[IdPv3] Packaging Java code for Linux Package Managers

[Peter Schober]

* Chad La Joie <lajoie at itumi.biz> [2011-11-03 12:38]:
> We can not use the "standard" Unix filesystem layout.  There are two
> main problems that I see in attempting to do so.  It would be
> impossible to install different IdP versions at the same time because
> you'd end up with different lib versions being installed in the same
> directory and thus on the classpath together.  That is going to be
> very problematic for people who do IdP hosting.

I don't think IdP hosting should be the target and I don't think
people hosting several IdPs will be the primary users of IdP packages.

> Second, the unit of management within Java (at least for our
> webapps) is the WAR, which includes libraries (which presumably
> would be expected to go in to /usr/lib somewhere) as well as various
> other files (e.g., images, text files like CSSs, conf files like
> web.xml).  Those other things really shouldn't go in the /usr/lib
> directory but do need to be in the same directory structure as the
> libs in order to be deployed.  In short, the Java environment makes
> assumption that are different than the ones the Linux environment
> makes.

Waiting for Russ to comment, since he authored
http://dep.debian.net/deps/dep7/
last year.
I also faintly recall Quanah (and possibly later on Russ, leading to
the above proposal?) trying to package the Shib IdP for Debian.

Either way, I doubt getting the IdP in shape according to the
distribution policies is possible with reasonable resources.
E.g. from http://fedoraproject.org/wiki/Packaging:Java

  Many Java projects re-ship their dependencies in their own
  releases. This is unacceptable in Fedora. All packages MUST be built
  from source and MUST enumerate their dependencies with
  Requires. They MUST NOT build against or re-ship the pre-included
  JAR files but instead symlink out to the JAR files provided by
  dependencies.

Which, among other things, means you can't update some of the IdP's
dependencies since they're provided by a different package, unlikely
to change outside a security issue.
-peter