Bug#903428: javadocs generated by javahelper include jquery

[tony mancill]

On Mon, Jul 09, 2018 at 11:41:24PM +0200, Markus Koschany wrote:
> Am 09.07.2018 um 23:35 schrieb Emmanuel Bourg:
> > Le 09/07/2018 à 23:29, Markus Koschany a écrit :
> > 
> >> We should really aim for the simplest solution. Actually I don't see any
> >> need to patch the javadoc tool because we could easily solve this at the
> >> packaging level. Just replace the embedded jquery library with symlinks
> >> to Debian's system library and let openjdk depend on jquery. Problem 
> >> solved.
> > 
> > Sounds fine.
> > 
> > Or remove these mostly unused documentation packages we spend too much
> > time fixing or discussing after each new JDK hiccup ;)
> 
> Yeah, brutal but there is truth in it. I would really like to keep the
> current level of support for Java documentation but I agree when it
> becomes too painful and we waste too much time to fix such issues, we
> should simply drop it.

I'm in favor of dropping the -java-doc packages completely and instead
using our time and effort to improve the state of our runtime libraries,
toolchain and application packages.  (It would be a different story if
we were developing a distribution for Java developers who don't have
ready access to other sources of documentation, but I have a hard time
imagining that our users would prefer javadocs over functioning and
secure libraries.)

> Well, now we have to convince doku to implement this solution, or at
> least to accept it, without closing the bug report again. Volunteers?

Hmm... I choose to believe that the bug (we're talking about [1],
right?) was mass-closed along with everything else that was open against
src:openjdk-9.  It seems like a reasonable and very "Debian" approach to
avoid embedding an available system library.  If we really want javadoc,
we could resubmit (preferably with a patch).

Cheers,
tony

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883981


signature.asc
Description: PGP signature
__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

cobertura: status change on tests.reproducible-builds.org/debian

[Reproducible builds folks]

2018-07-08 23:00 
https://tests.reproducible-builds.org/debian/unstable/amd64/cobertura changed 
from reproducible -> FTBFS

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

batik: status change on tests.reproducible-builds.org/debian

[Reproducible builds folks]

2018-07-08 00:53 
https://tests.reproducible-builds.org/debian/unstable/amd64/batik changed from 
FTBFS -> reproducible

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#903428: javadocs generated by javahelper include jquery

[Markus Koschany]

Am 09.07.2018 um 23:35 schrieb Emmanuel Bourg:
> Le 09/07/2018 à 23:29, Markus Koschany a écrit :
> 
>> We should really aim for the simplest solution. Actually I don't see any
>> need to patch the javadoc tool because we could easily solve this at the
>> packaging level. Just replace the embedded jquery library with symlinks
>> to Debian's system library and let openjdk depend on jquery. Problem solved.
> 
> Sounds fine.
> 
> Or remove these mostly unused documentation packages we spend too much
> time fixing or discussing after each new JDK hiccup ;)

Yeah, brutal but there is truth in it. I would really like to keep the
current level of support for Java documentation but I agree when it
becomes too painful and we waste too much time to fix such issues, we
should simply drop it.

Well, now we have to convince doku to implement this solution, or at
least to accept it, without closing the bug report again. Volunteers?

:E






signature.asc
Description: OpenPGP digital signature
__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#903428: javadocs generated by javahelper include jquery

[Emmanuel Bourg]

Le 09/07/2018 à 23:29, Markus Koschany a écrit :

> We should really aim for the simplest solution. Actually I don't see any
> need to patch the javadoc tool because we could easily solve this at the
> packaging level. Just replace the embedded jquery library with symlinks
> to Debian's system library and let openjdk depend on jquery. Problem solved.

Sounds fine.

