On Wed, Jul 28, 2021 at 08:41:46AM +0200, Emmanuel Bourg wrote: >> Hi Peymaneh, >> >> Le 2021-07-27 10:09, Peymaneh Nejad a écrit : >> >> > Is it intended or wished for that additional runtimes other than Java >> > are packaged in seperate source packages >> >> Yes it is, for several reasons: >> - The Java Team doesn't have the time and skills to maintain properly a >> multi-language package like ANTLR. The Java part is sufficiently complex on >> its own, we'd rather not have to care about the other languages. >> - Different language ecosystems often require distinct and slightly >> incompatible versions of ANTLR. >> - Handling several languages in the same package makes upgrades and >> regression testing much more difficult. >> - ANTLR is a core package of the Java ecosystems, including more languages >> increases the dependency tree of the Java packages and makes the >> bootstrapping harder. >> >> So it's preferable to have a clear separation of responsability with >> different source packages, each language team having the freedom to maintain >> its version as needed without impacting the others. > I don't disagree with Emmanuel's statements about the importance of > ANTLR and why it is helpful to maintain separation. However, I don't > think introducing a separate source package each language ecosystem is > necessarily best for Debian. > It causes additional work for the Security team when in the event there > vulnerabilities. It potentially confuses users (and Debian developers) > by creating a distinction that does not exist upstream. It also means > that we will release with different versions of ANTLR for different > languages, which feels very "non-distro" to me. (What happens if the > version of the ANTLR parser for language X is subtly incompatible with > language Y, and a user runs a system on Debian that requires both > bindings?) Chiming in here, since it was originally me who asked Peymaneh to contact this list, and I was sponsoring the same. I was initially of the same opinion that it should be unified into a single source package, but ebourg's points against doing that are pretty strong too. While I do not disagree w/ tony on this, but there already exist antlr4-cpp-runtime[1] and python3-antlr4[2] packaged separately, and indeed, they seem to have different versions than the Java antlr4 we have -- 4.9 and 4.9.1 respectively as opposed to 4.7.2 in the java antlr4 package IMO, this is making it "non-distro" already. There are also a bunch of other runtimes in other languages which might as well need packaging at some point in time Then, we have a few options: 1) Talk to the maintainers of cpp-runtime and python3-antlr to unify sources with the original antlr4 source package And this can be a very time consuming task there, since fundamentally the versions differ quite a bit, and fixing it will take time 2) Do "$something-else" for all these packages to stay in sync - again, probably bumping versions only when needed. With this approach, I do not see a problem in introducing a Go runtime source package there Thoughts? [1]: https://tracker.debian.org/pkg/antlr4-cpp-runtime [2]: https://tracker.debian.org/pkg/python3-antlr4 Nilesh
Attachment:
signature.asc
Description: PGP signature