Release on Maven Central about validator

[gdelhumeau]

Also, it would be good to have a JAR that does not embed the dependiences, in order to let Maven retrieve them.

[sideshowbarker]

Hi Guillaume,

Could you release your application into Maven Central (http://search.maven.org/)? It would make easy for developers to integrate the VNU classes into their applications.

Yes, thanks for making the request and I plan to do this but have not been able to make time for it yet. See also See also validator/validator.github.io#10

I'd not very familiar with the process for getting things into Maven Central and if there's some way to automate it, I'd welcome a patch. Otherwise, I will try to get it figured out and done within the next few weeks.

Also, it would be good to have a JAR that does not embed the dependencies, in order to let Maven retrieve them.

I think not all of the dependencies are in Maven and in some cases we are using older versions that may have been in Maven but aren't any more. But yeah I agree that we should get a jar into Maven that contains as few additional jars within it as possible. Preferably zero others, eventually.

[rwhogg]

I started writing that Maven pom file, but it is not finished yet. I also had the problem you mentioned about finding dependencies.

After you deprecated the validator/build repo I abandoned my fork of it, so instead I'm just temporarily posting it as a gist. (https://gist.github.com/rwhogg/849da62c71304f009b3d)

As for automating creation of it, one option might be http://maven.apache.org/ant-tasks/examples/write-pom.html

[sideshowbarker]

After you deprecated the validator/build repo I abandoned my fork of it

oops—sorry about that. I hadn't figured you'd started on it already

so instead I'm just temporarily posting it as a gist. (https://gist.github.com/rwhogg/849da62c71304f009b3d)
I also had the problem you mentioned about finding dependencies.

If the problem is finding the specific (older) versions, we could update to newer/current versions. But we'd need to test with this versions.

If the problem is that there are particular dependencies that don't exist at all in Maven, then I think we could deal with that by just keeping them packaged inside vnu.jar the way they currently are.

[rwhogg]

oops—sorry about that. I hadn't figured you'd started on it already

No worries. Besides, better repo organization will benefit everyone in the long run.

If the problem is finding the specific (older) versions, we could update to newer/current versions. 
If the problem is that there are particular dependencies that don't exist at all in Maven, then I think
we could deal with that by just keeping them packaged inside vnu.jar the way they currently are.

I mostly found the specific versions (or very close substitutes) when I was able to find the packages at all; it was more the second problem. Of course, I was only looking for ~20 minutes. Hopefully more of the dependencies will turn up with a more thorough search.

[skibz]

has there been any recent progress on this issue?

i'd be happy to help out if needed, though my knowledge of maven isn't the best. :D

regardless, having this project hosted within the maven central repo would benefit me and my organisation greatly as we have an application which consumes this validator programmatically by proxy of a bash process.

having it available through maven could open up the possibility of encapsulating it and then being able to use it without all the extra overhead.

[rwhogg]

I apologize, but after the initial attempt, I never had time to make further progress.

[sideshowbarker]

I apologize, but after the initial attempt, I never had time to make further progress.

No worries. I’ve not had time myself yet either. But I reckon I‘ll be able to finally get to it over the holidays.

[rwhogg]

I got rid of that gist, now I've just forked this repository and reuploaded the POM there.

[rwhogg]

In the valpom branch on my fork, I uploaded the steps I took to create a sources.jar file. I'll be uploading how to make GPG signatures for the various files too. I've also established how to use the Maven install plugin to install the jars, which will be part of that next update.

I'm also working on making a Javadoc jar. With that, almost everything will be ready.

Is there a built-in way to make a jar which contains only the classes and no dependencies? I suspect we'll want to automate this process (presumably by putting this into the python build file) and I don't really want to reinvent the wheel in doing so.

[sideshowbarker]

Is there a built-in way to make a jar which contains only the classes and no dependencies?

There's not. The build currently just uses ant with the https://github.com/validator/validator/blob/master/build/build.xml file to build the jar. So if I were to create a jar that doesn't include the dependencies, I guess I'd just make a copy of that build.xml file with lines 34-55 removed (and then name it build-no-depends.xml or whatever). I don't know what the maven equivalent would be.