Or remove these mostly unused documentation packages we spend too much
time fixing or discussing after each new JDK hiccup ;)

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#903428: javadocs generated by javahelper include jquery

[Markus Koschany]

Am 09.07.2018 um 23:26 schrieb Emmanuel Bourg:
> Le 09/07/2018 à 23:14, Markus Koschany a écrit :
> 
>> I believe the use case of viewing javadoc outside of a Debian
>> system is negligible and we should just symlink jquery.
> 
> Viewing an API documentation from a lib*-java-doc package outside of a
> Debian system is indeed a negligible use case. But if the javadoc tool
> was to be patched to link any javadoc generated with the system jquery,
> this would render our openjdk package unfit for many development scenarios.
> 
> If the jquery substitution is implemented directly in the javadoc tool
> it must be limited to documentation aimed at lib*-java-doc packages
> (either with an extra parameter passed by the helpers, or by detecting a
> debian specific environment variable, like DEB_BUILD_ARCH).

We should really aim for the simplest solution. Actually I don't see any
need to patch the javadoc tool because we could easily solve this at the
packaging level. Just replace the embedded jquery library with symlinks
to Debian's system library and let openjdk depend on jquery. Problem solved.

Regards,

Markus



signature.asc
Description: OpenPGP digital signature
__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#903428: javadocs generated by javahelper include jquery

[Emmanuel Bourg]

Le 09/07/2018 à 23:14, Markus Koschany a écrit :

> I believe the use case of viewing javadoc outside of a Debian
> system is negligible and we should just symlink jquery.

Viewing an API documentation from a lib*-java-doc package outside of a
Debian system is indeed a negligible use case. But if the javadoc tool
was to be patched to link any javadoc generated with the system jquery,
this would render our openjdk package unfit for many development scenarios.

If the jquery substitution is implemented directly in the javadoc tool
it must be limited to documentation aimed at lib*-java-doc packages
(either with an extra parameter passed by the helpers, or by detecting a
debian specific environment variable, like DEB_BUILD_ARCH).

Emmanuel Bourg

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#903428: javadocs generated by javahelper include jquery

[Markus Koschany]

Am 09.07.2018 um 23:01 schrieb Emmanuel Bourg:
> Le 09/07/2018 à 22:41, Christoph Berg a écrit :
> 
>> Or even better, have javadoc put in the symlink.
> 
> Not a good idea. The javadoc generated would no longer be usable outside
> Debian. Developers would no longer be able to generate the javadoc of
> their libraries a upload it to a web server.

I think this should work in the context of Debian. It's kind of funny
that we always argue about the usage of Debian packages (e.g. the Spring
framework clearly intended to be for web development, affected by
numerous security vulnerabilities but it is assumed nobody uses it in
production environments but only for building unrelated packages), still
we care about the use case of shipping javadoc outside of a Debian
environment.

In my opinion this issue should be fixed at the OpenJDK level. I am the
one who filed bug #883981 and I'm a bit disappointed that it was closed
automatically, not even reassigned to openjdk-10. IMO it would be
possible to create a javahelper/maven-debian-helper/etc option to choose
between embedding jquery into javadoc or symlinking to the system
libraries. I believe the use case of viewing javadoc outside of a Debian
system is negligible and we should just symlink jquery.

Markus



signature.asc
Description: OpenPGP digital signature
__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#903428: javadocs generated by javahelper include jquery

[Emmanuel Bourg]

Le 09/07/2018 à 22:41, Christoph Berg a écrit :

> Or even better, have javadoc put in the symlink.

Not a good idea. The javadoc generated would no longer be usable outside
Debian. Developers would no longer be able to generate the javadoc of
their libraries a upload it to a web server.

Emmanuel Bourg

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#903428: javadocs generated by javahelper include jquery

[Thomas Koch]

Package: javahelper
Severity: important
Tags: newcomer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

The command jh_build calls javadoc. The output of javadoc contains a copy of
jquery which leads to lintian error:
https://lintian.debian.org/tags/embedded-javascript-library.html

One solution would be if javahelper would strip the embedded jquery library
and replace it with a symlink to the version from the jquery debian package
and add a dependency on the jquery package to the -doc package.

