Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.java > #12271

Re: packaging Go runtime for ANTLR4

Show all headers | View raw

Le 2021-07-28 17:08, tony mancill a écrit :

> I don't disagree with Emmanuel's statements about the importance of
> ANTLR and why it is helpful to maintain separation.  However, I don't
> think introducing a separate source package each language ecosystem is
> necessarily best for Debian.

It's not optimal for the number of source packages in the distribution,
but it's optimal wrt the human resources available to maintain the 
packages,
and that's much more important than a few saved megabytes on the APT
repository mirrors. With separate source packages, I'm confident that
an issue with the Go/Python/C++ compiler and build tools won't hinder
the work on the Java library. Bootstrapping ANTLR4 wasn't a trivial task
(there was circular self dependencies) and I don't think I would have
been able to do it if I had to care about the other languages.


> It causes additional work for the Security team when in the event there 
> vulnerabilities.

AFAIK there was no CVE reported for ANTLR so far, so separate packages
do not induce an increased security maintenance in this case.


> It potentially confuses users (and Debian developers) by creating a 
> distinction that does not exist upstream.

I'm thinking about documenting in debian/README.source why the languages
are isolated in separate packages, this isn't the first time this 
question
arises.


> It also means that we will release with different versions of ANTLR
> for different languages, which feels very "non-distro" to me.  (What 
> happens
> if the version of the ANTLR parser for language X is subtly 
> incompatible with
> language Y, and a user runs a system on Debian that requires both
> bindings?)

We already have several versions of ANTLR for Java packaged (2.7.7, 3.2, 
3.5.2
and 4.7.2). If a new version of ANTLR creates regressions, we just clone
the package to preserve the old version. That's the only sane solution,
because you really don't want to test, debug and fix grammars with an
incompatible version of ANTLR, that's the reponsability of the upstream
developers.

Emmanuel Bourg

Back to linux.debian.maint.java | Previous | Next — Previous in thread | Find similar

Thread

packaging Go runtime for ANTLR4 Peymaneh Nejad <p.nejad@posteo.de> - 2021-07-27 10:10 +0200
  Re: packaging Go runtime for ANTLR4 Olek Wojnar <olek@debian.org> - 2021-07-27 17:10 +0200
    Re: packaging Go runtime for ANTLR4 tony mancill <tmancill@debian.org> - 2021-07-27 18:10 +0200
  Re: packaging Go runtime for ANTLR4 Emmanuel Bourg <ebourg@apache.org> - 2021-07-28 10:10 +0200
    Re: packaging Go runtime for ANTLR4 Peymaneh Nejad <p.nejad@posteo.de> - 2021-07-28 11:20 +0200
    Re: packaging Go runtime for ANTLR4 tony mancill <tmancill@debian.org> - 2021-07-28 17:10 +0200
      Re: Re: packaging Go runtime for ANTLR4 Nilesh Patra <nilesh@debian.org> - 2021-07-28 21:40 +0200
        Re: packaging Go runtime for ANTLR4 tony mancill <tmancill@debian.org> - 2021-07-28 21:50 +0200
        Re: packaging Go runtime for ANTLR4 Andrius Merkys <merkys@debian.org> - 2021-07-29 09:10 +0200
          Re: packaging Go runtime for ANTLR4 Olek Wojnar <olek@debian.org> - 2021-07-29 16:20 +0200
          Re: packaging Go runtime for ANTLR4 Nilesh Patra <nilesh@debian.org> - 2021-07-29 21:50 +0200
          antlr 4.10 released [Was: Re: packaging Go runtime for ANTLR4] Andrius Merkys <merkys@debian.org> - 2022-04-13 10:40 +0200
        Re: packaging Go runtime for ANTLR4 Emmanuel Bourg <ebourg@apache.org> - 2021-07-30 02:40 +0200
      Re: packaging Go runtime for ANTLR4 Emmanuel Bourg <ebourg@apache.org> - 2021-07-30 05:50 +0200

csiph-web