Co-bundling Jetty ?

[Cantor, Scott]

On 9/11/13 11:48 AM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>I am interested in feedback regarding co-bundling Jetty[1]. Do you
>like that idea ? alternatives ?

As a deployer I don't like the idea (hate would probably be closer), but
as a project member, I'm fully supportive of the goal, if unclear on the
practicality of it.

I have been on record as hesitant that making it part of V3 scope is
necessarily wise, let alone required, but that really depends on the
effort.

>The basic idea, as I see it, is to provide jetty-distribution as a
>versioned and unpacked dependency.

One of my concerns about it is that it creates a requirement on the
project to do frequent upgrades of the IdP to address Jetty releases that
have critical fixes. We are on record as wanting to do more
frequent/regular updates anyway, so my concerns are probably more broadly
just about where the resources to do those updates will be coming from.

>I understand that there will be a range of deployment strategies,
>maybe custom is the most common.

I think the opposite will be the outcome, which is one reason it's
troubling to me. It really means trying to make everything work with the
bundle no matter how complex or you end up turning people off.

>The idea of providing a v2 package with a co-bundled Jetty is
>interesting to me for the purposes of generating feedback, I like
>making decisions based on data. Maybe the upgrade path from v2 to v3
>would be made easier with an incremental step. Maybe not.

I think not in general but strongly agree that experimenting with the
packaging on V2 is a useful step. But again it's time that concerns me.

A key issue for me: I think setuid is essentially mandatory for this, and
the setuid extension in Jetty requires a native library. That greatly
complicates things.

-- Scott