jtreg7: request to vendor the dependencies

[Vladimir Petko]

Hi,

jtreg7 is a package that provides regression testing for openjdk-21
and soon openjdk-17 and is critical to the openjdk package build
process.

jtreg7 depends on a number of test-related packages (junit4, junit5,
libhamcrest-java) that require transitive dependencies such as picocli
or opentest4j-reporting either introduced (that is not an issue) or
upgraded.

A new point release of the package in the stable release requires
careful testing and ensuring that there is no impact on reverse
dependencies.

JTreg is seeing some acceleration in development and will require a
regular backporting effort for the dependencies.

I wonder if it is possible to provide an exclusion for jtreg7 to
vendor the required dependencies to simplify the backporting effort.

The draft vendoring implementation is available here[1].

Best Regards,
Vladimir.

[1] https://salsa.debian.org/vpa1977/jtreg/-/commit/eebacdae191d6f0a833d548681fb3fe6b17dbd91

[Thorsten Glaser]

On Wed, 18 Oct 2023, Vladimir Petko wrote:

>jtreg7 depends on a number of test-related packages (junit4, junit5,
>libhamcrest-java) that require transitive dependencies such as picocli
>or opentest4j-reporting either introduced (that is not an issue) or
>upgraded.

Standard answer is that these must be packaged separately.

>A new point release of the package in the stable release requires
>careful testing and ensuring that there is no impact on reverse
>dependencies.

Right. Please talk to stable release maintainers and security people
and ask them how they’d prefer to have this handled. Do also include
Doko (as openjdk-?? maintainer).

bye,
//mirabilos
--
Infrastrukturexperte • Qvest Digital AG
Am Dickobskreuz 10, D-53121 Bonn • https://www.qvest-digital.com/
Telephon +49 228 54881-393 • Fax: +49 228 54881-235
HRB AG Bonn 18196 • USt-ID (VAT): DE274355441
Vorstand: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg
Vorsitzender Aufsichtsrat: Peter Nöthen