Bug 18700 - jakarta-commons-httpclient should be removed in favor of httpcomponents-client
Summary: jakarta-commons-httpclient should be removed in favor of httpcomponents-client
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: release_blocker normal
Target Milestone: ---
Assignee: Nicolas Lécureuil
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-06-13 21:24 CEST by David Walser
Modified: 2017-07-30 05:00 CEST (History)
2 users (show)

See Also:
Source RPM:
CVE:
Status comment:


Attachments

Description David Walser 2016-06-13 21:24:37 CEST
As I've mentioned a few times in the past, all Jakarta software is dead and gone, unmaintained upstream for several years now, and should be removed from Linux distributions.

Most Jakarta things have modern, maintained Apache equivalents that are (near) drop-in replacements, and most of these switches have already been made.

My understanding is that everything still using jakarta-commons-httpclient should be portable to httpcomponents-client, which is the modern Apache equivalent.  It's just up to someone to do the porting.

Based on a check of all of our SPEC files that Thierry did last Christmas:
https://ml.mageia.org/l/arc/dev/2015-12/msg00483.html

these are the only packages still using jakarta-commons-httpclient:
ant-contrib.spec (BR jakarta-commons-httpclient)
apache-ivy.spec (BR jakarta-oro, BR jakarta-commons-httpclient)
axis.spec (BR jakarta-oro, BR/R jakarta-commons-httpclient)
fop.spec (R jakarta-commons-httpclient)
hadoop.spec (BR/R jakarta-commons-httpclient)
jenkins.spec (R jakarta-oro, R jakarta-commons-httpclient)
libreoffice.spec (R jakarta-commons-httpclient)
narayana.spec (BR jakarta-commons-httpclient)

Finally, oro (jakarta-oro) and regexp are two other Jakarta packages still in the distro that are used by things, but I don't know if there are equivalents for these, or if so, what they are called.
David Walser 2016-06-13 21:24:47 CEST

CC: (none) => geiger.david68210

Comment 1 Mikolaj Izdebski 2016-06-14 13:08:25 CEST
I agree that old and unmaintained code should be dropped. I'm all for it, when possible.

Unfortunately, as far as I know, httpcomponents-client (4.x) API is *not* compatible with jakarta-commons-httpclient (3.x). Porting dependant packages would require significant work and upstream cooperation. Any help is of course welcome.

jakarta-oro and regexp won't be easy to remove either. But there are some old and unmaintained packages, which should be much easier to get rid of, for example werken-xpath or avalon-framework.

CC: (none) => mizdebsk

Comment 2 David Walser 2016-06-14 13:17:35 CEST
It will require some Java programming work and cooperation with upstream, but it should be done.  I don't know how big the API changes are or how significant the work would really be, but again, just from what I've read, it should be do-able, it's just a matter of someone (or multiple someones) having the time to work on it.

werken-xpath is indeed no longer needed, so we can drop that.  Thanks for pointing that out.

avalon-framework is currently needed by several things, including at least:
avalon-logkit
fop
freemind
hadoop
jets3t-app
publican
Comment 3 Mikolaj Izdebski 2016-06-14 13:20:41 CEST
(In reply to David Walser from comment #2)
> avalon-framework is currently needed by several things, including at least:
> avalon-logkit
> fop
> freemind
> hadoop
> jets3t-app
> publican

Most of these are false-dependencies, IIRC. I'll see what can be done about fixing them.
Comment 4 David Walser 2017-07-30 05:00:07 CEST
Raising to release blocker for Mageia 7.  We shouldn't keep this around forever.

Priority: Normal => release_blocker


Note You need to log in before you can comment on or make changes to this bug.