Problems with the Apache Maven package

arch_anon_x · 2024-01-04 17:09:09

Hi,
Today I noticed some weird things about the Maven package:

Its version is 3.8.7. If you look at the official release history you will notce some stuff:
Two versions that are kept alive is the current 3.9.6 and LTSy 3.8.8, which requires just Java 7.
The version in the repos is from late 2022, so its outdated and has been flagged out of date some time after 3.8.8 was released.

Also, pacman -Qi shows that the package needs java-environment>=8, when the upstream claims that it's 7 not 8.

user@host $ pacman -Si maven
Repository      : extra
Name            : maven
Version         : 3.8.7-1
Description     : Java project management and project comprehension tool
Architecture    : any
URL             : https://maven.apache.org
Licenses        : APACHE
Groups          : None
Provides        : None
Depends On      : java-environment>=8  bash  procps-ng
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 7,66 MiB
Installed Size  : 9,27 MiB
Packager        : Antonio Rojas <arojas@archlinux.org>
Build Date      : pon, 16 sty 2023, 20:43:19
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Can anyone please fix this or tell me how to do it myself?

Kind regards

Lone_Wolf · 2024-01-04 18:44:45

arch_anon_x wrote:

Also, pacman -Qi shows that the package needs java-environment>=8, when the upstream claims that it's 7 not 8.

https://wiki.archlinux.org/title/Java# wrote:

Arch Linux officially supports the open source OpenJDK versions 8, 11, 17 and 21. All these JVM can be installed without conflict and switched between using helper script archlinux-java. Several other Java environments are available in AUR but are not officially supported.

Packages from official repos are not allowed to depend on aur packages, so depending on java 8 is the closest we can get to upstream requirement for this version.

to build your own version :

https://gitlab.archlinux.org/archlinux/ … ages/maven , use git clone to download the necessary files to your system.

make necessary adjustments (minimum needed is increasing the pkgver var in the PKGBUILD) , build with makepkg and test.

If you have no prior experience with building/packaging on archlinux you'll have to do a lot of reading.
Start with https://wiki.archlinux.org/title/Arch_build_system and the related articles.

If you need more help consider creating a thread in the Creating & Modifying Packages sub-board.

Welcome to archlinux forums.

Last edited by Lone_Wolf (2024-01-04 18:45:39)

arch_anon_x · 2024-01-04 18:54:12

https://wiki.archlinux.org/title/Java# wrote:
Arch Linux officially supports the open source OpenJDK versions 8, 11, 17 and 21. All these JVM can be installed without conflict and switched between using helper script archlinux-java. Several other Java environments are available in AUR but are not officially supported.
Packages from official repos are not allowed to depend on aur packages, so depending on java 8 is the closest we can get to upstream requirement for this version.

Okay, this makes sense. I did not know about that.

to build your own version : ...

Do you suggest i compile the package locally or package it for everyone to use?

Welcome to archlinux forums.

Is this more like "welcome to the jungle (try not to get killed)" or "it's nice that you are here, welcome"?

Lone_Wolf · 2024-01-04 19:16:31

Do you suggest i compile the package locally or package it for everyone to use?

locally for now. Your results are likely to be valuable for the arch dev that maintains maven and hopefully make their task of updating easier, how to do that can be discussed later.

Welcome to archlinux forums.
Is this more like "welcome to the jungle (try not to get killed)" or "it's nice that you are here, welcome"?

I am a weird person with many quirks. One of those quirks is a willingness to use my skills & knowledge to help other people.
Your post triggered my interest and gave me an opportunity to help.
"Welcome to archlinux forums" is my way to express gratitude for that.

arch_anon_x · 2024-01-04 20:53:46

locally for now ...

Okay, thanks for clarifying that. I don't know if i will have time to do that soon but it at least seems interesting so I'll get to it in some time.

"Welcome to archlinux forums" is my way to express gratitude for that.

I did not expect this so it's good that I asked.

Anyway, thanks for the explanations and links.

arch_anon_x · 2024-01-26 21:56:19

I have managed to build 3.8.8, but I have two problems:
1. in the sha256sums, am I supossed to just put the sums of the files that I have downloaded there?
2. I need to build with skipping signature checking.

==> Verifying source file signatures with gpg...
    apache-maven-3.8.8-src.tar.gz ... FAILED (unknown public key 1A2A1C94BDE89688)

This key belongs to "Michael Osipov (Java developer) <1983-01-06@gmx.net>", as the KEYS file says.
However, the file from maven/keys/ does not match and I do not know which pubkey to put there.

