[Yanel-dev] Re: fixing Yanel's Maven dependencies handling

[simon]

Guillaume Déflache schrieb:
> simon a écrit :
>> hi all
>
> Hi!
>
>
>> i would like to propose updating fop. now we are using fop-0.93 which 
>> is more then two years old and has some bugs which causes problem 
>> with my curent work (e.g. can not handle transparent png). the newest 
>> version fop-0.95 doesn't have this problems anymore.
>
> I think this would indeed be great! I am a long-time fan of FOP! :)
>
>
>> to work around this problems i replaced fop with the newest version 
>> within yanel. this seem to work fine. but it would be nicer if i 
>> don't have to ;-)
>
> 0.95 is in principle supposed to be backward-compatible with 0.93, 
> right? (Just asking to know if there is a official compatibility 
> policy written somewhere, as by the version numbers only this is still 
> admitted to be pre-1.0 and so maybe problematic as regards API 
> compatibility, etc.)
no idea.
>
>
>> fop has some dependencies which needs to be updated as well.
>> - commons-io-1.4
>> - commons-logging-1.1.1
>> - fop-0.95
>> - xmlgraphics-commons-1.3
>
> http://repo1.maven.org/maven2/org/apache/xmlgraphics/fop/0.95-1/fop-0.95-1.pom 
> and http://repo1.maven.org/maven2/org/apache/xmlgraphics/fop/0 with 
> .95/fop-0.95.pom say otherwise:
> - they use different versions, which are probably the oldest that are 
> needed
> - they use a lot of other not-optional-and-not-put-in-a-submodule SVG 
> JAR deps from Batik, which you probably did not need
> - they also require Avalon framework API, which you probably got from 
> Yanel or something else
> - they also require XML Graphics Commons, which maybe is also ony need 
> for SVG stuff
>
> My point here is: Michi and I agree that from now on we should strive 
> to use the pristine POM files for each project (e.g. those coming from 
> http://repo1.maven.org/maven2/ AFAIK) so as to be able to finally fix 
> Yanel's "duplicated libraries" problem: 
> http://bugzilla.wyona.com/cgi-bin/bugzilla/show_bug.cgi?id=7006 (and 
> coincidentally 
> http://bugzilla.wyona.com/cgi-bin/bugzilla/show_bug.cgi?id=6896 and 
> http://bugzilla.wyona.com/cgi-bin/bugzilla/show_bug.cgi?id=4771 as we 
> go along)
>
> Did you use another repository or no Maven repo at all to get the JARs?
no maven at all.
>
>
> Sorry this simple request morphs to a huge thing! ;)
i'm sorry too ;)
>
> I guess our options are, from the hackiest to the most long-term 
> beneficial one:
>
> 1) we add a fixed (see remarks above) FOP 0.95 POM and the 
> corresponding artifacts in current Wyona's own repo at 
> http://maven2.wyona.org/ (Simon, do you have write access to that?)
not sure. and not sure this is sufficient since some of the libs are 
declared in yanels dependencies file.
apache-jakarta-commons-logging-1.0.4 is listed (at least) in yanels 
dependencies file and also in the dependencies file of nutch and 
testing-control resources.
>
> 2) you grab the dependencies directly from your own project hoping or 
> else ensuring thanks to bug 7006's workaround that you don't get 
> duplicated libraries but only the latest versions of them as should be
this seems to be my problem.
i have to delete:
apache-jakarta-commons-io-1.2.jar
apache-jakarta-commons-logging-1.0.4.jar
commons-logging-1.0.4.jar
xmlgraphics-commons-1.1.jar

and i don't understand the workaround of bug 7006.
>
> 3) we start another /clean/ mirror of Maven main repo which would this 
> time not be a 
> one-time-copy-and-as-such-bound-to-be-always-somewhat-out-of-date of 
> the Maven central repo, but some kind of actively-synchronized proxy 
> of it, using for example "Dead Simple Maven Proxy" 
> (<http://www.pdark.de/dsmp/>) as it's the only repository manager I 
> know about (via 
> http://blogs.exist.com/oching/2007/11/05/the-hype-about-repository-managers/ 
> search there for "patches") that seems to be able to override POMs; 
> the question remains if we can easily use both at the same time while 
> in the repo transition phase.
not sure about about this.

sorry, but it seems to me i don't understand this dependency management 
stuff enough.
i guess i should learn more about it.

simon
>
> HTH,
>    Guillaume