Bug#801026: osgi-compendium: depends on obsolete libservlet2.5-java library

Neil Bartlett njbartlett at gmail.com
Mon Oct 5 20:35:01 UTC 2015


> On 5 Oct 2015, at 21:03, Markus Koschany <apo at gambaru.de> wrote:
> 
> Am 05.10.2015 um 21:26 schrieb Neil Bartlett:
>> This isn’t really possible. The osgi-compendium package is not just a program or library; it represents a specification published by a standards body, the OSGi Alliance. The specification supports the java servlet API 2.5 and above. We cannot simply update to 3.1 since that could break any consumers using 2.5 — also the package would not comply with the published specification.
>> 
>> Neil Bartlett
> 
> Hello,
> 
> you contradict yourself by claiming that The OSGi Compendium 5
> specification supports the Java servlet API 2.5 and above and in the
> next sentence you claim it only supports 2.5.

There is no contradiction… where did I claim that it only supports 2.5?

The specification supports users who depend on servlet 2.5 or above. That means the specification JAR compiles against the lowest version that it supports, i.e. 2.5.

> 
> I think your first part is correct. I quote from page 795 of the
> specification:
> 
> "This Web Application Specification provides support for web
> applications written to the Servlet 2.5
> specification, or later"
> 
> So I see this more like a minimum requirement. I have also never
> understood why we build-depend on libservlet2.5-java at all given the
> fact that it is not needed at build-time. I would rather tend to
> completely remove the build-dependency and the corresponding dependency
> on libservlet2.5-java but not before I have checked that all
> reverse-dependencies do not rely on this behaviour.

The source code for OSGi Compendium contains the type org.osgi.service.http.HttpService, which depends on types from the javax.servlet package. If the osgi-compendium package in Debian builds from Java sources then it certainly needs javax.servlet to be present on the compiler’s classpath, and therefore the dependency cannot be removed. On the other hand if it repackages pre-built JARs from elsewhere then I would agree that javax.servlet does not need to be present as a dependency.


> 
> Can you provide an example what package in Debian would be negatively
> affected if we started to build-depend/depend on libservlet3.1-java?

No I am not able to answer this.

> 
> Regards,
> 
> Markus
> 


Neil



More information about the pkg-java-maintainers mailing list