Do you know how to figure this out @Lone_Wolf?

Last edited by arch_anon_x (2024-01-26 21:57:59)

Scimmia · 2024-01-26 21:58:17

https://wiki.archlinux.org/title/Makepk … e_checking

arch_anon_x · 2024-01-26 22:02:51

I have read this before and now and still do not know how to figure out which key belongs to this man.

EDIT: This helped.

Now 3.8.8 compiles and all is great. What do I do now?
How can I share the PKGBUILD?

Last edited by arch_anon_x (2024-01-26 22:10:10)

arch_anon_x · 2024-01-26 22:55:20

I have also tried to build 3.9.6, but it does not pass the sha512 integrity test (diff and cmp).
What is the protocol here?

Lone_Wolf · 2024-01-27 13:43:27

edit:

3.9.x
You did use the upstream sha512sum in https://downloads.apache.org/maven/mave … .gz.sha512 for verifying ?
the 3.9.x version seems to differ from 3.8.x substantially so may need more changes/testing and can wait for now.

End-of-edit

If you want the 3.8.8 version to be tested/looked at by forum users, post the PKGBUILD + maven.sh here.

Some archlinux devs do use this forum.
Incase they don't pick it and you're confident it works well up you should create a bugreport on https://gitlab.archlinux.org/archlinux/ … n/-/issues .

Last edited by Lone_Wolf (2024-01-27 13:44:23)

arch_anon_x · 2024-01-27 16:04:16

> If you want the 3.8.8 version to be tested/looked at by forum users, post the PKGBUILD + maven.sh here.

How do I post the tarball here?

> You did use the upstream sha512sum in https://downloads.apache.org/maven/mave … .gz.sha512 for verifying ?

I did not change the sha512sum command, so I think so.

Lone_Wolf · 2024-01-27 16:53:21

The software used to run our BBS predates markdown but does support BBCode . see https://bbs.archlinux.org/help.php#bbcode for what is possible.

The file containing the sha512 checksum is in a format that's not directly usable for the sha512sum command.
Copying the checksum in the sha512sums array of a PKGBUILD with https://dlcdn.apache.org/maven/maven-3/ … src.tar.gz in its source array, then running makepkg --nobuild does state the file has passed the check.

I'd say the file & checksum are correct.

arch_anon_x wrote:

> If you want the 3.8.8 version to be tested/looked at by forum users, post the PKGBUILD + maven.sh here.
How do I post the tarball here?

You can't attach files here, only link to any publicly availabe download location.

Since both files are (small) textfiles, there are alternatives :
- post their content in [ code ] [ /code ] blocks.
- upload the files to a pastebin service and post the links .

arch_anon_x · 2024-01-27 18:46:22

> The file containing the sha512 checksum is in a format that's not directly usable for the sha512sum command.

I know, that's what the printf and cat is for.

> I'd say the file & checksum are correct.
for 3.9.6??

Anyway, here's the PKGBUILD for maven 3.8.8 that works. I did not do anything with `maven.sh`

# Maintainer: Levente Polyak <anthraxx[at]archlinux[dot]org>
# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
# Contributor: William Rea <sillywilly@gmail.com>

