Main Inclusion Report (Eucalyptus dependencies set 1)

[Thierry Carrez]

Binary package hint: janino

libjibx-java, libasm2-java and janino are expected dependencies of Eucalyptus 1.6, which needs to land in main, following https://wiki.ubuntu.com/EucalyptusInMainSpec

This bug tracks main inclusion process for those libraries, together with their own dependencies :
- libqdox-java (build depends for libjibx-java)
- libow-util-ant-tasks-java (build depends for libasm2-java)
- libjmock-java (build depends for libqdox-java)

[Thierry Carrez (ttx)]

MIR report for asm2

== Availability ==
 * http://archive.ubuntu.com/ubuntu/pool/universe/a/asm2/, arch-all package
== Rationale ==
 * libasm2-java is a runtime dependency of Eucalyptus (through groovy)
== Security ==
 * No CVE entries, no Secunia history.
 * No binaries, only a set of Java libraries (jar files)
 * No network activity
 * Binary processing: can dynamically modify Java classes at load time.
 * Source code review: none
== Quality assurance ==
 * Package works out of the box without configuration, no debconf questions
 * No Debian bugs, Maintenance in Debian is vigorous
 * Upstream is vigorous, however most activity is focused on the new ASM3 API.
 * Upstream bug tracker: http://forge.ow2.org/tracker/?group_id=23, nothing relevant
 * Hardware: package doesn't deal with hardware
 * There is a test suite in upstream packaging, but it is not enabled in the Debian packaging
== UI standards ==
 * n/a
== Standards compliance ==
 * Package is compliant with FHS, and new Java packaging rules
 * Debian policy: compliant with 3.7.3, section should be "java" to be 3.8.2-compliant
 * Package is compliant with current Ubuntu Java packaging rules
 * Packaging system: classic CDBS/ant build, no patchsystem
== Dependencies ==
 * Build depends: debhelper, cdbs, ant, default-jdk, libow-util-ant-tasks-java
 * Runtime depends/recommends: default-jre-headless
 * All in main except libow-util-ant-tasks-java, see MIR in this same bug.
== Maintenance ==
 * Package is a Java library without known bugs or expected updates
 * Low maintenance cost is expected
 * The Debian and Ubuntu Java teams are responsible for monitoring the package.
== Background information ==
 * Purpose of package is clear from debian/control description
 * Upstream calls this software ASM 2.0
== Internationalization ==
 * n/a

[Thierry Carrez (ttx)]

MIR report for janino

== Availability ==
 * http://archive.ubuntu.com/ubuntu/pool/universe/j/janino/, arch-all package
== Rationale ==
 * janino is a runtime dependency of Eucalyptus
== Security ==
 * No CVE entries, no Secunia history.
 * No SUID binaries or daemons
 * No network activity
 * No binary processing, but generates java bytecode from source files
 * Source code review: none
== Quality assurance ==
 * Package works out of the box without configuration, no debconf questions
 * No Debian bugs, Maintenance in Debian is vigorous
 * Upstream is calm, last release in June 2008.
 * Upstream bug tracker: http://jira.codehaus.org/secure/BrowseProject.jspa?id=10861
 * Hardware: package doesn't deal with hardware
 * No test suite in upstream packaging
== UI standards ==
 * User-visible strings (mostly exception texts) are not internationalized
== Standards compliance ==
 * Package is compliant with FHS
 * Debian policy: compliant with 3.8.0, section should be "java" to be 3.8.2-compliant
 * Package is compliant with current Ubuntu Java packaging rules
 * Packaging system: classic CDBS/ant build, uses dpatch as a patchsystem
== Dependencies ==
 * Build depends: debhelper, cdbs, ant, dpatch, default-jdk, unzip
 * Runtime depends/recommends: default-jre-headless
 * All in main.
== Maintenance ==
 * Package is maintained up to date in Debian
 * Low maintenance cost is expected
 * The Debian and Ubuntu Java teams are responsible for monitoring the package.
== Background information ==
 * Purpose of package is clear from debian/control description
 * Upstream calls this software Janino
== Internationalization ==
 * n/a

