Debian NEW review of derby 10.17.1.0-1: ACCEPTED

[awm at debian.org]

The Debian NEW review of derby 10.17.1.0-1 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

A few problems that you should fix when you have some time...

1. Third-party holders undocumented. debian/copyright only lists ASF and IBM for Files: *. The upstream NOTICE names many additional holders (NIST, OSGi/kxml/Felix, Lucene, Tomcat, json-simple, ICU, IBM 1997-2004). These are largely build-time-only dependencies that don't ship as separate code, so this isn't a DFSG violation — but dep5 doesn't record them or state that they aren't shipped. (Mitigated by NOTICE being installed.)

2. Optional-tools jar is built but never installed. ant ... buildjars builds derbyoptionaltools.jar (Lucene/JSON integration, see maven2/optionaltools/pom.xml), but no .poms file installs it, so liblucene4.10-java/libjson-simple-java are only used to compile an unshipped artifact. Good for DFSG, but the JSON-simple patch work is effectively dead code in the shipped packages.

3. Fragile in-place source mutation. debian/rules:36-40 (override_dh_auto_build) does sed -i.json-simple on *.java source files in the source tree (substituting @JSON_SIMPLE@), with restoration only in override_dh_auto_clean:31-32. An interrupted build leaves source files corrupted. Combined with the runtime dpkg -l parsing of JSON_SIMPLE_VERSION (debian/rules:11-17) to choose between com.github.cliftonlabs.json_simple and org.json.simple, this is brittle — better resolved by a fixed Build-Depends and a static patch.


Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/derby