the jars that are
> > not in debian. Outch, this will really be a lot of work.
> > Openfire uses 30/40 java libraries that are not packaged in Debian.
>
> Yes, this is the policy.

Do you refer to having to create seperate source packages here?
If so I believe, your statement is not true. The only section in the
policy which I can find to support that position, is the line:
Packages involving shared libraries should be split up into
several binary packages.
(from Chapter 8 - Shared libraries of the general policy)
But this refers only to binary packages and is only a SHOULD. Can you
please point out the section, that requires libraries to be shipped in a
separate source package?

Of course all class files contained in the source file must be purged
and the copyright notice of all contained libraries must be contained in
debian/copyright.

Best regards

Ben

--
Please do not send any email to ben-ml@gmx.net -- all email not
originating from the mailing list will be deleted. Use the reply to
address instead.


--
To UNSUBSCRIBE, email to debian-java-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Sat Jun 14 21:41, Benjamin Mesing wrote:

> Do you refer to having to create seperate source packages here?
> If so I believe, your statement is not true. The only section in the
> policy which I can find to support that position, is the line:
> Packages involving shared libraries should be split up into
> several binary packages.
> (from Chapter 8 - Shared libraries of the general policy)
> But this refers only to binary packages and is only a SHOULD. Can you
> please point out the section, that requires libraries to be shipped in a
> separate source package?

Oh sure, if the _source_ is distributed from upstream together then it
can and probably should be a single source package. I was assuming that
these were external libraries which were being distributed as jars with
the source for this program.

Matt

--
Matthew Johnson

* Matthew Johnson:

> Oh sure, if the _source_ is distributed from upstream together then it
> can and probably should be a single source package. I was assuming that
> these were external libraries which were being distributed as jars with
> the source for this program.

However, the sources should be repackaged and the JAR files removed.
Otherwise, dpkg-source will complain, provided that the JAR files are
actually recompiled from source.


--
To UNSUBSCRIBE, email to debian-java-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Matthew Johnson a écrit :
> On Fri Jun 13 19:52, Yann Rouillard wrote:
>>> 4) There are many other jars in the tarball, and these should be removed
>>> as well (even though you have included their copyrights/licenses in
>>> debian/copyright). Generally binaries are not allowed in the orig.tar.gz
>>> files (because of potential licensing issues, concerns about if the
>>> package [and its dependencies] can be built from free source, size of
>>> archive etc).
>> So this means I have to make a debian package for all the jars that are
>> not in debian. Outch, this will really be a lot of work.
>> Openfire uses 30/40 java libraries that are not packaged in Debian.
>
> Yes, this is the policy. If these libraries are simple then packaging
> them is fairly quick and easy. Have a look at the javahelper package
> which contains scripts to make your life a lot easier.

Hi again,

Thanks for your answers and advices.

I began to work on packaging jars used by openfire to be able to remove
them for the openfire package.

I began with jdmns, jstun and shaj for which I opened ITP bug [1] [2] [3].

It would be great if you could you review these packages, so I have some
feedback before I work on the remaining ones.

You will find the packages in my personal repository:

http://debian.pleiades.fr.eu.org/unstable/shaj_0.5-1.diff.gz
http://debian.pleiades.fr.eu.org/unstable/shaj_0.5-1.dsc
http://debian.pleiades.fr.eu.org/unstable/shaj_0.5-1_i386.changes
http://debian.pleiades.fr.eu.org/unstable/shaj_0.5.orig.tar.gz
http://debian.pleiades.fr.eu.org/unstable/libshaj-java_0.5-1_all.deb
http://debian.pleiades.fr.eu.org/unstable/libshaj-jni_0.5-1_i386.deb

http://debian.pleiades.fr.eu.org/unstable/jmdns_2.0-1.diff.gz
http://debian.pleiades.fr.eu.org/unstable/jmdns_2.0-1.dsc
http://debian.pleiades.fr.eu.org/unstable/jmdns_2.0-1_i386.changes
http://debian.pleiades.fr.eu.org/unstable/jmdns_2.0.orig.tar.gz
http://debian.pleiades.fr.eu.org/unstable/libjmdns-java_2.0-1_all.deb

http://debian.pleiades.fr.eu.org/unstable/jstun_0.7.1-1.diff.gz
http://debian.pleiades.fr.eu.org/unstable/jstun_0.7.1-1.dsc
http://debian.pleiades.fr.eu.org/unstable/jstun_0.7.1-1_i386.changes
http://debian.pleiades.fr.eu.org/unstable/jstun_0.7.1.orig.tar.gz
http://debian.pleiades.fr.eu.org/unstable/libjstun-java_0.7.1-1_all.deb

Yann


[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=486697
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=486718
[3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=486879


--
To UNSUBSCRIBE, email to debian-java-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Wed Jun 18 22:25, Yann Rouillard wrote:
> Thanks for your answers and advices.
>
> I began to work on packaging jars used by openfire to be able to remove
> them for the openfire package.
>
> I began with jdmns, jstun and shaj for which I opened ITP bug [1] [2] [3].
>
> It would be great if you could you review these packages, so I have some
> feedback before I work on the remaining ones.

No problem, here are some comments.

First of all I'll say the packages are nice and clean and look generally
in good shape.

Next some licence quibbles:

shaj:
The apache 2.0 and GPLv2 are not compatible[0]. Your packaging will
have to be licenced under a compatible licence. Apache 2.0 is good
(everything under the same licence) as is MIT/X11/expat. GPLv3 would
also work.

jstun:
The package is licenced under either Apache 2.0 or GPLv2. Ideally
both would be listed in debian/copyright, but if not you must make
the packaging and upstream licences compatible (see above).

jmdns:
See the shaj comments on packaging/upstream licences. Also, I notice
the headers of some files (src/javax/jmdns/impl/tasks/*java) says:

//Copyright 2003-2005 Arthur van Hoff, Rick Blair
//Licensed under Apache License version 2.0
//Original license LGPL

Was the relicencing done by the original authors? I don't think you
can relicence an LGPL program to apache unless you are the original
author.

Other than that, they build and are lintian clean and they install.

However, I notice that libshaj-java does not depend on libshaj-jni. I
assume it should do?

Matt

0. http://www.apache.org/licenses/GPL-compatibility.html

--
Matthew Johnson