Path: csiph.com!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!bofh.it!news.nic.it!robomod From: tony mancill Newsgroups: linux.debian.maint.java Subject: Re: packaging Go runtime for ANTLR4 Date: Wed, 28 Jul 2021 17:10:01 +0200 Message-ID: References: X-Mailbox-Line: From debian-java-request@lists.debian.org Wed Jul 28 15:08:22 2021 Old-Return-Path: X-Amavis-Spam-Status: No, score=-11.601 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, LDO_WHITELIST=-5, PGPSIGNATURE=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -5.5 X-Gm-Message-State: AOAM533KB90YV5Ds7hws8n/VZRntXAUKDE0vbxrYDeywPCPLsvaT4qhZ //l8xs9LZmhr1TF5iWoEaS0= X-Google-SMTP-Source: ABdhPJxZdwBdby36G0oHtuVhaApBkpfQGIDhMpw6bBYzwCtpuin6iErnqcbnzCuQdAaSuWEcycnqmQ== X-Received: by 2002:aa7:9f85:0:b029:32c:b091:ebc with SMTP id z5-20020aa79f850000b029032cb0910ebcmr307759pfr.4.1627484885922; Wed, 28 Jul 2021 08:08:05 -0700 (PDT) Sender: robomod@news.nic.it MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ml5l2v5pu2dqq5wl" Content-Disposition: inline X-Mailing-List: archive/latest/22891 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/20210728150803.qfw5los2idiy24ld@lark Approved: robomod@news.nic.it Lines: 69 Organization: linux.* mail to news gateway X-Original-Cc: Peymaneh Nejad , debian-java@lists.debian.org X-Original-Date: Wed, 28 Jul 2021 08:08:03 -0700 X-Original-Message-ID: <20210728150803.qfw5los2idiy24ld@lark> X-Original-References: X-Original-Sender: tony mancill Xref: csiph.com linux.debian.maint.java:12262 --ml5l2v5pu2dqq5wl Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Jul 28, 2021 at 08:41:46AM +0200, Emmanuel Bourg wrote: > Hi Peymaneh, >=20 > Le 2021-07-27 10:09, Peymaneh Nejad a =E9crit=A0: >=20 > > Is it intended or wished for that additional runtimes other than Java > > are packaged in seperate source packages >=20 > Yes it is, for several reasons: > - The Java Team doesn't have the time and skills to maintain properly a > multi-language package like ANTLR. The Java part is sufficiently complex = on > its own, we'd rather not have to care about the other languages. > - Different language ecosystems often require distinct and slightly > incompatible versions of ANTLR. > - Handling several languages in the same package makes upgrades and > regression testing much more difficult. > - ANTLR is a core package of the Java ecosystems, including more languages > increases the dependency tree of the Java packages and makes the > bootstrapping harder. >=20 > So it's preferable to have a clear separation of responsability with > different source packages, each language team having the freedom to maint= ain > its version as needed without impacting the others. I don't disagree with Emmanuel's statements about the importance of ANTLR and why it is helpful to maintain separation. However, I don't think introducing a separate source package each language ecosystem is necessarily best for Debian. It causes additional work for the Security team when in the event there vulnerabilities. It potentially confuses users (and Debian developers) by creating a distinction that does not exist upstream. It also means that we will release with different versions of ANTLR for different languages, which feels very "non-distro" to me. (What happens if the version of the ANTLR parser for language X is subtly incompatible with language Y, and a user runs a system on Debian that requires both bindings?) tony --ml5l2v5pu2dqq5wl Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE5Qr9Va3SequXFjqLIdIFiZdLPpYFAmEBctMACgkQIdIFiZdL PpZmBhAAiI4f4KxmZ722TUsy0tPRHJ0ZkP32Re21lkQ+HmUv6m6gL7Y3tCOY1rYJ sC0C2r25AsHrM9yzzDOH+VgTNjR2wXHrSGgqpeCsvdDOI/XXCjVh4sZFiVOlOQXG uWj5wi/xP7JdKN/yhumOHtqO4ebs919w7IOGUe4tPGXadPPGIdnUZth6SvUxagD0 I/RlgKHVBB0JQchwPyGKDow0cb43lSS+UQ6ialSRh8AjSV4jUu+VeM1b4GVEmmhS tO+ONx1Lm4uqiHPqKZHF8y9WhBbOULgGm2tq12rjuJh4wiKzYid71zDvC2BuDV19 IR7rlS7xDzmbKoAmHeWCwI/d5b8+K/hNcgFc1T3VueSJQEGN4zN8FNSbHJHuPIyc G7bR/msiaVcsJDdDiV1kjY28TNy9BxHCDSzkGmdo2ZKChGNeq9wISz29wBVz2NJ5 PYb+/iIa2dwnRQsdyAAdXF94qcLrU2hZKzwvDboW1oQsxaXDIfq2uXSZaFzaV5Pb AlA5ez0IOrOBk7KGBiSpHZtAcNpcNlGIg3uTCwsXvvaYeLJTAY00atBnvdcz75t8 yM0Gzdk8T+QdAV3X9xEz3Uy0x4F9jlq4V8NuVZLU1mrH28laK4R8Qru1k4zB3pD1 ouCoQmL1466E9+5WY/neLhLdCTDAsNAOoFzDdyjX+pc93FdgGX8= =aOyn -----END PGP SIGNATURE----- --ml5l2v5pu2dqq5wl--