Bug#819811: ITP: leiningen -- simple build system for Clojure

[Elana Hashman]

All,

We are getting very close!

I have completed packaging for the three outstanding blocking bugs:

- #862233: use maven 3.5.0 and upgrade to pomegranate 0.4.0-alpha1
  https://anonscm.debian.org/cgit/pkg-clojure/pomegranate-clojure.git/ 
-- this
  one is complicated, wanted a few more eyes before upload, but I did 
test it


- #712908: packaged stencil 0.5.0
  https://anonscm.debian.org/cgit/pkg-clojure/stencil-clojure.git/ -- 
Barry

  Warsaw promised me he'd upload this at the PyCon sprints

- #719664: packaged parsley 0.9.3
  https://anonscm.debian.org/cgit/pkg-clojure/parsley-clojure.git/ -- 
just need

  a sponsor

Once these all get uploaded and freeze is over, we should be able to get 
the

leiningen packaging completed. Looking forward to that.

- e

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Elana Hashman]

I mentioned this on IRC, but also wanted to send a message out to the bug list 
for posterity...

I've hit a bit of a snag with the libpomegranate-clojure packaging (#852246). 
While I did get the package to build, it doesn't actually work. I realized it 
relies on maven 3.0.4, which is only packaged in old-stable. Jessie packages 
version 3.0.5, and testing/unstable has 3.3.9. There are many breaking changes 
between Maven 3.0.4 and 3.3.9.

Maven 3.0.4 poses two problems: first, it is affected by a medium-severity 
CVE[1] and should be patched to 3.0.5. Second, it relies on an old version of 
Aether under org.sonotype. Aether moved from being maintained by Sonotype to 
being maintained by Eclipse in 2012, and then Eclipse archived the Aether 
project in 2016. The Aether changes are why pomegranate does not work against 
Maven 3.3.9; many classes have been renamed, refactored, and moved. The most 
recent Maven release, 3.5.0, covers the migration of the Aether code directly 
into the Maven project.[2] It was released very recently, at the beginning of 
April.

I see there's been some community effort to migrate pomegranate to Maven 3.3.9, 
but it has not yet succeeded.[3] I took a look at doing that last night, and it 
turns out to be quite complex. Hence, I see the following possible paths 
forward:

- Upgrade upstream (whether that involves changes in pomegranate or directly in 
  leiningen) to use Maven 3.5.0, and wait for Maven 3.5.0 to be packaged for 
  unstable.
- Upgrade upstream to use Maven 3.3.9.

I don't think that including a Maven 3.0.5 package just for leiningen is 
possible, and that would also just constitute a stopgap in my opinion.  
Upgrading to Maven 3.5.0 is, in my opinion, the best option, as 3.3.9 depends 
on orphaned versions of Aether.

Thoughts?

- e


[1]: https://maven.apache.org/security.html
[2]: https://maven.apache.org/docs/3.5.0/release-notes.html
[3]: https://github.com/cemerick/pomegranate/pull/80

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Elana Hashman]

Owner: Elana Hashman 


Hi all,

Phil has done a bunch of great work significantly reducing the 
dependency profile of leiningen, so I have updated all the blocking 
issues and we are down to 8.


Of those, two are addressed by packages sitting in NEW and I will have 
more to follow. I wrote a (janky, alpha) tool to assist in Clojure 
packaging, for anyone that might be interested: 
https://github.com/ehashman/clj-helper


I just got added to the Debian Java and Debian Clojure packaging groups 
so I should be able to start working on some of the version upgrades as 
well.


ChangZhuo, I'm going to claim this bug since I haven't heard anything 
from you in the last few months :)


- e

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Elana Hashman]

All the first-degree dependencies should now be marked as blocking. Now 
for some packaging...


There are a lot of deps and granddeps so if you're interested in helping 
out, please feel free to claim one (or many)!


- e

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Tom Marble]

Elana Hashman  writes:
> Should I also go ahead and file RFPs for the missing packages for 
> visibility?