pkgname=maven
pkgver=3.8.8
pkgrel=1
pkgdesc='Java project management and project comprehension tool'
url='https://maven.apache.org'
arch=('any')
license=('APACHE')
depends=('java-environment>=8' 'bash' 'procps-ng')
makedepends=('maven' 'java-environment=8')
backup=('opt/maven/conf/settings.xml')
source=(
  https://downloads.apache.org/maven/maven-3/${pkgver}/source/apache-maven-${pkgver}-src.tar.gz{,.asc}
  # both bin artifacts are only used for reproducible builds from source
  https://downloads.apache.org/maven/maven-3/${pkgver}/binaries/apache-maven-${pkgver}-bin.tar.gz{,.asc,.sha512}
  maven.sh
)
noextract=(apache-maven-${pkgver}-bin.tar.gz)
# https://downloads.apache.org/maven/KEYS
validpgpkeys=(
  '042B29E928995B9DB963C636C7CA19B7B620D787' # Stephen Connolly                <stephenc@apache.org>   [expires: never?    ]
  'AE9E53FC28FF2AB1012273D0BF1518E0160788A2' # Karl Heinz Marbaise (ASF Key)   <khmarbaise@apache.org> [expires: 2024-08-15]
  'BBE7232D7991050B54C8EA0ADC08637CA615D22C' # Enrico Olivelli                 <eolivelli@apache.org>  [expires: never?    ]
  'B02137D875D833D9B23392ECAE5A7FB608A0221C' # Robert Scholte                  <rfscholte@apache.org>  [expires: never?    ]
  '6A814B1F869C2BBEAB7CB7271A2A1C94BDE89688' # Michael Osipov (Java developer) <1983-01-06@gmx.net>    [expires: 2024-06-04]
)
sha256sums=(
  '224dbca28737d0b63a257f0a07c8ffae333a13cab837120dd15e773a357a0207' # apache-maven-${pkgver}-src.tar.gz
  'SKIP'                                                             # apache-maven-${pkgver}-src.tar.gz.asc
  '17811e108701af5985bf5167abbd47c06e92c6c6bd1c13a1a1c095c9b4ecc32a' # apache-maven-${pkgver}-bin.tar.gz
  'SKIP'                                                             # apache-maven-${pkgver}-bin.tar.gz.asc
  '4797a283980303b125f0a9a81ca9ba3c6a181a6ac571b980edb869e2a7d8715f' # apache-maven-${pkgver}-bin.tar.gz.sha512
  '17d9b8efa6a922907110026273443bcc8d83e061e14ac82cb5052b483acc9b76' # maven.sh
)

_buildnumber() {
  # use same build number as the binary dist but prove that our source build is
  # identical and therefor canonical in the build() step
  bsdtar xOf <(bsdtar xOf "${srcdir}/apache-maven-${pkgver}-bin.tar.gz" apache-maven-${pkgver}/lib/maven-core-${pkgver}.jar) \
    org/apache/maven/messages/build.properties | grep buildNumber | cut -d= -f2 | tr -cd '[:print:]'
}

build() {
  cd apache-maven-${pkgver}

  export PATH="/usr/lib/jvm/java-8-openjdk/bin:${PATH}"
  mvn package \
    -DbuildNumber="$(_buildnumber)" \
    -Dline.separator=$'\r\n' \
    -Dproject.build.sourceEncoding=UTF-8 -e \
    -Dmaven.repo.local="${srcdir}/repo" \
    -DskipTests

  # check reproducible builds result against upstream hashes. This way we can
  # prove that our source build is identical and therefor canonical so we are
  # technically free to use the static build number in our build env. On top we
  # ensure bit by bit identical upstream signed binary dist against our variant
  # via diff exiting non-successful on mismatch.
  sha512sum -c <(printf "$(cat ${srcdir}/apache-maven-${pkgver}-bin.tar.gz.sha512) apache-maven/target/apache-maven-${pkgver}-bin.tar.gz")
  diff "${srcdir}/apache-maven-${pkgver}-bin.tar.gz" apache-maven/target/apache-maven-${pkgver}-bin.tar.gz
}

check() {
  cd apache-maven-${pkgver}

  export PATH="/usr/lib/jvm/java-8-openjdk/bin:${PATH}"
  mvn test \
    -Dmaven.repo.local="${srcdir}/repo"
}

package() {
  cd apache-maven-${pkgver}

  install -Dm 755 ../maven.sh -t "${pkgdir}/etc/profile.d"

  install -d "${pkgdir}/opt/maven"
  bsdtar xf apache-maven/target/apache-maven-${pkgver}-bin.tar.gz \
    --strip-components=1 \
    -C "${pkgdir}/opt/maven"

  install -d "${pkgdir}/usr/bin"
  ln -s /opt/maven/bin/mvn "${pkgdir}/usr/bin/mvn"
  ln -s /opt/maven/bin/mvnDebug "${pkgdir}/usr/bin/mvnDebug"
}

# vim: ts=2 sw=2 et:

Lone_Wolf · 2024-01-28 12:06:25

about the keys of the apache maven devs : I used https://wiki.archlinux.org/title/GnuPG#Key_servers to use adifferent keyserver temporarily and found them on hkp://keyserver.ubuntu.com .

The key used for 3.9.6 is also found there, but isn't included in validpgpkeys array.

'29BEA2A645F2D6CED7FB12E02B172E3E156466E8' # "Tamas Cservenak (ASF) (Release key) <cstamas@apache.org>"

it's clearly from someone involved with apache, described as a release key and also included in https://downloads.apache.org/maven/KEYS .
Addding it as avalid key should be fine.

3.9.6 errrors at the end of the build so may need more work but 3.8.8 builds fine.

