fixing Yanel's Maven dependencies handling (was: Re: [Yanel-dev] updating fop)

[Guillaume Déflache]

simon a écrit :
> hi all

Hi!


> i would like to propose updating fop. now we are using fop-0.93 which is 
> more then two years old and has some bugs which causes problem with my 
> curent work (e.g. can not handle transparent png). the newest version 
> fop-0.95 doesn't have this problems anymore.

I think this would indeed be great! I am a long-time fan of FOP! :)


> to work around this problems i replaced fop with the newest version 
> within yanel. this seem to work fine. but it would be nicer if i don't 
> have to ;-)

0.95 is in principle supposed to be backward-compatible with 0.93, 
right? (Just asking to know if there is a official compatibility policy 
written somewhere, as by the version numbers only this is still admitted 
to be pre-1.0 and so maybe problematic as regards API compatibility, etc.)


> fop has some dependencies which needs to be updated as well.
> - commons-io-1.4
> - commons-logging-1.1.1
> - fop-0.95
> - xmlgraphics-commons-1.3

http://repo1.maven.org/maven2/org/apache/xmlgraphics/fop/0.95-1/fop-0.95-1.pom 
and http://repo1.maven.org/maven2/org/apache/xmlgraphics/fop/0 with 
.95/fop-0.95.pom say otherwise:
- they use different versions, which are probably the oldest that are needed
- they use a lot of other not-optional-and-not-put-in-a-submodule SVG 
JAR deps from Batik, which you probably did not need
- they also require Avalon framework API, which you probably got from 
Yanel or something else
- they also require XML Graphics Commons, which maybe is also ony need 
for SVG stuff

My point here is: Michi and I agree that from now on we should strive to 
use the pristine POM files for each project (e.g. those coming from 
http://repo1.maven.org/maven2/ AFAIK) so as to be able to finally fix 
Yanel's "duplicated libraries" problem: 
http://bugzilla.wyona.com/cgi-bin/bugzilla/show_bug.cgi?id=7006 (and 
coincidentally 
http://bugzilla.wyona.com/cgi-bin/bugzilla/show_bug.cgi?id=6896 and 
http://bugzilla.wyona.com/cgi-bin/bugzilla/show_bug.cgi?id=4771 as we go 
along)

Did you use another repository or no Maven repo at all to get the JARs?


Sorry this simple request morphs to a huge thing! ;)

I guess our options are, from the hackiest to the most long-term 
beneficial one:

1) we add a fixed (see remarks above) FOP 0.95 POM and the corresponding 
artifacts in current Wyona's own repo at http://maven2.wyona.org/ 
(Simon, do you have write access to that?)

2) you grab the dependencies directly from your own project hoping or 
else ensuring thanks to bug 7006's workaround that you don't get 
duplicated libraries but only the latest versions of them as should be

3) we start another /clean/ mirror of Maven main repo which would this 
time not be a 
one-time-copy-and-as-such-bound-to-be-always-somewhat-out-of-date of the 
Maven central repo, but some kind of actively-synchronized proxy of it, 
using for example "Dead Simple Maven Proxy" 
(<http://www.pdark.de/dsmp/>) as it's the only repository manager I know 
about (via 
http://blogs.exist.com/oching/2007/11/05/the-hype-about-repository-managers/ 
search there for "patches") that seems to be able to override POMs; the 
question remains if we can easily use both at the same time while in the 
repo transition phase.

HTH,
    Guillaume