Bug#1093577: dnssecjava: New upstream version (needs new dependency)

[tony mancill]

Hello Ingo,

Somehow my mail provider decided to categorize your email as spam, so I
only saw the one from Andreas.  (More below.)

On Mon, Jan 20, 2025 at 11:59:38PM +0100, Ingo Bauersachs wrote:
> Andreas Tille wrote on 2025-01-20:
> > I tried to upgrade dnssecjava to the latest upstream version (2.0.0) in
> > Git but it fails to build due to a new Build-Depends as you can see in
> > Salsa CI[1]:
> >
> 
> dnssecjava is EOL, archived on GitHub, and is affected by some CVEs.
> The code has been merged into dnsjava.
> 
> Note that dnsjava is AFAIK currently also removed from unstable because
> it too had CVEs. I'm not sure it's worth updating it either. The only
> rdep that I'm aware of was JMeter, and last time I checked, that version
> was also extremely old in Debian.
> 
> If you do want to update dnsjava, please let me know. The newest version
> has some build dependencies in the pom that are almost certainly not
> packaged at all or in their current version in Debian, but most of
> them should not be necessary to build it (e.g. Spotless, it only checks
> that the source code is properly formatted).
> 
> Regards,
> Ingo

A recent update to dnsjava was uploaded to unstable [1] , but there is
still some work to do.

Based on your email, it sounds like the suggested course of action is to
get dnsjava into shape, drop dnssecjava, and update any build
reverse-deps on dnssecjava to use dnsjava.

Thanks,
tony
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20250121/6a6b1224/attachment-0001.sig>