I suggest to test building some of the packages that have maven as makedep with the 3.8.8 to verify if there are issues.
maybe epubcheck & keycloak ?

Last edited by Lone_Wolf (2024-01-28 12:06:49)

arch_anon_x · 2024-01-30 10:06:18

Lone_Wolf wrote:

about the keys of the apache maven devs : I used https://wiki.archlinux.org/title/GnuPG#Key_servers to use adifferent keyserver temporarily and found them on hkp://keyserver.ubuntu.com .
The key used for 3.9.6 is also found there, but isn't included in validpgpkeys array.
'29BEA2A645F2D6CED7FB12E02B172E3E156466E8' # "Tamas Cservenak (ASF) (Release key) <cstamas@apache.org>"
it's clearly from someone involved with apache, described as a release key and also included in https://downloads.apache.org/maven/KEYS .
Addding it as avalid key should be fine.

Yes, i have seen that and have added that to the PKGBUILD file. However I do not know what to put in /keys/pgp/.

> I suggest to test building some of the packages that have maven as makedep with the 3.8.8 to verify if there are issues. Maybe epubcheck & keycloak?

I'm not really sure what you mean by that, but I have rebuilt 3.9.6 using 3.8.8 and the checksum still does not match.
Also, how could the pakages that you listed help?

Lone_Wolf · 2024-01-30 11:47:47

However I do not know what to put in /keys/pgp/

You can leave that folder out, it's only used in official packages .

I'm not really sure what you mean by that, but I have rebuilt 3.9.6 using 3.8.8 and the checksum still does not match.
Also, how could the pakages that you listed help?

maven is a project management tool, to test its functionality building a project that uses it is the simplest useful test I can think off.

I looked at which archlinux packages use maven at buildtime.

epubcheck has only 2 runtime deps and a clear purpose. verifying it works well when build with the newer maven should be easy.

keycloak is used for Identity & access management and important for archlinux gitlab single sign on .
That makes it a prime candidate to test new maven releases against.

As for 3.9.6 : troubleshooting that will be much harder, skip that version for now.

arch_anon_x · 2024-02-01 10:43:56

> You can leave that folder out, it's only used in official packages.

Got it.

> maven is a project management tool, to test its functionality building a project that uses it is the simplest useful test I can think off.

I see.
I thought that these packages were to somehow help me with 3.9.6.

I have built them both and they work fine. Should I email the devs now?

Lone_Wolf · 2024-02-03 16:18:49

Looking good now, I do think it's time to contact devs.

You'll need an account for gitlab.archlinux.org, then you can create an issue against the maven package.
An MR might be even better, but I'm not certain if non-devs can file MRs now.

arch_anon_x · 2024-02-15 12:42:33

I have emailed Antonio Rojas (packager of the current version) around two weeks ago and got no response from him.
I wanted to avoid creating another account but I think it's inevitable. Today I asked my account to be registered.

I'm still on it.

Last edited by arch_anon_x (2024-02-15 12:43:17)

Arch Linux

#1 2024-01-04 17:09:09

Problems with the Apache Maven package

#2 2024-01-04 18:44:45

Re: Problems with the Apache Maven package

#3 2024-01-04 18:54:12

Re: Problems with the Apache Maven package

#4 2024-01-04 19:16:31

Re: Problems with the Apache Maven package

#5 2024-01-04 20:53:46

Re: Problems with the Apache Maven package

#6 2024-01-26 21:56:19

Re: Problems with the Apache Maven package

#7 2024-01-26 21:58:17

Re: Problems with the Apache Maven package

#8 2024-01-26 22:02:51

Re: Problems with the Apache Maven package

#9 2024-01-26 22:55:20

Re: Problems with the Apache Maven package

#10 2024-01-27 13:43:27

Re: Problems with the Apache Maven package

#11 2024-01-27 16:04:16

Re: Problems with the Apache Maven package

#12 2024-01-27 16:53:21

Re: Problems with the Apache Maven package

#13 2024-01-27 18:46:22

Re: Problems with the Apache Maven package

#14 2024-01-28 12:06:25

Re: Problems with the Apache Maven package

#15 2024-01-30 10:06:18

Re: Problems with the Apache Maven package

#16 2024-01-30 11:47:47

Re: Problems with the Apache Maven package

#17 2024-02-01 10:43:56

Re: Problems with the Apache Maven package

#18 2024-02-03 16:18:49

Re: Problems with the Apache Maven package

#19 2024-02-15 12:42:33

Re: Problems with the Apache Maven package

Board footer