Stewardship SIG Report (August 2019)
Whoop, this report is a bit late, but I still want to give a summary of what the Stewardship SIG has been up to in August. TL;DR: We reduced the number of outdated packages from about 55% to about 45% and introduced some changes to limit the number of packages that we’re going to have to maintain in the future.
We started by removing some unused functionality from a few packages (especially dropping the dependency on the Spring framework, which was removed from fedora at the beginning of August due to it failing to build from source since fedora 29.
|google-guice||4.1||16.fc31||disable support for spring and JPA|
|snakeyaml||1.17||9.fc31||drop spring dependency|
|xbean||4.9||5.fc31||drop spring and groovy support|
We also started working on getting some packages updated to the latest versions. Most of our packages haven’t been touched since 2017, so there’s a lot of outstanding new releases pending, and this is only a small start.
|ant||1.10.6||1.fc31||1.10.5 → 1.10.6|
|jna||5.4.0||1.fc31||4.5.1 → 5.4.0|
|apache-logging-parent||2||1.fc31||1 → 2|
|apache-mime4j||0.8.3||1.fc31||0.8.1 → 0.8.3|
|apache-rat||0.13||1.fc31||0.12 → 0.13|
|bean-validation-api||2.0.1||1.fc31||1.1.0 → 2.0.1|
|woodstox-core||5.2.1||1.fc31||5.0.3 → 5.2.1|
|plexus-io||3.1.1||1.fc31||3.0.0 → 3.1.1|
|google-guice||4.2.2||1.fc31||4.1 → 4.2.2|
Meeting in person at flock in Budapest, we also finally decided that we couldn’t
continue maintaining Gradle and the build system support for it any longer due
to numerous issues (including Gradle failing to build since fedora 30, the
package being massively outdated, and newer versions requiring even more yet
unpackaged dependencies). So we dropped support for builind packages with
Gradle from both
javapackages-tools for fedora 31 and later.
Maintainers of packages that get built with Gradle will have to adapt (it’s usually possible to convert builds to use Maven instead, which is already the way it works for some existing fedora packages).
|xmvn||3.0.0||25.fc31||disabled support for gradle|
|javapackages-tools||5.3.0||6.fc31||disabled support for gradle|
Then we pushed some more changes to packages to remove additional dependencies, so we don’t have to keep adopting more and more packages to keep things working. We made sure to only remove functionality that wasn’t in use in other fedora packages.
|apache-commons-compress||1.18||6.fc32, 6.fc31||drop powermock dependency|
|bsf||2.4.0||34.fc32, 34.fc31||removed rhino dependency|
|apache-ivy||2.4.0||18.fc32, 18.fc31||disable ssh, bouncycastle, and vfs support|
Then started a second round of version updates, which brought the percentage of outdated packages to below 50% (which is progress).
|jboss-annotations-1.2-api||1.0.2||1.fc32, 1.fc31||1.0.0 → 1.0.2|
|jboss-connector-1.7-api||1.0.1||1.fc32, 1.fc31||1.0.0 → 1.0.1|
|jboss-el-2.2-api||1.0.5||1.fc32, 1.fc31||1.0.2 → 1.0.5|
|plexus-archiver||4.1.0||1.fc32, 1.fc31||3.6.0 → 4.1.0|
|maven-archiver||3.4.0||1.fc32, 1.fc31||3.2.0 → 3.4.0|
|maven-assembly-plugin||3.1.1||1.fc32, 1.fc31||3.1.0 → 3.1.1|
We also updated
flex to the latest version and pushed a patch to adapt
to these changes.
|jflex||1.7.0||1.fc32, 1.fc31||1.6.1 → 1.7.0|
|qdox||2.0||6.M9.fc32, 6.M9.fc31||port to jflex 1.7.0|
A third round of easy version updates followed, where we still pushed our changes to both rawhide and the pre-beta fedora 31 branch.
|maven-dependency-analyzer||1.11.1||1.fc32, 1.fc31||1.10 → 1.11.1|
|maven-shade-plugin||3.2.1||1.fc32, 1.fc31||3.1.1 → 3.2.1|
|modello||1.10.0||1.fc32, 1.fc31||1.9.1 → 1.10.0|
|plexus-containers||2.0.0||1.fc32, 1.fc31||1.7.1 → 2.0.0|
|plexus-compiler||2.8.5||1.fc32, 1.fc31||2.8.2 → 2.8.5|
|plexus-components-pom||4.0||1.fc32, 1.fc31||1.3.1 → 4.0|
|xbean||4.14||1.fc32, 1.fc31||4.9 → 4.14|
|felix-utils||1.11.2||1.fc32, 1.fc31||1.10.4 → 1.11.2|
In preparation for other updates we worked to update
xmlunit to the latest
major version, and pushed a patch for
xmvn to adapt to this new version.
|xmlunit||2.6.3||1.fc32, 1.fc31||1.6 → 2.6.3|
|xmvn||3.0.0||26.fc32, 26.fc31||port to xmlunit 2|
We also updated
snakeyaml to the latest version, which contained some minor
changes in API. I pushed a patch for
jruby to adapt to these changes. No other
packages were affected.
|snakeyaml||1.25||1.fc32, 1.fc31||1.17 → 1.25|
|jruby||1.7.22||10.fc32, 10.fc31||port to snakeyaml 1.20+|
Last, we disabled some more unused features in two packages to make sure we don’t depend on packages that are going to be removed due to the 6-week-orphan retirement process.
|httpcomponents-client||4.5.7||3.fc32, 3.fc31||disable memcached and ehcache support|
|maven-wagon||3.3.3||3.fc32, 3.fc31||disable SSH support|