Sure!

Thanks!

--Tom

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Elana Hashman]

On 2017-01-19 16:12, Tom Marble wrote:

I've created a new page on the Debian wiki for this purpose:
https://wiki.debian.org/Clojure/Leiningen


Thanks for the great work on the wiki page, Tom, Phil!


I've gone ahead and filed version upgrade requests as blocking this bug 
for all the packages identified on the wiki as needing upgrades to 
support leiningen 2.7.2.


Should I also go ahead and file RFPs for the missing packages for 
visibility?


- e

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Tom Marble]

Tom Marble  writes:
> Based on the fabulous work of ehashman and the help of technomancy
> I've made some minor reformatting of the "state of packaging leiningen"
> below.

As everyone knows leiningen is a special case package due
to it's signicance to the Clojure ecosystem. As such
it doesn't make sense to track the packaging work by
constantly updating this bug.

Therefore I've created a new page on the Debian wiki for this purpose:
https://wiki.debian.org/Clojure/Leiningen

Indeed I've created a entire tree to support Clojure work:
https://wiki.debian.org/Clojure

Which has been shameless cribbed from
https://wiki.debian.org/Java

Let's continue to collaborate with the Java team and
meet online in #debian-java

Regards,

--Tom

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Tom Marble]

Based on the fabulous work of ehashman and the help of technomancy
I've made some minor reformatting of the "state of packaging leiningen"
below. The biggest change is that I'm not calling out transitive
deps (on leiningen missing deps).

In terms of next steps

1. technomancy is already addressing the
   'deps with unstable-version > leiningen 2.7.2-SNAPSHOT'
   issues upstream.

2. We should probably start with 
   'deps with unstable-version < leiningen 2.7.2-SNAPSHOT'

3. Then the big work is on missing deps (which will be recursive :)
   NOTE: I had some packaging on alioth for some of these
   which probably can be reprised.

Question on java/clojure policy.. should names with a dot
be converted to a dash?
  Does [org.clojure/tools.nrepl "0.2.12"]
  want to be libtools.nrepl-clojure or libtools-nrepl-clojure ?
 (my guess is the latter)???

Regards,

--Tom

** deps with unstable-version == leiningen 2.7.2-SNAPSHOT
*** [org.clojure/data.xml "0.0.8"]
unstable: https://packages.debian.org/sid/libdata-xml-clojure
leiningen: https://github.com/technomancy/leiningen/blob/master/project.clj#L10
*** [commons-io "2.5"]
unstable: https://packages.debian.org/sid/libcommons-io-java 
leiningen: https://github.com/technomancy/leiningen/blob/master/project.clj#L11 
 
*** [clojure-complete "0.2.4"]
unstable: https://packages.debian.org/sid/libcomplete-clojure
leiningen: https://github.com/technomancy/leiningen/blob/master/project.clj#L17
NOTE: check for old packaging on alioth
*** [robert/hooke "1.3.0"]
unstable: https://packages.debian.org/sid/librobert-hooke-clojure
leiningen: 
https://github.com/technomancy/leiningen/blob/master/leiningen-core/project.clj#L9
 
*** [org.tcrawley/dynapath "0.2.5"]
unstable: https://packages.debian.org/sid/libdynapath-clojure
leiningen: 
https://github.com/technomancy/leiningen/blob/master/leiningen-core/project.clj#L11
*** [org.apache.maven.wagon/wagon-http "2.10"]
unstable: https://packages.debian.org/sid/libwagon2-java
leiningen: 
https://github.com/technomancy/leiningen/blob/master/leiningen-core/project.clj#L12
 
*** [com.hypirion/io "0.3.1"]
unstable: https://packages.debian.org/sid/libcom-hypirion-io-clojure
leiningen: 
https://github.com/technomancy/leiningen/blob/master/leiningen-core/project.clj#L13
NOTE: check for old packaging on alioth