[skibz]

i'm not sure, but i think maven builds jars without deps by default.
in the past, i've had to use the maven shade plugin to build "fat" jars that include dependencies.

[sideshowbarker]

FYI this weekend I made code changes that reduce the number of runtime dependencies.

So at this point I think all the dependencies are now available from maven central except a icu4j-charset-*.jar (com/ibm/icu/charset & com/ibm/icu/impl/data packages). And the reason it's not there is just, no ICU project devs have had time yet to do the work needed to make it available; see http://bugs.icu-project.org/trac/ticket/8241 & http://sourceforge.net/p/icu/mailman/message/30089933/

[skibz]

kudos @sideshowbarker !!

[rwhogg]

Great to hear it! Ideally I'll be able to update the POM in my fork sometime on the weekend.

[sideshowbarker]

Great to hear it! Ideally I'll be able to update the POM in my fork sometime on the weekend.

Super—if you end up having time to work on it this weekend and run into any questions or need help, please feel free to ping me.

If there are dependencies that are on GitHub but not on any public repositories you could get them with https://jitpack.io

[sideshowbarker]

So FYI this weekend I finally got around to adding a build target to publish releases to the Central Repository that will meet the requirements given at http://central.sonatype.org/pages/requirements.html

So I've filed a project-creation request (see https://issues.sonatype.org/browse/OSSRH-14147) and as soon as the project gets created, I'll publish a release.

[rwhogg]

Great to hear it!

I've been using your new autogenerated POM file (no sense in updating mine anymore) and experiencing some problems - namely that log4j 1.2.15 has certain dependencies that are seemingly unavailable in Maven Central, which causes mvn install to fail. I haven't looked into the compatibility issues yet, but using 1.2.17 appears to fix the download problem, so maybe someone (me?) should investigate whether or not you can upgrade. Assuming the releases follow semver, there shouldn't be any problems, but I'm not 100% sure.

I found another minor issue as well, but I'll be issuing a PR for that shortly.

[sideshowbarker]

I've been using your new autogenerated POM file

Cool—thanks for testing it

I've been using your new autogenerated POM file (no sense in updating mine anymore) and experiencing some problems - namely that log4j 1.2.15 has certain dependencies that are seemingly unavailable in Maven Central, which causes mvn install to fail. I haven't looked into the compatibility issues yet, but using 1.2.17 appears to fix the download problem

Using log4j 1.2.17 should be fine. I think the only reason we're using 1.2.15 is, that was the latest available at the time we last updated that dependency (more than 6 years ago…)

I haven't looked into the compatibility issues yet, but using 1.2.17 appears to fix the download problem, so maybe someone (me?) should investigate whether or not you can upgrade.

I'll go ahead and change the dependency in our build script and test with it. If it seems to be working as expected, I'll switch it in the source for the generated POM as well, and then push it all.

Thanks again much for attention and help

[sideshowbarker]

Travis CI liked the log4j update to 1.2.17 just fine https://travis-ci.org/validator/validator/builds/52702187
and locally I also built fine and started and ran the service fine with no unexpected warnings or errors. I ran the regression test suite with no unexpected results and I (manually) tested the WAR file too. So, everything's passing.

[rwhogg]

Sonatype is ready to accept the project! :)

[sideshowbarker]

We have liftoff:

https://repo1.maven.org/maven2/nu/validator/validator/15.3.10/

[cvrebert]

🎆 😎 🎉

[gdelhumeau]

Great news! Thanks!

[sideshowbarker]

FYI, since the checker uses a forked version jing, I also released package of that version. And since the HTML parser that we use hasn't been released on maven in more than 2 years, I also released an updated version of that.

All can be found here:

https://repo1.maven.org/maven2/nu/validator/

The validator package of course has its dependency info set to depend on those two packages.

Please test and raise new issues if you find any problems.

[rwhogg]

Great news!