Bug 1901583

Summary: Review Request: javapackages-bootstrap - A means of bootstrapping Java Packages Tools
Product: [Fedora] Fedora Reporter: Marián Konček <mkoncek>
Component: Package ReviewAssignee: Mikolaj Izdebski <mizdebsk>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: mizdebsk, package-review
Target Milestone: ---Flags: mizdebsk: fedora-review+
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: javapackages-bootstrap-1.0.0-1.fc34 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-30 16:33:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
rpmlint output none

Description Marián Konček 2020-11-25 15:23:20 UTC 
Spec URL: https://mkoncek.fedorapeople.org/javapackages-bootstrap.spec
SRPM URL: https://mkoncek.fedorapeople.org/javapackages-bootstrap-1.0.0-1.fc34.src.rpm

Description:
In a nutshell, Java Packages Bootstrap (JPB) is a standalone build of all Java
software packages that are required for Java Packages Tools (JPT) to work.

In order to achieve reliable and reproducible builds of Java packages while
meeting Fedora policy that requires everything to be built from source, without
using prebuilt binary artifacts, it is necessary to build the packages in a
well-defined, acyclic order. Dependency cycles between packages are the biggest
obstacle to achieving this goal and JPT is the biggest offender -- it requires
more than a hundred of Java packages, all of which in turn build-require JPT.

JPB comes with a solution to this problem -- it builds everything that JPT needs
to work, without reliance on any Java software other than OpenJDK. JPT can
depend on JPB for everything, without depending on any other Java packages. For
example, JPB contains embedded version of XMvn, removing dependency of JPT on
XMvn, allowing JPT to be used before one builds XMvn package.

Fedora Account System Username: mkoncek
Comment 1 Mikolaj Izdebski 2020-11-25 18:53:43 UTC 
The review is ongoing, licensing is complex so it will take me some
time to complete.  Items marked with "+" are passed, ones marked with
"-" are failed and need to be fixed or explained.

+ 1. spec file looks sane

+ 2. license tag looks fine on first glance, but due to its complexity
     will be evaluated later in more detail

+ 3. complex licensing is explained in licensing breakdown file

+ 4. package builds in rawhide x86_64

+ 5. rpmlint identified 1 error and 112 warnings, all false-positives

+ 6. requires look sane

+ 7. provides look sane

+ 8. file manifest looks good, JAR files are installed in a
     subdirectory of /usr/share/java/

+ 9. package is installable on rawhide x86_64

+ 10. bundled provides were added

- 11. upstream was not yet contacted about unbundling dependencies
      ("All packages whose upstreams have no mechanism to build
      against system libraries must be contacted publicly about a path
      to supporting system libraries.", Bundled Software Policy)

- 12. automatic dependencies are not filtered ("Packages that bundle
      libraries must follow the AutoProvides filtering guidelines for
      private libraries.", Bundled Software Policy)

+ 13. buildrequires are correct

+ 14. there is no Class-path in JAR manifests

+ 15. the package is noarch

+ 16. dist tag is used correctly
Comment 2 Mikolaj Izdebski 2020-11-27 11:26:19 UTC 
Created attachment 1734072 [details]
rpmlint output
Comment 3 Mikolaj Izdebski 2020-11-27 11:32:30 UTC 
+ 11. I can see that issue 11 was fixed by opening upstream issue at
      https://github.com/fedora-java/javapackages-bootstrap/issues/10

+ 12. Issue 12 turned out to be minor as there is actually nothing to
      filter out, but still filtering should be implemented to prevent
      unexpected provides/requires from appearing in the future. But
      that should not be a blocker.

+ 17. I checked licensing, everything looks correct.  Licensing
      breakdown is very precise.  Additional installed MIT license
      files for plexus-* are correct.

+ 18. File permissions are correct.

+ 19. Executables provided by the package seem to work.

+ 20. Docs are installed.

Everything looks good, package is APPROVED.
Comment 4 Gwyn Ciesla 2020-11-30 14:53:18 UTC 
(fedscm-admin):  The Pagure repository was created at https://src.fedoraproject.org/rpms/javapackages-bootstrap
Comment 5 Marián Konček 2020-11-30 16:33:30 UTC 
Package build in Fedora Rawhide:
https://koji.fedoraproject.org/koji/taskinfo?taskID=56451126