** deps with unstable-version < leiningen 2.7.2-SNAPSHOT
*** [slingshot "0.12.2"]
unstable: 0.10.3 https://packages.debian.org/sid/libslingshot-clojure
leiningen: https://github.com/technomancy/leiningen/blob/master/project.clj#L19
NOTE: check for old packaging on alioth
*** [bultitude "0.2.8"]
unstable: 0.2.7 https://packages.debian.org/sid/libbultitude-clojure
leiningen: 
https://github.com/technomancy/leiningen/blob/master/leiningen-core/project.clj#L7
 
*** [com.cemerick/pomegranate "0.3.1"]
unstable: 0.2.0 https://packages.debian.org/sid/libpomegranate-clojure
leiningen: 
https://github.com/technomancy/leiningen/blob/master/leiningen-core/project.clj#L12

** deps with unstable-version > leiningen 2.7.2-SNAPSHOT
*** [org.clojure/tools.macro "0.1.2"]
unstable: 0.1.5 https://packages.debian.org/sid/libtools-macro-clojure
leiningen: 0.1.2 
https://github.com/technomancy/leiningen/blob/master/test_projects/sample-profile-meta/project.clj#L10
*** [commons-codec "1.6"]
unstable: 1.10 https://packages.debian.org/sid/libcommons-codec-java
leiningen: 
./test_projects/managed-deps-snapshot/project.clj
./test_projects/managed-deps/project.clj
*** [clj-stacktrace "0.2.4"]
unstable: 0.2.6 https://packages.debian.org/sid/libclj-stacktrace-clojure
leiningen: 
./resources/leiningen/help/project.clj: :dependencies [[clj-stacktrace 
"0.2.4"]]}
3:17 < tmarble> technomancy: we have [clj-stacktrace "0.2.6"] 
https://packages.debian.org/sid/libclj-stacktrace-clojure
13:17 < tmarble> but you have ./resources/leiningen/help/project.clj: 
:dependencies [[clj-stacktrace "0.2.4"]]}
13:17 < tmarble> ... can that be bumped?
13:22 < technomancy> tmarble: that file is help text, not an actual project.clj 
=)
13:22 < tmarble> nvm :)

** deps missing from leiningen 2.7.2-SNAPSHOT
*** [clj-http "2.0.1"]
unstable: https://packages.debian.org/sid/libclj-http-clojure
leiningen: https://github.com/technomancy/leiningen/blob/master/project.clj#L21
NOTE:  [clj-http "2.0.1"]
[commons-codec "1.10" :exclusions [[org.clojure/clojure]]]
[org.apache.httpcomponents/httpclient "4.5" :exclusions 
*** [org.clojure/tools.nrepl "0.2.12"]
unstable: https://packages.debian.org/sid/libtools.nrepl-clojure
leiningen: https://github.com/technomancy/leiningen/blob/master/project.clj#L16
*** [cheshire "5.6.3"]
unstable: https://packages.debian.org/sid/libcheshire-clojure
leiningen: https://github.com/technomancy/leiningen/blob/master/project.clj#L20
*** [classlojure "0.6.6"]
unstable: https://packages.debian.org/sid/libclasslojure-clojure
leiningen: 
https://github.com/technomancy/leiningen/blob/master/leiningen-core/project.clj#L8
*** [pedantic "0.2.0"]
unstable: 

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Phil Hagelberg]

> I understand this probably goes against some policies, but I would urge
> you to consider removing the search task if including it would add a
> significant burden to the job of packaging. If it would help, I will
> include a deprecation notice in version 2.7.2 of Leiningen recommending
> against the use of the search task.

Upon further reflection, I think it should probably be removed from
upstream as well. Sorry for the confusion.

