Debian Bug report logs - #874494
rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Matthias Klose <doko@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Wed, 6 Sep 2017 14:51:51 +0200

Package: src:libsambox-java
Version: 1.0.34-1
Severity: serious
Tags: sid buster

rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>=
1.1.3.RELEASE)

$ dpkg -I ../libsambox-java_1.0.34-1_all.deb | grep Depends
 Depends: libcommons-io-java, libfontbox2-java (>= 2.0.7), libsejda-io-java (>=
1.1.3.RELEASE), libslf4j-java (>= 1.7.25)

Message #10 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Matthias Klose <doko@debian.org>

To: Emmanuel Bourg <ebourg@apache.org>, 874494@bugs.debian.org, Markus Koschany <apo@debian.org>

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Wed, 6 Sep 2017 18:56:11 +0200

On 06.09.2017 15:08, Emmanuel Bourg wrote:
> Le 6/09/2017 à 14:51, Matthias Klose a écrit :
> 
>> rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>=
>> 1.1.3.RELEASE)
>>
>> $ dpkg -I ../libsambox-java_1.0.34-1_all.deb | grep Depends
>>  Depends: libcommons-io-java, libfontbox2-java (>= 2.0.7), libsejda-io-java (>=
>> 1.1.3.RELEASE), libslf4j-java (>= 1.7.25)
> 
> This is an issue with libsejda-io-java, the --has-package-version flag
> was mistakenly used [1]. This led maven-debian-helper to think that it
> could use the version in the pom as a version constraint at the package
> level, which is wrong in this case due to the ".RELEASE" suffix (this
> behavior was broken before maven-debian-helper 2.2, see #862894).
> 
> The solution is to either:
> - add the ".RELEASE" suffix to the package version

I didn't try that.

> - remove the suffix from the version in the pom

doesn't work

> - remove the --has-package-version flag

doesn't work

Matthias

Message #15 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: Matthias Klose <doko@debian.org>, 874494@bugs.debian.org, Markus Koschany <apo@debian.org>

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Wed, 6 Sep 2017 19:19:58 +0200

Le 6/09/2017 à 18:56, Matthias Klose a écrit :

>> - remove the suffix from the version in the pom
> 
> doesn't work
> 
>> - remove the --has-package-version flag
> 
> doesn't work

You did that on libsejda-io-java right?

Message #20 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: Matthias Klose <doko@debian.org>, 874494@bugs.debian.org

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Wed, 6 Sep 2017 15:08:45 +0200

Le 6/09/2017 à 14:51, Matthias Klose a écrit :

> rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>=
> 1.1.3.RELEASE)
> 
> $ dpkg -I ../libsambox-java_1.0.34-1_all.deb | grep Depends
>  Depends: libcommons-io-java, libfontbox2-java (>= 2.0.7), libsejda-io-java (>=
> 1.1.3.RELEASE), libslf4j-java (>= 1.7.25)

This is an issue with libsejda-io-java, the --has-package-version flag
was mistakenly used [1]. This led maven-debian-helper to think that it
could use the version in the pom as a version constraint at the package
level, which is wrong in this case due to the ".RELEASE" suffix (this
behavior was broken before maven-debian-helper 2.2, see #862894).

The solution is to either:
- add the ".RELEASE" suffix to the package version
- remove the suffix from the version in the pom
- remove the --has-package-version flag

[1]
https://sources.debian.net/src/libsejda-io-java/1.1.3-1/debian/libsejda-io-java.poms/#L28

Message #25 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: Emmanuel Bourg <ebourg@apache.org>, 874494@bugs.debian.org

Cc: Matthias Klose <doko@debian.org>

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Wed, 6 Sep 2017 22:58:56 +0200

[Message part 1 (text/plain, inline)]

Am 06.09.2017 um 15:08 schrieb Emmanuel Bourg:
> Le 6/09/2017 à 14:51, Matthias Klose a écrit :
> 
>> rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>=
>> 1.1.3.RELEASE)
>>
>> $ dpkg -I ../libsambox-java_1.0.34-1_all.deb | grep Depends
>>  Depends: libcommons-io-java, libfontbox2-java (>= 2.0.7), libsejda-io-java (>=
>> 1.1.3.RELEASE), libslf4j-java (>= 1.7.25)
> 
> This is an issue with libsejda-io-java, the --has-package-version flag
> was mistakenly used [1]. This led maven-debian-helper to think that it
> could use the version in the pom as a version constraint at the package
> level, which is wrong in this case due to the ".RELEASE" suffix (this
> behavior was broken before maven-debian-helper 2.2, see #862894).