The problem is that we'd need to rebuild all javadoc packages if the jquery
package gets updated in an incompatible way.

Therefor it would be better if javadoc had an option to build the docs without
jquery, but I have not found such an option. What does javadoc need jquery for
in a world with HTML5?

There was bug 883981 about exactly this ("openjdk-9: embeds jquery.js when
creating javadoc") which got autoclosed.

I made this bug important since it leads to policy violation errors in the
generated packages. It is not feasible to fix this bug in all the generated
- -doc packages manually.

Java 11 should at least come with an updated jquery:
https://bugs.openjdk.java.net/browse/JDK-8204865

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEdgQCBVl/ppbxMTvKB/xIkQQrploFAltDu/wACgkQB/xIkQQr
ploAtQ//fWEVjPbtCzCVXO/YhjZ9YJ1iXTC1ErfIveY+6SQ57USahu6I9GQ6IZll
WNtYuXWaxhOeHtEmEVQmSaSU0urXA9n9dq4VjZ0wznGzj84w/73UX+KcvyLmRo5f
fiWyHTdNC9IPpdEpPbmSgWESXOZ4HlSb591CZlp61HnZ71Px0m/B0nL6f1eTZ9pF
/B0Gyr1BTQCg3reDINSaZrKXtdK7xqVWguFQD/JxP/T4+71ulzMATOHD8usLYiyZ
/4t2VfPNFUTfaP2Kgwq/xeezGp3c/rzLtIk4gosnmSV/il8fYZFe5JVUBwSp7RR8
9eD8XHm7wMnle77uuJpOSUhdqF3IjBJ/4vUJS4IenrUHg5z4RQco1niP/qOqWw6G
CuPjqkmTzBF62xQFiPlvarsobs7KFLdn33cmdTZoITpbG84Ycdgwve5hpryJ+dgR
G8dwjFI+262bXMBP5mic7aGWOtLpPVix34atcl5s6j3h8DWwgOl45fm14CDGq3Ix
XRO1cTPAHy61hKm5FPXbWWp8BQ0DlLLdjio0YLSqTCnNvkg1Z7N+68sQWmIFAyPq
Oda/zF04Oz6qshdOQb7CoiHZZ9HiL2G+22/097wSkjL3kBCogKxwWJw+R/fWJfKx
D0hJSX6/ZcSozbIzwJpQFfDrvqc4TLij0gWMzXciEZePCZr0AwU=
=sf3F
-END PGP SIGNATURE-

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Bug#903420: RFA: libjsr311-api-java -- JSR 311, JAX-RS, Java API for RESTful Web Services

[Thomas Koch]

Package: wnpp
Severity: normal

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

I request an adopter for the libjsr311-api-java package.

The package description is:
 Java API for the development of Web services built according to the
 Representational State Transfer (REST) architectural style.

I don't use Java anymore and my knowledge about Java packaging has
faded away.

I'm preparing an upload to bring the package to the latest standard
before I go and will need a sponsor for this. I'm working on it here

https://mentors.debian.net/package/libjsr311-api-java
https://salsa.debian.org/thk-guest/libjsr311-api-java/commits/test

Thank you!

