Review: derby 10.17.1.0-1
Package Information
| Description | Apache Derby Shared Code Apache Derby is an open source relational database implemented entirely in Java. This package contains derbyshared.jar, the classes shared by the Derby database engine, the network server and the client JDBC driver. |
|---|---|
| Maintainer | Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> |
| Changed By | Emmanuel Bourg <ebourg@apache.org> |
| Sponsor | ebourg@apache.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/java-team/derby.git (browse) |
| Popcon Installs | 53 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/derby |
| Uploaded | 24 days ago |
New Package Report
.changes
| Source | derby |
|---|---|
| Version | 10.17.1.0-1 |
| Changed-By | Emmanuel Bourg <ebourg@apache.org> |
| Architecture | source all |
| Distribution | unstable |
| Date | Mon, 28 Sep 2026 12:22:56 +0200 |
Changelog
derby (10.17.1.0-1) unstable; urgency=medium
.
* New upstream release
- Refreshed the patches
- Copy the servlet API jar under the name expected by module-info.java
- New binary package libderbyshared-java for the shared classes moved
out of derby.jar and derbyclient.jar
- Derby now requires Java 21
* Replaced orig-tar.sh with the Files-Excluded field in debian/copyright
* Depend on libservlet-api-java instead of libservlet3.1-java
* Standards-Version updated to 4.7.4
* derby-tools now depends on default-jre-headless
* Rewrote the watch file in the version 5 format
* Updated the lintian overrides
* Removed the redundant Priority and Rules-Requires-Root fields
* Use the pkg-info.mk variables instead of parsing dpkg-parsechangelog
* Fixed the obsolete dpkg --compare-versions operator in debian/rules.dsc
| Component | main |
|---|---|
| Package-List | derby-doc deb doc optional arch=all derby-tools deb java optional arch=all libderby-java deb java optional arch=all libderbyclient-java deb java optional arch=all libderbyshared-java deb java optional arch=all |
| Section | doc |
| Priority | optional |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Apache Derby
Source: https://db.apache.org/derby/
Files-Excluded: *.bat
tools/java/*
*doc-src/*
Files: *
Copyright: 2004-2014, The Apache Software Foundation
1997-2004, International Business Machines Corporation
License: Apache-2.0
On Debian systems you can find the complete text of the
Apache-2.0 license in '/usr/share/common-licenses/Apache-2.0'
Files: debian/*
Copyright: 2013-2014, Emmanuel Bourg
2012-2013, Tim Booth
License: BSD-2-clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Review Information
accepted — allocated to awm 22 days ago, started 22 days ago, completed 22 days ago.
Final Comment
Hi,
A few problems that you should fix when you have some time...
-
Third-party holders undocumented. debian/copyright only lists ASF and IBM for Files: *. The upstream NOTICE names many additional holders (NIST, OSGi/kxml/Felix, Lucene, Tomcat, json-simple, ICU, IBM 1997-2004). These are largely build-time-only dependencies that don't ship as separate code, so this isn't a DFSG violation — but dep5 doesn't record them or state that they aren't shipped. (Mitigated by NOTICE being installed.)
-
Optional-tools jar is built but never installed. ant ... buildjars builds derbyoptionaltools.jar (Lucene/JSON integration, see maven2/optionaltools/pom.xml), but no .poms file installs it, so liblucene4.10-java/libjson-simple-java are only used to compile an unshipped artifact. Good for DFSG, but the JSON-simple patch work is effectively dead code in the shipped packages.
-
Fragile in-place source mutation. debian/rules:36-40 (override_dh_auto_build) does sed -i.json-simple on *.java source files in the source tree (substituting @JSON_SIMPLE@), with restoration only in override_dh_auto_clean:31-32. An interrupted build leaves source files corrupted. Combined with the runtime dpkg -l parsing of JSON_SIMPLE_VERSION (debian/rules:11-17) to choose between com.github.cliftonlabs.json_simple and org.json.simple, this is brittle — better resolved by a fixed Build-Depends and a static patch.
Thanks!