How to package Nuxeo DM, a Java EE application, in Ubuntu?

[Stefane Fermigier]

On Feb 3, 2011, at 4:13 PM, Scott Howard wrote:

> Hello,
> 
> On Wed, Feb 2, 2011 at 8:25 AM, Stefane Fermigier <sf at nuxeo.com> wrote:
>> Here are some thoughts and questions about how to package a Java EE
>> application so that it can be accepted in partner.
>> We have packages that have been created a few months ago, and would be
>> really pleased if they could be included in Natty, so your help would be
>> really appreciated.
>>   S.
> 
> Thanks for wanting to contribute to Ubuntu!
> 
> First, if your project is LGPL, you are eligible for Debian Main and
> Ubuntu Universe (and possibly Ubuntu main),

We would be happy to, in the longer term.

> both of which have more
> visibility and easier use than Partner. Usually "Partner" is for
> companies that have closed-source code but want to work with Canonical
> to distribute their programs.

Given that we anticipated some of the objections that have been raised, we initially wanted to target the "partner" repo to get things moving fast. We're not closed-source, but if it can get our packages faster in the hands of Ubuntu users, we would be glad to act as if we were so.

> The problem, as you know, are the 200
> prepackaged jars - if any of them are not DFSG free, then your package
> is contrib/multiverse - and if any of them prevent redistribution,
> then we can't touch your project with those jars at all.

We're an open source project. Of course all our dependencies are open source (and DFSG compliant).

But we don't expect to people taking our word for granted. We can provide a spreadsheet of all the dependencies and their license, so that anyone can check that this is really the case.

> The most common path to getting a package into Ubuntu is to get it
> into Debian. Ubuntu then automatically syncs your package into Ubuntu.
> However, right now Debian's repositories are frozen and their queue
> for new packages is quite long, so it probably won't get packaged and
> through the queue in time for Natty.

Since speed was an issue, we didn't want to got this route, initially.

> You also can upload directly to
> Ubuntu's repositories, and link [1] describes the process.

Whatever is the fastest, although in the long term we would be happier if there were Debian packages for Nuxeo because of the additional reach.

> 
> It's probably best if you coordinate with the debian-java team
> <debian-java at lists.debian.org>, who will be able to review and upload
> your packages. Also see the debian java policy (which also applies to
> Ubuntu [2]).

I will.

> I have some experience with debian-java, so I can comment on your two points:
> 
> 1) your have to use the ubuntu/debian Tomcat, but a script to set up a
> custom instance could be possible as long as it doesn't cause problems
> with other parts of the system (other tomcat instances, for example).

As I said, this is a problem for us. We can try to work around this issue in the longer term, but this will take additional engineering resources on our side.

> 2) The main Debian and Ubuntu archives will never allow prepackaged
> jars to be distributed for security reasons (we don't know what
> actually is in there) and legal reasons (we don't know what license
> each part of the code is).

That's part of the reason we were targeting "partners", initially.

> This could be a reason why you would want
> to distribute your code in the "Partner" repository, but that process
> is a little more opaque - someone else might be able to explain that
> process.

Please (someone else) do, as all we've been told is to write this email to the ubuntu-devel mailing list and try to work things out.

> For "traditional" packages, however, you really should
> discuss this with the debian-java team. They have volunteers who might
> be interested in helping you get some of those packages into Debian
> (and thus Ubuntu), although 200 RFP/ITP bugs and packages in the NEW
> queue is a bit intimidating

As I said, it's not just about "getting 200 java packages in the distrib", but "getting 200 java package *with the exact version number we know works for Nuxeo in the distrib."

> - and if anyone one of them has legal
> problems (e.g. license incompatibilities) or technical problems (e.g.
> not-sane build systems, missing source code), that would hold up the
> whole packaging effort. Is there a "distribution" that has the source
> code and builds all those third party libraries?

All these jars (except for a few we've had to patch and rebuild ourselves) are from the main public open source jar repository, repo1.maven.org. I don't know how this repository is built, except that it's by the Apache Foundation.

> We could then package
> that distribution as a source package and each of the libraries as a
> separate binary packages (also requiring a lot of work, but javahelper
> [3] could help in that situation). It is possible to package different
> versions of the same java library in Debian/Ubuntu (see [2]), but you
> must use a version that is in Debian/Ubuntu.

As I said, it's a lot of work.

> In conclusion: it appears that it would be a lot of work to get the
> package in Ubuntu the traditional way, and you should really discuss
> this with the debian-java team. However, the "Partner" way could work
> for you - but I don't know how to start that process.

The persons managing the "partner" repo asked me to contact this list, so I feel a bit like a dog chasing his own tail here :(

  S.

-- 
Stefane Fermigier, Founder and Chairman, Nuxeo
Open Source, Java EE based, Enterprise Content Management (ECM)
http://www.nuxeo.com/ - +33 1 40 33 79 87 - http://twitter.com/sfermigier
Join the Nuxeo Group on LinkedIn: http://linkedin.com/groups?gid=43314
New Nuxeo release: http://nuxeo.com/dm54
"There's no such thing as can't. You always have a choice."