Further discussion on the upstream issue tracker:

  https://github.com/technomancy/leiningen/pull/2234

Hope this makes the packaging job easier.


signature.asc
Description: PGP signature

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Phil Hagelberg]

Elana Hashman  writes:

> Finally following up with some conversations I had at Clojure/conj, I'd 
> like to help get the ball rolling on this again. Based on leiningen 
> 2.7.1's dependencies, here's what we'll need to package/upgrade to make 
> this happen.

Very exciting; thanks!

> Packages that have a higher version in Debian unstable than in leiningen 
> 2.7.1:
>
> libdynapath-clojure aka org.tcrawley/dynapath (2.5.1 > 2.4.1)
> libmaven-indexer-java aka org.apache.maven.indexer/indexer-core (5.1.1 > 
> 4.1.3)
> libcommons-io-java aka commons-io (2.5 > 2.4)

For the record, the versions of both dynapath and commons-io in the
current git version of Leiningen (2.7.2-SNAPSHOT) match those in Debian
unstable.

The indexer is another story. It is use to support the `search' task,
but I really regret leaving that in Leiningen 2.x and am strongly
considering adding a warning not to use it. Since it was originally
introduced the indices it has to download have gotten so large as to be
quite impractical, and users are nearly always better off performing a
search in a web browser against an online index vs downloading their own
copy of the indices.

I understand this probably goes against some policies, but I would urge
you to consider removing the search task if including it would add a
significant burden to the job of packaging. If it would help, I will
include a deprecation notice in version 2.7.2 of Leiningen recommending
against the use of the search task.

Though obviously in most cases diverging from upstream in a situation
like this is a bad idea, the search task is *never* used in an automated
context; if it breaks it will not affect the builds of other projects
which use Leiningen. In addition, in the past three years the only time
anyone has mentioned the search task to me on IRC or elsewhere has been
to ask why it isn't working well and whether it's really going to take
as many hours as it claims to download the rest of the indices. My
suspicion is that the number of users who have the patience to wait for
the indices to actually download (vs switching to a browser and having
the search results displayed immediately) is in the low double digits.

If this is not acceptable then I will bump the version of Maven Indexer
used in Leiningen 2.7.2 to match the version in Debian.

-Phil


signature.asc
Description: PGP signature

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Tom Marble]

Elana Hashman  writes:
> Finally following up with some conversations I had at Clojure/conj, I'd 
> like to help get the ball rolling on this again. Based on leiningen 
> 2.7.1's dependencies, here's what we'll need to package/upgrade to make 
> this happen.

Awesome, thank you!!!

I've added technomancy on Bcc: as he dropped into #debian-java a while
back asking how he could help.

Here's the link to this bug (and the rest of the context):
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819811

FWIW I'd also like to see boot packaged... Last time I checked, though,
boot has a build dep on leiningen.

Regards,

--Tom

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Elana Hashman]

Hello!

Finally following up with some conversations I had at Clojure/conj, I'd 
like to help get the ball rolling on this again. Based on leiningen 
2.7.1's dependencies, here's what we'll need to package/upgrade to make 
this happen.



Packages that have a higher version in Debian unstable than in leiningen 
2.7.1:


libdynapath-clojure aka org.tcrawley/dynapath (2.5.1 > 2.4.1)
libmaven-indexer-java aka org.apache.maven.indexer/indexer-core (5.1.1 > 
4.1.3)

libcommons-io-java aka commons-io (2.5 > 2.4)

All but libmaven-indexer-java have been upgraded to the correct versions 
on upstream leiningen master. I've submitted a pull request to upgrade 
that dependency: https://github.com/technomancy/leiningen/pull/2234



Packages that are in Debian with the right versions:

librobert-hooke-clojure aka robert/hooke (1.3.0)
libwagon2-java aka org.apache.maven.wagon/wagon-http (2.10)
libcom-hypirion-io-clojure aka com.hypirion/io (0.3.1)
libdata-xml-clojure aka org.clojure/data.xml (0.0.8)
libcomplete-clojure aka clojure-complete (0.2.4)