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEdgQCBVl/ppbxMTvKB/xIkQQrploFAltDqToACgkQB/xIkQQr
ployEA/+NCHAhT1xw+HDgfz419dHu5+D26cOvNbKTQAh2G7Je0jz7lkNTx3ifGA7
2rTXnGCDchiR4MnQs1hVJXibB9VmCSBTDwwhZ22Pax4leIauYunrTJdIwCmz8SjU
Wgt0rrpm8htPj7rdsGDEd9AayxFy7ygxM/eOIJIuEkk2dQeCPF7OC43r53tKhz9S
L5bgSN+YBdrBEF+ztIK60cl72LFKeZlPJq3E9ewjIN2Yjgfr4EKpz74RRIu9rueB
Q0W/SNUSbMXkxSAeseZbRr6i8GZuV7wtmJEbRuqVlnLcFGkwSbmWEvxlyHkQBu6e
H3yYronf+HEW5wB/n+LY7PKbxC+cF9DvPISK1meXaFn3bzR7f9n/5ZMqXayvvMzj
Y9yDCnFQCRmOp62+nLyHSTuBlDeY8bC+gARAF1BiRvkfFLfuOvsfMy3ZhcB3mRMx
1Q8yhG9nC4G8LTG2QYbJetOxq3jQVbaF6QJppLUfz81XCi+lb1lwQZ5wZZq9NfO1
h0NQE3qHlgOiz0NEg6Snmvz+rRPxuT7nxARDo5UCcB++CxpR+4BmtrIaMSbvZkGU
SPBSqy8Ax1405AXedQghGqn3ebhEy+qcKJkL0cRTS7WaWU1VKMgF4mQsj678daQE
Pq0YeX82xdud6cwwr9ylWoAMPhtNr0kicOargmIrASDySe2lvNQ=
=LmPL
-END PGP SIGNATURE-

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

[bts-link] source package maven-bundle-plugin

[debian-bts-link]

#
# bts-link upstream status pull for source package maven-bundle-plugin
# see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
# https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-l...@lists.debian.org

# remote status report for #868913 (http://bugs.debian.org/868913)
# Bug title: libmaven-bundle-plugin-java: Unexpected error about classes found 
in the wrong directory
#  * http://issues.apache.org/jira/browse/FELIX-5430
#  * remote status changed: (?) -> Open
usertags 868913 + status-Open

thanks

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Processed: [bts-link] source package src:undertow

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> #
> # bts-link upstream status pull for source package src:undertow
> # see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
> # https://bts-link-team.pages.debian.net/bts-link/
> #
> user debian-bts-l...@lists.debian.org
Setting user to debian-bts-l...@lists.debian.org (was 
debian-bts-l...@lists.debian.org).
> # remote status report for #885338 (http://bugs.debian.org/885338)
> # Bug title: CVE-2017-12165
> #  * https://issues.jboss.org/browse/UNDERTOW-1251
> #  * remote status changed: (?) -> Resolved
> #  * remote resolution changed: (?) -> Done
> #  * closed upstream
> tags 885338 + fixed-upstream
Bug #885338 [src:undertow] CVE-2017-12165
Added tag(s) fixed-upstream.
> usertags 885338 + status-Resolved resolution-Done
There were no usertags set.
Usertags are now: status-Resolved resolution-Done.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
885338: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=885338
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

Processed: [bts-link] source package commons-daemon

[Debian Bug Tracking System]

Processing commands for cont...@bugs.debian.org:

> #
> # bts-link upstream status pull for source package commons-daemon
> # see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
> # https://bts-link-team.pages.debian.net/bts-link/
> #
> user debian-bts-l...@lists.debian.org
Setting user to debian-bts-l...@lists.debian.org (was 
debian-bts-l...@lists.debian.org).
> # remote status report for #770304 (http://bugs.debian.org/770304)
> # Bug title: New -cwd default needlessly breaks backwards compatibility
> #  * http://issues.apache.org/jira/browse/DAEMON-327
> #  * remote status changed: (?) -> Resolved
> #  * remote resolution changed: (?) -> Won-t-Fix
> #  * closed upstream
> tags 770304 + fixed-upstream
Bug #770304 [jsvc] New -cwd default needlessly breaks backwards compatibility
Added tag(s) fixed-upstream.
> usertags 770304 + status-Resolved resolution-Won-t-Fix
There were no usertags set.
Usertags are now: status-Resolved resolution-Won-t-Fix.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
770304: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770304
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

[bts-link] source package src:undertow

[debian-bts-link]

#
# bts-link upstream status pull for source package src:undertow
# see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
# https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-l...@lists.debian.org

