Unlock opensaml-parent ?

[Cantor, Scott]

On 10/23/15, 12:45 PM, "dev on behalf of Ian Young" <dev-bounces at shibboleth.net on behalf of ian at iay.org.uk> wrote:

>
>> On 23 Oct 2015, at 17:30, Tom Zeller <tzeller at dragonacea.biz> wrote:
>> 
>> 
>>> On Oct 23, 2015, at 6:11 AM, Ian Young <ian at iay.org.uk> wrote:
>>> 
>>> I don't see that buying us anything in general. What do you see as the benefit of such a requirement?
>> 
>> Consistency ? Weakly stated, though.
>
>Consistency in the parent POM across components is not in itself a benefit, so you're just restating the outcome. I'm asking what concrete benefit you think results from the particular kind of consistency you're proposing.

I don't know if I would agree that consistency isn't itself a benefit in a complex software environment with a lot of pieces.

>>Okay, I’m remembering what we said on the call better now. And how do we define “functional” changes ? Quickly and offhand, I would say : ultimately it boils down to the versions of the artifacts we ship in WEB-INF/lib.
>
>Is the concern that you don't think we'll ship the most recent dependency artifacts unless we rebuild the whole stack? Have you done the obvious experiment?

For me, there's kind of a basic discomfort with the lack of library versioning in Java. The fact that we might have opensaml depending on dependency.jar vX and the IdP also depending on dependency.jar but vY always makes me leery.

This was something I hit with SWF. They didn't rev their POM to reflect the change to Spring 4.1 or whichever it was, and I thought that was a problem. But that's just how it works. Everything's transitive and somehow things don't blow up. I'm just not sure why, and I'm pretty sure it's situational and depending on some luck.

-- Scott