Path: csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod From: Martijn Verburg Newsgroups: linux.debian.maint.java Subject: Re: DebConf25 Java/JVM BoF report Date: Mon, 04 Aug 2025 01:00:02 +0200 Message-ID: References: X-Original-To: =?UTF-8?Q?Julien_Plissonneau_Duqu=C3=A8ne?= X-Mailbox-Line: From debian-java-request@lists.debian.org Sun Aug 3 22:59:17 2025 Old-Return-Path: X-Amavis-Spam-Status: No, score=-5.099 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=2, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no autolearn_force=no X-Policyd-Weight: using cached result; rate: -5.5 X-Gm-Message-State: AOJu0YyldiZt5+Z7QcS0jN/SSmye0hzOhHxNnfZqzpdvOxrCws2ZH5MB OB6sn8NTLQV97eivGKSb9XwHwId3QMq53rUYxn75hCL3j2bfjUApilFoH1yRnXwgv/UuaBiYO1p 1QKr8AVIashLs6V2r6EYKyQJXI6EBY/xgwu3VMz9NrA== X-Gm-Gg: ASbGncvZ8NUDYAM4v6ww5aLVKUgjhyAvkx2rE1QZi2jOwdBQzAIM9POSXJGkxG3fK1V fcuFlaCKwctKkGxRvSo2wrlSsvskTbnJLMyqMOcl540l5MEaZyt6rdtJ7tr3Xh7k64r8aE2nt8x 8aq46r+xztAdW77XwL7j6Plw13mAfKhq964MyF6HpBCG3I7lVjYVkwsLmBNCx0jxVGTQ/F0/yxN P1z7kwa X-Google-SMTP-Source: AGHT+IEr0Mj1PMLQBQ60foxrBEdyKZsW/ZzIB+9rfb9garpYB2rQI95VV3DEuFO++O8KJMmZOdG8Lw2JtsyixnNbLos= X-Received: by 2002:a17:907:6d14:b0:af9:1be8:c2aa with SMTP id a640c23a62f3a-af94018ff02mr812255266b.45.1754261930748; Sun, 03 Aug 2025 15:58:50 -0700 (PDT) MIME-Version: 1.0 X-Gm-Features: Ac12FXybJONmtRq-JJaPQ1_-q-2F7I2pGoOqEQOVZESu7VMv1ttixm4bzYOwpcU Content-Type: multipart/alternative; boundary="00000000000039b067063b7def9c" X-Mailing-List: archive/latest/23775 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CAP7YuARH5kZdL7ABeDVrSUJ4f7EKoV9-VANR6KQMH-qJCF_dyA@mail.gmail.com Approved: robomod@news.nic.it Lines: 423 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: Debian Java X-Original-Date: Sun, 3 Aug 2025 15:58:38 -0700 X-Original-Message-ID: X-Original-References: <17ae144949aa0dd2b77dfa79c63b1fff@free.fr> Xref: csiph.com linux.debian.maint.java:13043 --00000000000039b067063b7def9c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Julien/All, I'm a member of the Eclipse Adoptium Working group (we produce the Temurin binaries) as well as working for $MSFT (where my Java team produces the MSFT Build of OpenJDK). I know that folks will be happy to compare build/test notes with y'all. It's in everyone's best interests to have rock solid OpenJDK binaries no matter the vendor :-). Our build scripts + CI/CD pipeline configs & Linux installer scripts can be a little convoluted. If you need to chat with the Adoptium folks, they hang out on a Slack instance (sorry!). Assuming that's a no go then you can probably just communicate through GH Issues or some other mechanism? Also happy to chat about Aqa-test, TCK testing and the like (we've introduced some automation there) as well if that's helpful. Cheers, Martijn On Fri, 1 Aug 2025 at 13:09, Julien Plissonneau Duqu=C3=A8ne wrote: > Hi, > > Thank you to all those who participated to the Java/JVM BoF two weeks > ago at DebConf25. > > As with many things at this DebConf it was a bit chaotic to start but a > fallback was quickly worked out and we could proceed with all 10 > participants, 8 on site and 2 remote on Jitsi. > > After a round of introduction we discussed the following items: > > * build tools =E2=80=94 I did a quick recap of where we currently were wi= th the > upgrades of Gradle and Kotlin, and Vladimir added a few words about his > own contribution to this work. Work on some other popular build tools > such as sbt and Bazel is also on the radar. > > > * IDEs =E2=80=94 Vladimir reported that JetBrains is planning some change= s in > the distribution of IDEA [1] that may make it easier to package. As the > same open source base is used for Android Studio and the source package > already exists in Debian, we are certainly going to look at what else > would be needed to build a working IDE at some point in the future. > > [1]: > > https://blog.jetbrains.com/idea/2025/07/intellij-idea-unified-distributio= n-plan/ > > Then we considered the Eclipse IDE, and whether attempting to package it > is a worthy and realistic goal. Emmanuel said that this project is too > large to be properly packaged and maintained with our current resources > and I agree with him: proper integration is complex, and it's > tentacular, so it's likely to amount to a full-time job. > > Mechtilde suggested that Debian could provide an installer script in > contrib to help users install Eclipse quickly. Alex proposed that > instead of providing the Eclipse IDE in Debian, detailed wiki pages > could be written to help users to properly install the IDE on a Debian > system. [Note: a page already exists [2] but it's probably incomplete > and outdated.] > > [2]: https://wiki.debian.org/Eclipse > > > * JDKs =E2=80=94 Trixie will ship the JDK 21 (LTS), and unstable already > features an Early Access preview of the next