Packages that are in Debian, but need updates:

libbultitude-clojure aka bultitude (0.2.7 < 0.2.8)
libpomegranate-clojure aka com.cemerick/pomegranate (0.2.0 < 0.3.1)
libslingshot-clojure aka slingshot (0.10.3 < 0.12.2)


Here's the full dependency chains of all the missing packages (per `lein 
deps :tree`):


 [cheshire "5.6.3"]
   [com.fasterxml.jackson.core/jackson-core "2.7.5"]
   [com.fasterxml.jackson.dataformat/jackson-dataformat-cbor "2.7.5"]
   [com.fasterxml.jackson.dataformat/jackson-dataformat-smile "2.7.5"]
   [tigris "0.1.1"]
 [classlojure "0.6.6"]
   [useful "0.8.3-alpha8"]
 [org.clojure/tools.macro "0.1.1"]
 [clj-http "2.0.1"]
   [commons-codec "1.10" :exclusions [[org.clojure/clojure]]]
   [org.apache.httpcomponents/httpclient "4.5" :exclusions 
[[org.clojure/clojure]]]
   [org.apache.httpcomponents/httpcore "4.4.1" :exclusions 
[[org.clojure/clojure]]]
   [org.apache.httpcomponents/httpmime "4.5" :exclusions 
[[org.clojure/clojure]]]

   [potemkin "0.4.1" :exclusions [[org.clojure/clojure]]]
 [clj-tuple "0.2.2"]
 [riddley "0.1.10"]
 [pedantic "0.2.0"]
 [net.cgrand/parsley "0.9.3" :exclusions [[org.clojure/clojure]]]
   [net.cgrand/regex "1.1.0"]
 [org.clojure/tools.nrepl "0.2.12"]
 [reply "0.3.7" :exclusions [[ring/ring-core] [org.thnetos/cd-client]]]
   [clj-stacktrace "0.2.7"]
   [com.cemerick/drawbridge "0.0.6" :exclusions 
[[org.clojure/tools.nrepl]]]

   [jline "2.12.1"]
   [net.cgrand/sjacket "0.1.1" :exclusions [[org.clojure/clojure]]]
   [org.clojure/tools.cli "0.3.1"]
   [trptcolin/versioneer "0.1.1"]
 [stencil "0.5.0" :exclusions [[org.clojure/core.cache]]]
   [quoin "0.1.2"]
   [scout "0.1.0"]


To make that slightly more legible, here are the (grand-)dependencies we 
need in Debian:


libtools-macro-clojure (0.1.5 > 0.1.1)
libcommons-codec-java (1.10)
libhttpclient-java (4.5)
libhttpcore-java (4.4.6 > 4.4.1)
libhttpmime-java (4.5.2 > 4.5)
libversioneer-clojure (0.1.1)
libscout-clojure (0.1.1 > 0.1.0)


Here are the ones that are in Debian but need upgrades:

libclj-stacktrace-clojure (0.2.6 < 0.2.7)
libtools-cli-clojure (0.2.4 < 0.3.1)
libjline2-java (2.11 < 2.12.1)


And last, here are all the missing ones, preserving dependency chains:

 [cheshire "5.6.3"]
   [com.fasterxml.jackson.core/jackson-core "2.7.5"]
   [com.fasterxml.jackson.dataformat/jackson-dataformat-cbor "2.7.5"]
   [com.fasterxml.jackson.dataformat/jackson-dataformat-smile "2.7.5"]
   [tigris "0.1.1"]

 [classlojure "0.6.6"]
   [useful "0.8.3-alpha8"]

 [clj-http "2.0.1"]
   [potemkin "0.4.1" :exclusions [[org.clojure/clojure]]]
 [clj-tuple "0.2.2"]
 [riddley "0.1.10"]

 [pedantic "0.2.0"]

 [net.cgrand/parsley "0.9.3" :exclusions [[org.clojure/clojure]]]
   [net.cgrand/regex "1.1.0"]

 [org.clojure/tools.nrepl "0.2.12"]

 [reply "0.3.7" :exclusions [[ring/ring-core] [org.thnetos/cd-client]]]
   [com.cemerick/drawbridge "0.0.6" :exclusions 
[[org.clojure/tools.nrepl]]]

   [net.cgrand/sjacket "0.1.1" :exclusions [[org.clojure/clojure]]]

 [stencil "0.5.0" :exclusions [[org.clojure/core.cache]]]
   [quoin "0.1.2"]


Hope everyone finds this helpful.

