Path: csiph.com!newsfeed.xs4all.nl!newsfeed9.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Nilesh Patra Newsgroups: linux.debian.maint.java Subject: Re: Re: packaging Go runtime for ANTLR4 Date: Wed, 28 Jul 2021 21:40:01 +0200 Message-ID: References: X-Mailbox-Line: From debian-java-request@lists.debian.org Wed Jul 28 19:36:35 2021 Old-Return-Path: X-Amavis-Spam-Status: No, score=-10.249 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, LDO_WHITELIST=-5, PGPSIGNATURE=-5, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RERE=1] autolearn=ham autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .mail-pj1-f49.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 X-Gm-Message-State: AOAM533MKLRe1lVEQExxdXZ1lqc3fCwxaZ1SaCuQir6nxJpq1OFhOW8M fzRjw0O7ZTbiGF7NRtJS2LT31DDTK1zmqMrd X-Google-SMTP-Source: ABdhPJw218Ug2XFKTrUKTG/9zf6AJlF2H2gfKzXlLe3CpWP3YnV7fD3Me8XoPAl8SwDB1xXKHoC1yg== X-Received: by 2002:a17:903:32cf:b029:12b:8b8b:3a5 with SMTP id i15-20020a17090332cfb029012b8b8b03a5mr1118522plr.48.1627500976729; Wed, 28 Jul 2021 12:36:16 -0700 (PDT) MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="+8WltQhndTbazsgH" Content-Disposition: inline X-Mailing-List: archive/latest/22892 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/YQGxq3TY64TDy3P1@debian Approved: robomod@news.nic.it Lines: 103 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Thu, 29 Jul 2021 01:06:11 +0530 X-Original-Message-ID: X-Original-References: <20210728150803.qfw5los2idiy24ld@lark> Xref: csiph.com linux.debian.maint.java:12263 --+8WltQhndTbazsgH Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Jul 28, 2021 at 08:41:46AM +0200, Emmanuel Bourg wrote: >> Hi Peymaneh, >> >> Le 2021-07-27 10:09, Peymaneh Nejad a =E9crit : >> >> > Is it intended or wished for that additional runtimes other than Java >> > are packaged in seperate source packages >> >> Yes it is, for several reasons: >> - The Java Team doesn't have the time and skills to maintain properly a >> multi-language package like ANTLR. The Java part is sufficiently complex= on >> its own, we'd rather not have to care about the other languages. >> - Different language ecosystems often require distinct and slightly >> incompatible versions of ANTLR. >> - Handling several languages in the same package makes upgrades and >> regression testing much more difficult. >> - ANTLR is a core package of the Java ecosystems, including more languag= es >> increases the dependency tree of the Java packages and makes the >> bootstrapping harder. >> >> So it's preferable to have a clear separation of responsability with >> different source packages, each language team having the freedom to main= tain >> its version as needed without impacting the others. > I don't disagree with Emmanuel's statements about the importance of > ANTLR and why it is helpful to maintain separation. However, I don't > think introducing a separate source package each language ecosystem is > necessarily best for Debian. > It causes additional work for the Security team when in the event there > vulnerabilities. It potentially confuses users (and Debian developers) > by creating a distinction that does not exist upstream. It also means > that we will release with different versions of ANTLR for different > languages, which feels very "non-distro" to me. (What happens if the > version of the ANTLR parser for language X is subtly incompatible with > language Y, and a user runs a system on Debian that requires both > bindings?) Chiming in here, since it was originally me who asked Peymaneh to contact this list, and I was sponsoring the same. I was initially of the same opinion that it should be unified into a single source package, but ebourg's points against doing that are pretty strong too. While I do not disagree w/ tony on this, but there already exist antlr4-cpp-runtime[1] and python3-antlr4[2] packaged separately, and indeed, they seem to have different versions than the Java antlr4 we have -- 4.9 and 4.9.1 respectively as opposed to 4.7.2 in the java antlr4 package IMO, this is making it "non-distro" already. There are also a bunch of other runtimes in other languages which might as well need packaging at some point in time Then, we have a few options: 1) Talk to the maintainers of cpp-runtime and python3-antlr to unify sources with the original antlr4 source package And this can be a very time consuming task there, since fundamentally the versions differ quite a bit, and fixing it will take time 2) Do "$something-else" for all these packages to stay in sync - again, probably bumping versions only when needed. With this approach, I do not see a problem in introducing a Go runtime source package there Thoughts? [1]: https://tracker.debian.org/pkg/antlr4-cpp-runtime [2]: https://tracker.debian.org/pkg/python3-antlr4 Nilesh --+8WltQhndTbazsgH Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEPpmlJvXcwMu/HO6mALrnSzQzafEFAmEBsacACgkQALrnSzQz afHUKxAAmwCQkLddO1eq9P8auhnh3w3NIq35xGBP8AoZaNoS6I5f/XwkSpDiH6XK ZyepSpq1RKWjW7uyTN7I1CC+1HgtROIaPZE15BIcY10n1ffoJpnyz75RrvHmIdJo rdVupwPGOmKEdc7/KudZndszYMkWVJyWZErz/ckVHRgqnTwpiEFel8jtmJJxiLEk q2pX4WwY676aInqy5zjOzfCAHu+4xGg0NR6SfPDnytlsBMEFlb+m9ohlK8osU9/X q71AJvtA2LSq481beppyxdkjO5ZdswjYbSCOFVofqx3EKD82TvgH8pRMYuqZkykX ckQe5Bm/3nTbTEzhAf6epge6yITYGiWQd5bUASlWkU551FmfJxAgwL5fFPDqOeeF RZv1mBePlebYrI0RRNGSNeyV48XnyAisQtGBtg+3PiCHmWR/nx7na/Ok+bKyvbNi 0VytaTsA4p1h9+IMpK4yhEZ+6CYLOPfw/wfkO+VYobvA8QAUossiKEghNatD5EJ+ to5za+i19h+QTmsDP/UOZKscrAXJZkdqllCZ8INKdJ5K9gDdk3pRycOZUqV6bFWb h49Ozqp6BJbLPghCxkEdsaBEqSaUYYQdHifj+4e8A7fR5P/bgaJaV1Ua6Ukv1QFC SZ3HAsINCSWvizzw6ZrU6tQcqv3gFT8aIaUy6VWOLhBplCwcvYQ= =F9ID -----END PGP SIGNATURE----- --+8WltQhndTbazsgH--