[Thierry Carrez (ttx)]

MIR report for jmock

== Availability ==
 * http://archive.ubuntu.com/ubuntu/pool/universe/j/jmock/, arch-all package
== Rationale ==
 * jmock is a buildtime dependency of qdox, which is a dependency of jibx, which is a dependency of Eucalyptus
== Security ==
 * No CVE entries, no Secunia history.
 * No binaries, only a Java library (jar file) with associated javadoc package
 * No network activity
 * No binary processing
 * Source code review: none
== Quality assurance ==
 * Package works out of the box without configuration, no debconf questions
 * No significant Debian bugs, Maintenance in Debian is calm
 * Upstream is vigorous, however most activity is focused on the new Jmock2 API.
 * Upstream bug tracker: http://jira.codehaus.org/secure/BrowseProject.jspa?id=10336, nothing relevant
 * Hardware: package doesn't deal with hardware
 * There is a test suite in upstream packaging and it is enabled in the Debian packaging
== UI standards ==
 * n/a
== Standards compliance ==
 * Package is compliant with FHS
 * Debian policy: compliant
 * Package is compliant with current Ubuntu Java packaging rules
 * Packaging system: debhelper/ant build, uses dpatch as a patchsystem
== Dependencies ==
 * Build depends: default-jdk, ant, ant-optional, junit, debhelper, dpatch
 * Runtime depends/recommends: default-jre-headless
 * All in main
== Maintenance ==
 * Package is a Java library without known bugs
 * Low maintenance cost is expected
 * The Debian and Ubuntu Java teams are responsible for monitoring the package.
== Background information ==
 * Purpose of package is clear from debian/control description
 * Upstream calls this software jMock 1.x.x
== Internationalization ==
 * n/a

[Thierry Carrez (ttx)]

MIR report for libjibx-java

== Availability ==
 * http://archive.ubuntu.com/ubuntu/pool/universe/libj/libjibx-java/, arch-all package
== Rationale ==
 * libjibx-java is a runtime dependency of Eucalyptus
== Security ==
 * No CVE entries, no Secunia history.
 * No binaries, only a set of Java libraries (jar files) with associated javadoc package
 * No network activity
 * No binary processing, binds XML data to Java objects
 * Source code review: none
== Quality assurance ==
 * Package works out of the box without configuration, no debconf questions
 * No significant Debian bugs, Maintenance in Debian is calm
 * Upstream is vigorous
 * Upstream bug tracker: http://jira.codehaus.org/secure/BrowseProject.jspa?id=10410, nothing relevant
 * Hardware: package doesn't deal with hardware
 * There is a test suite in upstream packaging, but it is not enabled in the Debian packaging
== UI standards ==
 * n/a
== Standards compliance ==
 * Package is compliant with FHS
 * Debian policy: compliant
 * Package is compliant with current Ubuntu Java packaging rules
 * Packaging system: classic CDBS/ant build, uses simple-patchsys
== Dependencies ==
 * Build depends: default-jdk, ant, libbcel-java, libxpp3-java, libqdox-java, liblog4j1.2-java
 * Runtime depends/recommends: default-jre-headless, libbcel-java, libxpp3-java, libqdox-java, liblog4j1.2-java
 * All in main, except libqdox-java, see MIR in this same bug.
== Maintenance ==
 * Package is a Java library without known bugs
 * Low maintenance cost is expected
 * The Debian and Ubuntu Java teams are responsible for monitoring the package.
== Background information ==
 * Purpose of package is clear from debian/control description
 * Upstream calls this software JiBX
== Internationalization ==
 * n/a

[Thierry Carrez (ttx)]

