Since we are in the midst of redoing the build tools and spec files this is a perfect opportunity to bring consistency to where we install our jars and their names. The short summary is: All noarch jars should install to /usr/share/java/pki. All jar names should begin with the "pki-" prefix. Rationale: Existing packaging guidelines and the FHS have long adopted the practice that application specific items install into an application specific directory under the normal parent directory. We already follow that guideline with respect to /usr/share, the application specific directory in this instance is "pki" (where "pki" is our application specific name), thus we install into /usr/share/pki. In the context of java jar files the normal parent directory is /usr/share/java. This is where you will find jars meant to be used in a variety of non-application specific contexts (e.g. general libraries). Jars which which are not of general use, but rather are specific to a specific application should be isolated in their own directory so they are not available for loading in a general context. Thus our PKI specific jars should be isolated in a subdirectory of /usr/share/java allocated for our use only. Often the guidelines make reference to <package> when they mean <application>. Because we partition the various PKI subsystems into different independent packages you should equate <package> with <application> where in this context <application> implies "pki". Side Bar Note: The existing Java packaging guidelines on the fedora project website are in a state of disrepair. You cannot find the explicit recommendation that application specific jars are to be installed into /usr/share/java/<application>. This is an oversight and omission which is in the process of being corrected. I have confirmed with Tom Callaway (aka "spot") a packaging expert and Aleksandar Kurtakov (responsible for current java packaging guidelines) that we indeed should be installing our jars into /usr/share/java/pki (where "pki" is our application specific directory). I have been assured that the Java packaging guidelines will be updated to reflect this. Attachments will follow which detail the existing installation targets and the recommended installation targets. As for why some jars are prefixed with "pki-" and others are not, I can only assume the inconsistent naming is historical and needs to be corrected.
Created attachment 462496 [details] summary of our current installation with respect to jars
Created attachment 462497 [details] suggested jar renaming Of course the symbolic links from the non-version name to the current version will still need to be provided.
I forgot to add this important piece of information to the rationale. Plays better with path based class resolution, which makes it: * More robust * Better security * Easier to manage Rather than enumerating the file path to every jar we load (our former practice, but difficult to manage) we are moving to a simpler search path based solution. If our jars are in known locations the search path works better because our jars will be located earlier in the search path. The proposed search path is: /var/lib/$instance/webapps/$subsystem/WEB-INF/lib/ /var/lib/$instance/common/lib /usr/share/java/pki /usr/share/java /usr/lib/java The first two paths in the instance directories are normally expected to be empty and exist only to provide a local override if necessary. Thus effectively the first place we search for jars is our pki jar area: /usr/share/java/pki Then followed by the system jar locations. If our jars are in our jar location rather than a mix of our location and the system locations then we have better control.
Created attachment 472722 [details] Jar relocation and renaming . . .
# cd pki # svn status | grep -v ^$ | grep -v ^P | grep -v ^X | grep -v ^? M dogtag/java-tools/pki-java-tools.spec M dogtag/ca/pki-ca.spec M dogtag/common/pki-common.spec M dogtag/silent/pki-silent.spec M dogtag/tks/pki-tks.spec M dogtag/console/pki-console.spec M dogtag/ocsp/pki-ocsp.spec M dogtag/util/pki-util.spec M dogtag/console-ui/src/CMakeLists.txt M dogtag/console-ui/dogtag-pki-console-ui.spec M dogtag/console-ui/build.xml M dogtag/kra/pki-kra.spec M base/java-tools/src/CMakeLists.txt M base/java-tools/templates/pretty_print_crl_command_wrapper M base/java-tools/templates/pki_java_command_wrapper M base/java-tools/templates/pki_java_command_wrapper.in M base/java-tools/templates/pretty_print_cert_command_wrapper M base/java-tools/build.xml M base/ca/src/CMakeLists.txt M base/ca/build.xml M base/common/src/CMakeLists.txt M base/common/build.xml M base/silent/scripts/pkisilent M base/silent/src/CMakeLists.txt M base/silent/build.xml M base/setup/pkicreate M base/tks/src/CMakeLists.txt M base/tks/build.xml M base/console/src/CMakeLists.txt M base/console/templates/pki_console_wrapper M base/console/build.xml M base/ocsp/src/CMakeLists.txt M base/ocsp/build.xml M base/kra/src/CMakeLists.txt M base/kra/build.xml M base/util/src/CMakeLists.txt M base/util/build.xml M specs/dogtag-pki-theme.spec M specs/pki-tps.spec M specs/pki-core.spec M specs/pki-migrate.spec M specs/ipa-pki-theme.spec M specs/pki-kra.spec M specs/pki-tks.spec M specs/pki-console.spec M specs/pki-ra.spec M specs/pki-ocsp.spec # svn commit Sending base/ca/build.xml Sending base/ca/src/CMakeLists.txt Sending base/common/build.xml Sending base/common/src/CMakeLists.txt Sending base/console/build.xml Sending base/console/src/CMakeLists.txt Sending base/console/templates/pki_console_wrapper Sending base/java-tools/build.xml Sending base/java-tools/src/CMakeLists.txt Sending base/java-tools/templates/pki_java_command_wrapper Sending base/java-tools/templates/pki_java_command_wrapper.in Sending base/java-tools/templates/pretty_print_cert_command_wrapper Sending base/java-tools/templates/pretty_print_crl_command_wrapper Sending base/kra/build.xml Sending base/kra/src/CMakeLists.txt Sending base/ocsp/build.xml Sending base/ocsp/src/CMakeLists.txt Sending base/setup/pkicreate Sending base/silent/build.xml Sending base/silent/scripts/pkisilent Sending base/silent/src/CMakeLists.txt Sending base/tks/build.xml Sending base/tks/src/CMakeLists.txt Sending base/util/build.xml Sending base/util/src/CMakeLists.txt Sending dogtag/ca/pki-ca.spec Sending dogtag/common/pki-common.spec Sending dogtag/console/pki-console.spec Sending dogtag/console-ui/build.xml Sending dogtag/console-ui/dogtag-pki-console-ui.spec Sending dogtag/console-ui/src/CMakeLists.txt Sending dogtag/java-tools/pki-java-tools.spec Sending dogtag/kra/pki-kra.spec Sending dogtag/ocsp/pki-ocsp.spec Sending dogtag/silent/pki-silent.spec Sending dogtag/tks/pki-tks.spec Sending dogtag/util/pki-util.spec Sending specs/dogtag-pki-theme.spec Sending specs/ipa-pki-theme.spec Sending specs/pki-console.spec Sending specs/pki-core.spec Sending specs/pki-kra.spec Sending specs/pki-migrate.spec Sending specs/pki-ocsp.spec Sending specs/pki-ra.spec Sending specs/pki-tks.spec Sending specs/pki-tps.spec Transmitting file data ............................................... Committed revision 1719.