Bug#831993: libcommons-codec-java: accesses the internet during build

[Emmanuel Bourg]

Le 21/07/2016 à 09:12, Chris Lamb a écrit :

> Whilst libcommons-codec-java builds successfully on unstable/amd64, according to
> Debian Policy 4.9 packages may not attempt network access during
> a build.

Hi Chris,

Thank you for reporting this issue. This happens because the Javadoc is
linked to the JDK API hosted on download.oracle.com [1]. The connection
isn't required for the build though, if it fails the javadoc generated
won't contain links to the documentation of the standard API.

My understanding of the "no network access" rule was that the build must
not require a network connection to complete, nor pull into the package
external elements not found in the source tarball at build time. I guess
the intent is to ensure that the source packages are self contained.

Here the javadoc tool merely checks the existence of the remote
documentation to add href links in the generated files. This is optional
and doesn't break the build if it doesn't work. So for these reasons I
think this is a rather minor policy violation, the package is indeed
self contained and doesn't fail to build without network access.

I'm more concerned about the reproducibility issue induced though,
because this means the package generated will be different when built
with or without network access.

libcommons-codec-java is still built with Ant. Switching to
maven-debian-helper should fix this issue.

Emmanuel Bourg


[1]
https://sources.debian.net/src/libcommons-codec-java/1.10-1/build.xml/#L93