LTS (25) to be released in > September. Vladimir performed a mass rebuild of Java packages [3] with > it and ended up with only 39 build failures, much less than in the > previous migration to 21 (146). > > [3]: https://lists.debian.org/debian-java/2025/07/msg00000.html > > During DebCamp I was told that some people believe that the JDKs > provided by Debian are not fit for use in production as they are only > "reference implementations", and they would like Debian to ship the > Eclipse (previously Adoptium) Temurin builds instead. This would have > some benefits (as Temurin is known and used by popular build tools and > IDEs) but it's probably not possible because the Debian policy is likely > to conflict with the Temurin trademark policy. Instead I suggested that > we study and document the differences between both builds (that are > probably pretty similar) and eventually work on minimizing the > divergences. > > I shared again my intention to reintroduce legacy LTS JDKs to the stable > distribution for the purpose of building and testing packages, with no > formal security support and appropriate disclaimers. Matthias would be > fine with that. I still have to validate this plan with Moritz. > > > * transitions =E2=80=94 from a trusted source (online references missing)= I > learned that it will soon be possible to do proper transitions [4] with > Architecture: all packages (such as Java libraries). An update to the > transition tracker is on the way, and scheduling binNMUs will be > possible. > > As a reminder: > > > The Release Team considers everything a transition where the upload of > > a package requires changes (rebuilds or actual patches) to reverse > > dependencies. > > [4]: https://wiki.debian.org/Teams/ReleaseTeam/Transitions > > > * autopkgtests =E2=80=94 they are on the radar too. Currently too much br= eakage > caused by updates is detected (too) late; autopkgtests would help to > detect issues sooner and take appropriate decisions. In some cases there > are only a few dependencies that are missing to be able to run the > upstream test suites. > > > * reproducible builds =E2=80=94 the current trend is to have build tools = (such > as Gradle, but also Maven) validate cryptographic signatures of > dependencies at build time. A way to build signed artifacts would be to > have them signed by the maintainer and the signature(s) committed to the > package source before upload: this would in practice enforce a strictly > reproducible build between the developer system and the CI (though a way > to fail the package build if the signature doesn't match has yet to be > implemented). > > Does Gradle fulfill the requirements for reproducible builds? Yes: > features were included into this build tool to make it possible to build > reproducibly with it. > > > * helping and Debian Java Documentation =E2=80=94 documentation is outdat= ed and > users/developers/maintainers don't know where to look for. The Java > Policy is due for some updates as well. > > The Debian Go Packaging Team pages [5] are IMO an interesting example of > how a "team portal" could be structured. > > [5]: https://go-team.pages.debian.net/ > > To make the #debian-java IRC channel more welcoming for newcomers and > discussions, it was proposed to move the gitlab notifications out of it > to a separate channel and reduce their verbosity [and this was since > done by lavamind =E2=80=94 thank you!]. > > There is also the team blog [6] that hasn't been updated since 2019. I'm > planning to post updates on major milestones of build tool upgrades, and > it would be nice if someone else could prepare a post about "what's new > in Trixie" summarizing the changes in and around Java packages that are > about to be released. > > [6]: https://java.debian.net/blog/ > > > * next meeting =E2=80=94 a quarterly video call on Jitsi? This was sugges= ted and > most participants seemed interested. For the first meeting I've started > a poll [7] to figure out which days would be preferred in the range > September 10 to 23, then by late August I will run another poll to > choose a day and time within the most popular days. > > [7]: https://beta.framadate.org/polls/92ae6badb5f59bf80f21 > > > * group picture =E2=80=94 unfortunately I wasn't able to convince my phon= e front > camera to focus on the group behind me so we get ... an unvoluntarily > privacy-preserving picture? [8] (I really should have taken more > pictures with me completely out of the field then stitch them, but I > didn't think about that at the time.) Sorry about that, but anyway here > it is. > > [8]: > > https://assets.chaos.social/media_attachments/files/114/955/272/469/556/4= 89/original/f8248965003bb8e4.jpg > > > Cheers, > > -- > Julien Plissonneau Duqu=C3=A8ne > > --00000000000039b067063b7def9c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Julien/All,