MIR report for ow-util-ant-tasks

== Availability ==
 * http://archive.ubuntu.com/ubuntu/pool/universe/o/ow-util-ant-tasks/, arch-all package
== Rationale ==
 * Build-time dependency of asm2, which is a dependency of Eucalyptus
== Security ==
 * No CVE entries, no Secunia history.
 * No binaries, only a Java library (jar file) and associated javadoc
 * No network activity
 * No binary processing
 * Source code review: none
== Quality assurance ==
 * Package works out of the box without configuration, no debconf questions
 * No Debian bugs, Maintenance in Debian is calm
 * Upstream is calm
 * Upstream bug tracker: http://forge.ow2.org/tracker/?group_id=41, no relevant bugs
 * Hardware: package doesn't deal with hardware
 * No test suite in upstream packaging
== UI standards ==
 * n/a
== Standards compliance ==
 * Package is compliant with FHS
 * Debian policy: compliant
 * Package is (with latest version) compliant with current Ubuntu Java packaging rules
 * Packaging system: debhelper/ant build, uses dpatch as a patchsystem
== Dependencies not in main ==
 * Build depends: libasm2-java (circular build-dep), see MIR in this same bug
== Maintenance ==
 * Package is a Java library without known bugs or expected updates
 * Low maintenance cost is expected
 * The Debian and Ubuntu Java teams are responsible for monitoring the package.
== Background information ==
 * Purpose of package is clear from debian/control description
 * Upstream calls this software OwAntTask, and it is delivered as part of the Monolog stack
== Internationalization ==
 * n/a

[Thierry Carrez (ttx)]

MIR report for qdox

== Availability ==
 * http://archive.ubuntu.com/ubuntu/pool/universe/q/qdox/, arch-all package
== Rationale ==
 * Build-time dependency of libjibx-java, which is a dependency of Eucalyptus
== Security ==
 * No CVE entries, no Secunia history.
 * No binaries, only a Java library (jar file) and associated javadoc
 * No network activity
 * No binary processing
 * Source code review: none
== Quality assurance ==
 * Package works out of the box without configuration, no debconf questions
 * No Debian bugs, Maintenance in Debian is calm
 * Upstream is vigorous
 * Upstream bug tracker: http://jira.codehaus.org/browse/QDOX, no relevant bugs
 * Hardware: package doesn't deal with hardware
 * There is a test suite in upstream packaging and it is enabled in the Debian packaging
== UI standards ==
 * n/a
== Standards compliance ==
 * Package is compliant with FHS
 * Debian policy: compliant
 * Package still uses gcj-compat-dev to build, compiling with openjdk breaks testsuite
 * Packaging system: classic CDBS/ant build, uses simple-patchsys
== Dependencies not in main ==
 * Build depends: libjmock-java, see MIR in this same bug
== Maintenance ==
 * Package is a Java library without known bugs
 * Low maintenance cost is expected
 * The Debian and Ubuntu Java teams are responsible for monitoring the package.
== Background information ==
 * Purpose of package is clear from debian/control description
 * Upstream calls this software QDox
== Internationalization ==
 * n/a

[Martin Pitt (pitti)]

Approved, as pointed out on https://wiki.ubuntu.com/EucalyptusInMainSpec/Packages

[Martin Pitt (pitti)]

libjibx-java approved, see https://wiki.ubuntu.com/EucalyptusInMainSpec/Packages

[Michael Terry (mterry)]

Approved by asac, as per https://wiki.ubuntu.com/EucalyptusInMainSpec/Packages

[Michael Terry (mterry)]

Approved by doko, as per https://wiki.ubuntu.com/EucalyptusInMainSpec/Packages

[Martin Pitt (pitti)]

Assigned to Loic on https://wiki.ubuntu.com/EucalyptusInMainSpec/Packages, so assigning here, too.

[Loïc Minier (lool)]

On asm2:
* build.xml fix would better be stored as a patch
* debhelper compat 4 is old
* most files are Copyright (c) 2000-2005 INRIA, France Telecom, this really should be reflected in debian/copyright

All of this is ok and the first two don't warrant adding to the delta with Debian, so good to stay in main.

[Loïc Minier (lool)]

Hmm actually asm2 has a fairly large testsuite; it would certainly be nice to run it.

[Loïc Minier (lool)]

janino: looks good, can stay in main.

[Loïc Minier (lool)]

Filed bug #452910, bug #452900, and bug #452901 on asm2; can all be fixed in lucid.