If I understand correctly the behavior changed in maven-debian-helper
2.2 and all Maven packages that build-depend on a package which
specifies --has-package-version will automatically use a version
constraint from now on? Please note that --has-package-version is used
by default when new packages are created with mh_make and I believe most
Maven packages that I have touched use this flag in some way.

> The solution is to either:
> - add the ".RELEASE" suffix to the package version
> - remove the suffix from the version in the pom
> - remove the --has-package-version flag

I can remove the --has-package-version again and work around the version
constraint but I believe the issue is more complex. In my opinion there
shouldn't be an automatic version constraint unless explicitly specified
by the maintainer. I fear a lot more packages are affected and version
constraints will be too strict and cause more of these issues. Do we
really need to remove --has-package-version if we don't want a versioned
constraint or can't we just treat --has-package-version and automatic
version constraints differently in m-d-h to get back a more fine-grained
control?

[signature.asc (application/pgp-signature, attachment)]

Message #30 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: Markus Koschany <apo@debian.org>, 874494@bugs.debian.org

Cc: Matthias Klose <doko@debian.org>

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Wed, 6 Sep 2017 23:57:16 +0200

Le 6/09/2017 à 22:58, Markus Koschany a écrit :

> If I understand correctly the behavior changed in maven-debian-helper
> 2.2 and all Maven packages that build-depend on a package which
> specifies --has-package-version will automatically use a version
> constraint from now on?

That's correct. When --has-package-version is specified, the
debian.hasPackageVersion property is added to the pom installed in the
package. mh_installpom did that in maven-repo-helper, but not
maven-debian-helper before the version 2.2.


> Please note that --has-package-version is used
> by default when new packages are created with mh_make and I believe most
> Maven packages that I have touched use this flag in some way.

I checked mh_make, it handles this properly. The --has-package-version
flag is only added if the version of the package matches the version of
the pom.


> I can remove the --has-package-version again and work around the version
> constraint but I believe the issue is more complex. In my opinion there
> shouldn't be an automatic version constraint unless explicitly specified
> by the maintainer.

> I fear a lot more packages are affected and version
> constraints will be too strict and cause more of these issues. Do we
> really need to remove --has-package-version if we don't want a versioned
> constraint or can't we just treat --has-package-version and automatic
> version constraints differently in m-d-h to get back a more fine-grained
> control?

Intuitively I think the version constraints on the binary packages
should be picked from the version constraints of the source package (so
controlled by the maintainer). On the other hand, it's rather common to
forget versioning the build dependencies, and this --has-package-version
mechanism is often handy to prevent accidental migrations to testing of
packages that actually need another dependency still blocked for some
reason. This greatly improves the consistency of the migrations.

We probably need a lintian rule that checks if the version of the pom
matches the version of the package when --has-package-version is
specified (actually the pom version must be less than the package
version, this allows some divergences such as a package with the version
1.2.3+ds1 and the pom with the version 1.2.3). This will allow us to
easily identify and fix the packages affected.

Emmanuel Bourg

Message #35 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Matthias Klose <doko@debian.org>

To: Emmanuel Bourg <ebourg@apache.org>, 874494@bugs.debian.org, Markus Koschany <apo@debian.org>

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Thu, 7 Sep 2017 05:58:18 +0200

On 06.09.2017 19:19, Emmanuel Bourg wrote:
> Le 6/09/2017 à 18:56, Matthias Klose a écrit :
> 
>>> - remove the suffix from the version in the pom
>>
>> doesn't work
>>
>>> - remove the --has-package-version flag
>>
>> doesn't work
> 
> You did that on libsejda-io-java right?

yes, and then trying to build the libsambox-java package.

Message #40 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Gianfranco Costamagna <locutusofborg@debian.org>

To: 874494@bugs.debian.org

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Sat, 9 Sep 2017 18:34:19 +0200

[Message part 1 (text/plain, inline)]

control: tags -1 patch

> >>> - remove the suffix from the version in the pom
> >>
> >> doesn't work

it worked to me, and the bootstrap in Ubuntu is now complete.

This is the patch:
--- libsejda-io-java-1.1.3/debian/patches/fix-broken-version.patch	1970-01-01 00:00:00.000000000 +0000
+++ libsejda-io-java-1.1.3/debian/patches/fix-broken-version.patch	2017-09-09 13:33:44.000000000 +0000
@@ -0,0 +1,15 @@
+Description: This breaks reverse-dependencies, fix version up
+Author: Gianfranco Costamagna <locutusofborg@debian.org>
+Last-Update: 2017-09-09
+
+--- libsejda-io-java-1.1.3.orig/pom.xml
++++ libsejda-io-java-1.1.3/pom.xml
+@@ -5,7 +5,7 @@
+ 	<artifactId>sejda-io</artifactId>
+ 	<packaging>jar</packaging>
+ 	<name>sejda-io</name>
+-	<version>1.1.3.RELEASE</version>
++	<version>1.1.3</version>
+ 
+ 	<description>An Input/Output layer built on top of Java standard io and nio packages</description>
+ 	<url>http://www.sejda.org</url>

G.

