Bug#969633: transition: json-simple

[Gilles Filippini]

Package: release.debian.org
Severity: normal
User: ***@packages.debian.org
Usertags: transition

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

I'd like to transition json-simple 3.1.1 surrently sitting into experimental.
The name of the library doens't change, but reverse dependencies need a
binnmu.

Here is the status for each of these build-rdeps:

biojava4-live build OK
derby build OK
h2database build OK
i2p build OK
jts build OK
mapsforge build OK
mobile-atlas-creator build OK
mockito build OK
netbeans build KO - not in testing
orthanc-imagej build OK
plm build OK
spatial4j build OK
spatial4j-0.4 build OK
syndie build OK
tika build KO - not in testing

Since there is no library name change, I'm not sure what to put into the
ben file. Here is an attempt:

Ben file:

title = "json-simple";
is_affected = .depends ~ /libjson-simple-java/ | .build-depends ~ /libjson-simple-java/;
is_good = .depends ~ /lbjson-simple-java/;
is_bad = .depends ~ /lbjson-simple-java/;

Thanks in advance for considering.

_g.

[Gilles Filippini]

Post by Gilles Filippini
Package: release.debian.org
Severity: normal
Usertags: transition
Hi,
I'd like to transition json-simple 3.1.1 surrently sitting into experimental.
The name of the library doens't change, but reverse dependencies need a
binnmu.

Why is that?

Upstream removed an API that was deprecated long ago and introduced a
few backward incompatible changes.

_g.

[Gilles Filippini]

Hi Emilio,

Post by Gilles Filippini

Post by Gilles Filippini
Package: release.debian.org
Severity: normal
Usertags: transition
Hi,
I'd like to transition json-simple 3.1.1 surrently sitting into experimental.
The name of the library doens't change, but reverse dependencies need a
binnmu.

Why is that?

Upstream removed an API that was deprecated long ago and introduced a
few backward incompatible changes.

Then it needs a SONAME bump.

There is no such thing in java. I asked the question on the debian-java
list whether to change the binary package's name and it was answered
that it should be avoidable [1]. I eventually chose not to change it
because there are few reverse dependencies.

[1] https://lists.debian.org/debian-java/2020/05/msg00025.html

What do you think?

_g.

[Paul Gevers]

Hi,

Post by Gilles Filippini

Post by Gilles Filippini
Upstream removed an API that was deprecated long ago and introduced a
few backward incompatible changes.

Then it needs a SONAME bump.

There is no such thing in java. I asked the question on the debian-java
list whether to change the binary package's name and it was answered
that it should be avoidable [1]. I eventually chose not to change it
because there are few reverse dependencies.

As you don't have a way to know what 3rd party packages exist that rely
on json-simple's binaries, the most robust solution is to rename the
binary like we do in c-library transitions when SONAME's are bumped. We
don't get the benefit of smooth-transitions, but it avoids most silent
breakage.

Do I assume correctly that the reverse build dependencies' binaries get
the right package name to depend on during the build, or are they
hard-coded and would need manual updating? If it's manual, how would the
reverse build dependencies' binaries get the right versioned dependency?

Paul

[p***@debian.org]

Hi Paul,

Post by Paul Gevers
Hi,

Post by Gilles Filippini

Post by Gilles Filippini
Upstream removed an API that was deprecated long ago and introduced a
few backward incompatible changes.
Then it needs a SONAME bump.

There is no such thing in java. I asked the question on the
debian-java
list whether to change the binary package's name and it was answered
that it should be avoidable [1]. I eventually chose not to change it
because there are few reverse dependencies.

As you don't have a way to know what 3rd party packages exist that rely
on json-simple's binaries, the most robust solution is to rename the
binary like we do in c-library transitions when SONAME's are bumped. We
don't get the benefit of smooth-transitions, but it avoids most silent
breakage.
Do I assume correctly that the reverse build dependencies' binaries get
the right package name to depend on during the build, or are they
hard-coded and would need manual updating? If it's manual, how would
the reverse build dependencies' binaries get the right versioned
dependency?

Thank you for following up on this old thread, but I've now lost
interest in json-simple. I started packaging it as a dependency of
sikuli which was removed from Debian 8 years ago.

Best,
_g.