I'm a mem= ber of the Eclipse=C2=A0Adoptium Working group (we produce the Temurin bina= ries) as well as working for $MSFT (where my Java team produces the MSFT Bu= ild of OpenJDK).=C2=A0 I know that folks will be happy to compare build/tes= t notes with y'all. It's in everyone's best interests to have r= ock solid OpenJDK binaries=C2=A0no matter the vendor :-).

Our build scripts + CI/CD pipeline configs & Linux installer sc= ripts can be a little convoluted. If you need to chat with the Adoptium fol= ks, they hang out on a Slack instance (sorry!). Assuming that's a no go= then you can probably just communicate through GH Issues or some other mec= hanism?

Also happy to chat about Aqa-test, TCK tes= ting and the like (we've introduced some automation there) as well if t= hat's helpful.

Cheers,
Martijn

<= /div>
On Fri, 1 Aug 2025 at 13:09, Julien Plissonneau Duqu= =C3=A8ne <sre4ever@free.fr> w= rote:
Hi,

Thank you to all those who participated to the Java/JVM BoF two weeks
ago at DebConf25.

As with many things at this DebConf it was a bit chaotic to start but a fallback was quickly worked out and we could proceed with all 10
participants, 8 on site and 2 remote on Jitsi.

After a round of introduction we discussed the following items:

* build tools =E2=80=94 I did a quick recap of where we currently were with= the
upgrades of Gradle and Kotlin, and Vladimir added a few words about his own contribution to this work. Work on some other popular build tools
such as sbt and Bazel is also on the radar.


* IDEs =E2=80=94 Vladimir reported that JetBrains is planning some changes = in
the distribution of IDEA [1] that may make it easier to package. As the same open source base is used for Android Studio and the source package already exists in Debian, we are certainly going to look at what else
would be needed to build a working IDE at some point in the future.

[1]:
https://blog.jetbrai= ns.com/idea/2025/07/intellij-idea-unified-distribution-plan/

Then we considered the Eclipse IDE, and whether attempting to package it is a worthy and realistic goal. Emmanuel said that this project is too
large to be properly packaged and maintained with our current resources and I agree with him: proper integration is complex, and it's
tentacular, so it's likely to amount to a full-time job.

Mechtilde suggested that Debian could provide an installer script in
contrib to help users install Eclipse quickly. Alex proposed that
instead of providing the Eclipse IDE in Debian, detailed wiki pages
could be written to help users to properly install the IDE on a Debian
system. [Note: a page already exists [2] but it's probably incomplete <= br> and outdated.]