- e

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Mathieu Parent]

On Sat, 2 Apr 2016 23:06:58 +0800 ChangZhuo Chen
=?utf-8?B?KOmZs+aYjOWArCk=?=  wrote:
[...]
> * Package name: leiningen
[...]
> The package was once in Debian, and I plan to bring it back.

Hello ChangZhuoChen,

Any new on this?

I don't know anything about Clojure and Leiningen, but I'm waiting for
it for puppetserver and puppetdb.

Regards

Mathieu Parent

Bug#819811: ITP: leiningen -- simple build system for Clojure

[陳昌倬]

On Sun, Apr 03, 2016 at 02:52:52PM +0800, Paul Wise wrote:
> Please note the additional steps required when reintroducing packages
> that were in Debian before:
> 
> https://www.debian.org/doc/manuals/developers-reference/pkgs.html#reintroducing-pkgs


Thanks for the hint.

Look like the package was removed due to change between 1.7.x and 2.x,
and the missing dependency clojure-1.6. I will see if all dependencies
are ready now.



[Date: Tue, 16 Sep 2014 10:46:40 +] [ftpmaster: Scott Kitterman]
Removed the following packages from unstable:

 leiningen |1.7.1-2 | source, all
 Closed bugs: 761305

 --- Reason ---
 RoM; obsolete; request from upstream
 --
 Also closing bug(s): 699532

-- 
ChangZhuo Chen (陳昌倬) 
Debian Developer (https://nm.debian.org/public/person/czchen)
Key fingerprint = EC9F 905D 866D BE46 A896  C827 BE0C 9242 03F4 552D
  BA04 346D C2E1 FE63 C790  8793 CC65 B0CD EC27 5D5B


signature.asc
Description: PGP signature

Bug#819811: ITP: leiningen -- simple build system for Clojure

[Paul Wise]

On Sat, Apr 2, 2016 at 11:06 PM, ChangZhuo Chen wrote:

> The package was once in Debian, and I plan to bring it back.
>
> [0] https://tracker.debian.org/pkg/leiningen

Please note the additional steps required when reintroducing packages
that were in Debian before:

https://www.debian.org/doc/manuals/developers-reference/pkgs.html#reintroducing-pkgs

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

Bug#819811: ITP: leiningen -- simple build system for Clojure

[陳昌倬]

Package: wnpp
Severity: wishlist
Owner: "ChangZhuo Chen (陳昌倬)" 

* Package name: leiningen
  Version : 2.6.1
  Upstream Author : Phil Hagelberg, Alex Osborne, Dan Larkin,
* URL : https://github.com/technomancy/leiningen
* License : EPL-1.0
  Programming Lang: Clojure
  Description : simple build system for Clojure

 Working on Clojure projects with tools designed for Java can be an
 exercise in frustration. With Leiningen, you describe your build with
 Clojure. Leiningen handles fetching dependencies, running tests, packaging
 your projects and can be easily extended with a number of plugins.


The package was once in Debian, and I plan to bring it back.

[0] https://tracker.debian.org/pkg/leiningen

-- 
ChangZhuo Chen (陳昌倬) 
Debian Developer (https://nm.debian.org/public/person/czchen)
Key fingerprint = EC9F 905D 866D BE46 A896  C827 BE0C 9242 03F4 552D
  BA04 346D C2E1 FE63 C790  8793 CC65 B0CD EC27 5D5B


signature.asc
Description: PGP signature