Hi there,
we just noticed that cassandra is currently published with inconsistent
dependencies. The inconsistencies exist between the published pom and
the published distribution (tar.gz). I compared hashes of the libs of
several versions and the inconsistencies are different each time.
However, I have not found a single cassandra release without
inconsistencies.
This is a serious issue for us as we are using pom dependencies for
development/testing and a tarball distribution for production. Over the
long term it is very likely that we run into problems because sth. does
not work as expected.
I had a look at the build process of cassandra and noticed that all
dependencies that are included in the tarball are actually versioned in
the libs directory. Unfortunately, these dependencies do not match the
ones that are placed into the pom. Is there any reason for doing so?
The first things that came to my mind for solving the issue are:
a.) Remove the versioned dependencies and use ivy to retrieve the needed
dependencies for compilation and packaging
b.) Create a fat jar that includes all dependencies of cassandra and
publish that fat jar, too
c.) relabel all dependencies from the lib folder and republish them, too.
What do you think?
Kind regards
Matthias