[signature.asc (application/pgp-signature, attachment)]

Message #47 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: 874494@bugs.debian.org

Cc: Gianfranco Costamagna <locutusofborg@debian.org>

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Sat, 9 Sep 2017 19:53:15 +0200

[Message part 1 (text/plain, inline)]

Control: tags -1 -patch

Hi,

thanks for the patch. However we can just remove the
--has-package-version option in libsambox-java.poms which will have the
same effect. This issue was caused by a recent change in
maven-debian-helper and affects multiple packages.

Regards,

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #54 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: 874494@bugs.debian.org

Cc: Gianfranco Costamagna <locutusofborg@debian.org>

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Sun, 10 Sep 2017 00:22:58 +0200

Control: reassign -1 libsejda-io-java
Control: affects -1 libsambox-java
Control: tags -1 + patch

Le 9/09/2017 à 19:53, Markus Koschany a écrit :

> thanks for the patch. However we can just remove the
> --has-package-version option in libsambox-java.poms which will have the
> same effect. This issue was caused by a recent change in
> maven-debian-helper and affects multiple packages.

The --has-package-version flag in libsambox-java is fine. It's the one
in libsejda-io-java that isn't consistent with the pom version, sorry if
this wasn't clear. The patch proposed is a good solution.

Message #67 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: Emmanuel Bourg <ebourg@apache.org>

Cc: 874494@bugs.debian.org, Gianfranco Costamagna <locutusofborg@debian.org>

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Sun, 10 Sep 2017 18:05:41 +0200

[Message part 1 (text/plain, inline)]

Am 10.09.2017 um 00:22 schrieb Emmanuel Bourg:
> Control: reassign -1 libsejda-io-java
> Control: affects -1 libsambox-java
> Control: tags -1 + patch
> 
> Le 9/09/2017 à 19:53, Markus Koschany a écrit :
> 
>> thanks for the patch. However we can just remove the
>> --has-package-version option in libsambox-java.poms which will have the
>> same effect. This issue was caused by a recent change in
>> maven-debian-helper and affects multiple packages.
> 
> The --has-package-version flag in libsambox-java is fine. It's the one
> in libsejda-io-java that isn't consistent with the pom version, sorry if
> this wasn't clear. The patch proposed is a good solution.

Hi,

I understand that this will resolve the issue but in my opinion patching
the pom file is the wrong solution. In fact we should avoid as much as
possible to do this kind of work manually.

I have created a bunch of packages which have a .RELEASE or .FINAL
version. Of course we can go without that in Debian. This probably
affects all jboss-* packages. Many of them use --has-package-version. If
we don't remove the --has-package-version flag from all of those
packages we will face a similar situation in the future.

If the change in maven-debian-helper is permanent than I am in favor of
removing this flag in packages because I don't want to maintain several
patches which just correct a version number. Tools like m-d-h should
take care of this for me.

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #72 received at 874494@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bourg <ebourg@apache.org>

To: Markus Koschany <apo@debian.org>

Cc: 874494@bugs.debian.org, Gianfranco Costamagna <locutusofborg@debian.org>

Subject: Re: Bug#874494: rebuilding libsambox-java generates unmet dependency on libsejda-io-java (>= 1.1.3.RELEASE)

Date: Wed, 13 Sep 2017 17:13:33 +0200

Le 10/09/2017 à 18:05, Markus Koschany a écrit :

> If the change in maven-debian-helper is permanent than I am in favor of
> removing this flag in packages because I don't want to maintain several
> patches which just correct a version number. Tools like m-d-h should
> take care of this for me.

I share your feelings wrt to pom patching. Removing the
--has-package-version flag is fine until maven-debian-helper learns to
better handle these suffixes.

