[Debian-science-sagemath] Jmol transition?

[Ximin Luo]

Progress report: I've done most of the packaging for java2script and jmol, here:

https://github.com/infinity0/java2script
https://github.com/infinity0/jmol

The current version of Jmol actually has *less* dependencies than the old one in Debian. It looks like they're shifting the priority onto JSmol.

However, this is going to be a potential blocker. JSmol uses java2script (J2S) to compile Java into JS. To do this, they also recreate the whole of the standard Java library in JS.

But they don't do this in a way that is auditable - the developers of both J2S and JSmol generate some JS files from who-knows-what-version Java source, pack this generated code up and check it into source control, then gradually over time, mix it in with manually-optimised JS overrides for specific Java classes.

In J2S, this code is bundled into j2slib.zip that is checked into git:
https://github.com/zhourenjian/java2script/blob/master/sources/net.sf.j2s.lib/j2slib.zip

In JSmol, this code lives in j2s/java and srcjs:
https://github.com/infinity0/jmol/tree/master/JSmol/j2s/java
https://github.com/infinity0/jmol/tree/master/JSmol/srcjs

There are no build scripts that automate the *full* process, and furthermore it is not documented anywhere accessible. I have been unable to reproduce these steps (only about 80% of it). The developers of both projects don't seem to care particularly about having a smooth, automated, reproducible and auditable process to generate these files. I have brought this issue up with them:

J2S: https://github.com/zhourenjian/java2script/issues/8
JSmol: https://sourceforge.net/p/jmol/bugs/587/#2260/97e3/8c8f

However even if they answer this *for the current version*, in order for us to be able to properly maintain these two packages in the long run, these upstream projects will have to change their development workflow to *automate* these things.

This is the *last blocking* issue for these two packages to enter Debian. I have solved all of the other technical points, including automatically generating these things in a headless environment using the Eclipse command-line.

This point is critical for Free and Open Source Software. We can't be relying on unreproducible blobs generated several years ago via an opaque process. We might as well be using proprietary software in that case. The upstream developers don't seem to care much about this point either.

I will give it a few weeks for these developers to respond; but after that we need to seriously think about cutting out JSmol from Debian and/or Sage. I will also contain sage-devel@ about this point too. Since their mission is to create an open-source replacement to Mathematica etc, I hope they are serious about these FOSS principles. Again to re-iterate: JSmol and J2S are very close to being proprietary software. We can't trace or reproduce these JS "core Java" libs.

X

P.S. The Java parts of Jmol are fine. It is technically difficult atm, and we need upstream to do some things to make it easier to maintain in the long run - but from a FOSS and auditability point of view, everything checks out. The Java parts of J2S are also fine - but it's next to useless without the J2SLib.

-- 
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git