# remote status report for #885338 (http://bugs.debian.org/885338)
# Bug title: CVE-2017-12165
#  * https://issues.jboss.org/browse/UNDERTOW-1251
#  * remote status changed: (?) -> Resolved
#  * remote resolution changed: (?) -> Done
#  * closed upstream
tags 885338 + fixed-upstream
usertags 885338 + status-Resolved resolution-Done

thanks

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

[bts-link] source package libxmlrpc3-java

[debian-bts-link]

#
# bts-link upstream status pull for source package libxmlrpc3-java
# see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
# https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-l...@lists.debian.org

# remote status report for #801002 (http://bugs.debian.org/801002)
# Bug title: libxmlrpc3-java: depends on obsolete libcommons-httpclient-java 
library
#  * http://issues.apache.org/jira/browse/XMLRPC-191
#  * remote status changed: (?) -> Open
usertags 801002 + status-Open

thanks

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

[bts-link] source package src:maven-plugin-tools

[debian-bts-link]

#
# bts-link upstream status pull for source package src:maven-plugin-tools
# see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
# https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-l...@lists.debian.org

# remote status report for #898821 (http://bugs.debian.org/898821)
# Bug title: maven-plugin-tools: FTBFS with Java 10 due to 
com.sun.tools.doclets removal
#  * http://issues.apache.org/jira/browse/MPLUGIN-339
#  * remote status changed: (?) -> Open
usertags 898821 + status-Open

thanks

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

[bts-link] source package libxerces2-java

[debian-bts-link]

#
# bts-link upstream status pull for source package libxerces2-java
# see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
# https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-l...@lists.debian.org

# remote status report for #605389 (http://bugs.debian.org/605389)
# Bug title: libxerces2-java: fails to XInclude when element xpointer refers to 
xml:id
#  * http://issues.apache.org/jira/browse/XERCESJ-1113
#  * remote status changed: (?) -> Open
usertags 605389 + status-Open

# remote status report for #609536 (http://bugs.debian.org/609536)
# Bug title: libxerces2-java: please support xpointer() XPointer scheme
#  * http://issues.apache.org/jira/browse/XERCESJ-873
#  * remote status changed: (?) -> Open
usertags 609536 + status-Open

thanks

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

[bts-link] source package commons-daemon

[debian-bts-link]

#
# bts-link upstream status pull for source package commons-daemon
# see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
# https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-l...@lists.debian.org

# remote status report for #770304 (http://bugs.debian.org/770304)
# Bug title: New -cwd default needlessly breaks backwards compatibility
#  * http://issues.apache.org/jira/browse/DAEMON-327
#  * remote status changed: (?) -> Resolved
#  * remote resolution changed: (?) -> Won-t-Fix
#  * closed upstream
tags 770304 + fixed-upstream
usertags 770304 + status-Resolved resolution-Won-t-Fix

thanks

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

[bts-link] source package src:commons-daemon

[debian-bts-link]

#
# bts-link upstream status pull for source package src:commons-daemon
# see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
# https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-l...@lists.debian.org

# remote status report for #700898 (http://bugs.debian.org/700898)
# Bug title: commons-daemon: FTBFS because it whitelists architectures
#  * http://issues.apache.org/jira/browse/DAEMON-294
#  * remote status changed: (?) -> Open
usertags 700898 + status-Open

thanks

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.

[bts-link] source package axis

[debian-bts-link]

#
# bts-link upstream status pull for source package axis
# see http://lists.debian.org/debian-devel-announce/2006/05/msg1.html
# https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-l...@lists.debian.org

# remote status report for #800994 (http://bugs.debian.org/800994)
# Bug title: axis: depends on obsolete libcommons-httpclient-java library
#  * http://issues.apache.org/jira/browse/AXIS-2911
#  * remote status changed: (?) -> Open
usertags 800994 + status-Open

thanks

__
This is the maintainer address of Debian's Java team
.
 Please use
debian-j...@lists.debian.org for discussions and questions.