Emmanuel Bourg

Message #75 received at 874494@bugs.debian.org (full text, mbox, reply):

From: pkg-java-maintainers@lists.alioth.debian.org

To: 874494@bugs.debian.org, 874494-submitter@bugs.debian.org

Subject: Pending fixes for bugs in the libsejda-io-java package

Date: Thu, 14 Sep 2017 20:38:33 +0000

tag 874494 + pending
thanks

Some bugs in the libsejda-io-java package are closed in revision
ef38b1849ce005a454d7ee3fecce6c3471c88c10 in branch 'master' by Markus
Koschany

The full diff can be seen at
https://anonscm.debian.org/cgit/pkg-java/libsejda-io-java.git/commit/?id=ef38b18

Commit message:

    libsejda-io-java.poms: Remove --has-package-version flag.
    
    Closes: #874494

Message #85 received at 874494-close@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: 874494-close@bugs.debian.org

Subject: Bug#874494: fixed in libsejda-io-java 1.1.3-2

Date: Thu, 14 Sep 2017 21:06:09 +0000

Source: libsejda-io-java
Source-Version: 1.1.3-2

We believe that the bug you reported is fixed in the latest version of
libsejda-io-java, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 874494@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Markus Koschany <apo@debian.org> (supplier of updated libsejda-io-java package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 14 Sep 2017 22:34:24 +0200
Source: libsejda-io-java
Binary: libsejda-io-java
Architecture: source
Version: 1.1.3-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Markus Koschany <apo@debian.org>
Description:
 libsejda-io-java - layer of Input/Output classes built on top of Java IO and NIO
Closes: 874494
Changes:
 libsejda-io-java (1.1.3-2) unstable; urgency=medium
 .
   * libsejda-io-java.poms: Remove --has-package-version flag. (Closes: #874494)
Checksums-Sha1:
 c424865cf241480c451cd8850e9103a7610bbbe5 2229 libsejda-io-java_1.1.3-2.dsc
 f10aecdabb0add9a6bd5926cc4f37a915d1c5668 2368 libsejda-io-java_1.1.3-2.debian.tar.xz
 34cf8b50607e63a96625371fcff72afc8c61b1fc 14843 libsejda-io-java_1.1.3-2_amd64.buildinfo
Checksums-Sha256:
 7f29c62219f1631e118f6eaf3f0eda7602e7b6ee7e36028930c324d68ab2d4e8 2229 libsejda-io-java_1.1.3-2.dsc
 f1ec9e90f26a6e8efa279b83ae25d73d98d9f02afd573b81f1f99cf2c63a1280 2368 libsejda-io-java_1.1.3-2.debian.tar.xz
 25bb5e504c0b0ace7acfaa4a8fc8fc2160303d13c64b2b76daeb133bf2d2bec6 14843 libsejda-io-java_1.1.3-2_amd64.buildinfo
Files:
 66c8a953c87d3b33f6eb880a9a3ff6e6 2229 java optional libsejda-io-java_1.1.3-2.dsc
 ac9e3e29e6c9913ee613f512d91a12d4 2368 java optional libsejda-io-java_1.1.3-2.debian.tar.xz
 4c5b76523bbeece524903dddf0e0e926 14843 java optional libsejda-io-java_1.1.3-2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlm66JVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HkufoP/3xGWsMO2K8IbpX6YNyFDUiPLpIvINHbNgvR
3XwSbDaGc6D4o4Fi0EFv6HsMwpz7O2XCGM4GYBKpALkuOdY2xp+nzy3bHS/b4O4m
OpjTIS6/rj5SVPxJYmIlPyL785eZCqEv0W0BX4XrTt48KPcqfv6ZW1LDpF0f23Hb
DuGVLWpbheggjFEtaqEsSl1G0QOiX5AIcyUn3xG7mtEONOtOc15hBaNllXxyjxqj
dMK1YcIsowoBtz2hZdPnfzhxqo292Tg4KYxZqH5n+owNf2eLt+XxmMexw8tt6rNL
zU9Ov8LUpkhHnDRQEW1+ub247rMWC4bxAQIl4SvQi2cHdBjBYaJ9I6MAJd8lLuCD
1peu/Yl1rUYLaN+ngaas1ypHKlpH/R/3ZhUM4r9OIWFoU8ZRPNU5+Q3dDSyQeorm
UBocc2TaK7BxZPZKzfT5ZYfisj/bOi6pAZYpRISuESSlQSGCN11V/LoLeaVkbSy2
COYC2HqolYS3OBb8qH4rGKLGFCSWLr30ohfJxnoP/ro3CA53Y7oKgjmGbl/az95c
ihHb6XKxDYPH2jN5IDNJZg/sxIdj3H79WzYGa2RfYfO3i1JtL97vb8KIBtU/meWO
mCXNAaKkevEtu5Ful7tmdeBUJnfka+gIQt+p13YxyobWkgiMZ6mgsuXWEdBPNHB3
V3MD53p2
=MYY8
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.