[2]: https://wiki.debian.org/Eclipse


* JDKs =E2=80=94 Trixie will ship the JDK 21 (LTS), and unstable already features an Early Access preview of the next LTS (25) to be released in September. Vladimir performed a mass rebuild of Java packages [3] with
it and ended up with only 39 build failures, much less than in the
previous migration to 21 (146).

[3]: https://lists.debian.org/debian-java/= 2025/07/msg00000.html

During DebCamp I was told that some people believe that the JDKs
provided by Debian are not fit for use in production as they are only
"reference implementations", and they would like Debian to ship t= he
Eclipse (previously Adoptium) Temurin builds instead. This would have
some benefits (as Temurin is known and used by popular build tools and
IDEs) but it's probably not possible because the Debian policy is likel= y
to conflict with the Temurin trademark policy. Instead I suggested that we study and document the differences between both builds (that are
probably pretty similar) and eventually work on minimizing the
divergences.

I shared again my intention to reintroduce legacy LTS JDKs to the stable distribution for the purpose of building and testing packages, with no
formal security support and appropriate disclaimers. Matthias would be
fine with that. I still have to validate this plan with Moritz.


* transitions =E2=80=94 from a trusted source (online references missing) I=
learned that it will soon be possible to do proper transitions [4] with Architecture: all packages (such as Java libraries). An update to the
transition tracker is on the way, and scheduling binNMUs will be
possible.

As a reminder:

> The Release Team considers everything a transition where the upload of=
> a package requires changes (rebuilds or actual patches) to reverse > dependencies.

[4]: https://wiki.debian.org/Teams/ReleaseTeam= /Transitions


* autopkgtests =E2=80=94 they are on the radar too. Currently too much brea= kage
caused by updates is detected (too) late; autopkgtests would help to
detect issues sooner and take appropriate decisions. In some cases there are only a few dependencies that are missing to be able to run the
upstream test suites.


* reproducible builds =E2=80=94 the current trend is to have build tools (s= uch
as Gradle, but also Maven) validate cryptographic signatures of
dependencies at build time. A way to build signed artifacts would be to have them signed by the maintainer and the signature(s) committed to the package source before upload: this would in practice enforce a strictly reproducible build between the developer system and the CI (though a way to fail the package build if the signature doesn't match has yet to be =
implemented).

Does Gradle fulfill the requirements for reproducible builds? Yes:
features were included into this build tool to make it possible to build reproducibly with it.


* helping and Debian Java Documentation =E2=80=94 documentation is outdated= and
users/developers/maintainers don't know where to look for. The Java Policy is due for some updates as well.

The Debian Go Packaging Team pages [5] are IMO an interesting example of how a "team portal" could be structured.

[5]: https://go-team.pages.debian.net/

To make the #debian-java IRC channel more welcoming for newcomers and
discussions, it was proposed to move the gitlab notifications out of it to a separate channel and reduce their verbosity [and this was since
done by lavamind =E2=80=94 thank you!].

There is also the team blog [6] that hasn't been updated since 2019. I&= #39;m
planning to post updates on major milestones of build tool upgrades, and it would be nice if someone else could prepare a post about "what'= s new
in Trixie" summarizing the changes in and around Java packages that ar= e
about to be released.

[6]: https://java.debian.net/blog/


* next meeting =E2=80=94 a quarterly video call on Jitsi? This was suggeste= d and
most participants seemed interested. For the first meeting I've started=
a poll [7] to figure out which days would be preferred in the range
September 10 to 23, then by late August I will run another poll to
choose a day and time within the most popular days.

[7]: https://beta.framadate.org/polls/92ae6bad= b5f59bf80f21


* group picture =E2=80=94 unfortunately I wasn't able to convince my ph= one front
camera to focus on the group behind me so we get ... an unvoluntarily
privacy-preserving picture? [8] (I really should have taken more
pictures with me completely out of the field then stitch them, but I
didn't think about that at the time.) Sorry about that, but anyway here=
it is.

[8]:
https://assets.chaos.social/media_attachments/files/114/955/272/469/55= 6/489/original/f8248965003bb8e4.jpg


Cheers,

--
Julien Plissonneau Duqu=C3=A8ne

--00000000000039b067063b7def9c--