Dear maintainers,

maven-verifier 1.8.0-1 has been failing to build in Ubuntu, because its
build-time tests depend on downloading software from the Internet:

[...]
[ERROR] testWithMavenHome(org.apache.maven.it.Embedded3xLauncherTest)  Time elapsed: 0.581 s  <<< FAILURE!
java.lang.AssertionError:
exit code unexpected, build log:
[INFO] Scanning for projects...
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-shared-components/18/maven-shared-components-18.pom
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[FATAL] Non-resolvable parent POM for org.apache.maven.shared:maven-verifier:1.4-SNAPSHOT: Could not transfer artifact org.apache.maven.shared:maven-shared-components:pom:18 from/to central (https://repo.maven.apache.org/maven2): transfer failed for https://repo.maven.apache.org/maven2/org/apache/maven/shared/maven-shared-components/18/maven-shared-components-18.pom and 'parent.relativePath' points at wrong local POM @ line 23, column 11
 @
[...]

  (https://launchpad.net/ubuntu/+source/maven-verifier/1.8.0-1/+build/26010073)

This fails because Launchpad does not allow network access during package
builds, unlike Debian buildds which usually have network access.

While this is not a build failure, it does mean building the package has a
dependency on software outside of main, which I believe is a serious policy
violation.

libmaven-parent-java ships maven-shared-components-35.pom and maven-verifier
build-depends on libmaven-parent-java.  So perhaps src/test/resources/pom.xml
simply needs updated to point at the current version instead of version 18?

The network access during build is a policy violation in itself:

    4.9
    …
    For packages in the main archive, required targets must not
    attempt network access, except, via the loopback interface, to
    services on the build host that have been started by the build.


Cheers,
gregor

Hello,

Bug #1037064 in maven-verifier reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/java-team/maven-verifier/-/commit/c761ab42ddbdd883306e9d72a27096a2123d0752

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1037064

We believe that the bug you reported is fixed in the latest version of
maven-verifier, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1037064@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
tony mancill <tmancill@debian.org> (supplier of updated maven-verifier package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 15 Jun 2023 20:13:15 -0700
Source: maven-verifier
Architecture: source
Version: 1.8.0-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: tony mancill <tmancill@debian.org>
Closes: 1037064
Changes:
 maven-verifier (1.8.0-2) unstable; urgency=medium
 .
   * Team upload.
   * Rework tests patch to disable network access (Closes: #1037064)
   * Freshen years in debian/copyright
   * Set Rules-Requires-Root: no in debian/control
Checksums-Sha1:
 2bea4f4d360a67b33526cb25bec54f0c51d8ee44 2244 maven-verifier_1.8.0-2.dsc
 f4fa6106900dd0ec326c13bf0eeaf4ec99d2a05b 4148 maven-verifier_1.8.0-2.debian.tar.xz
 7eb163709fdd64b128235e18661da9feab9db0d4 13732 maven-verifier_1.8.0-2_amd64.buildinfo
Checksums-Sha256:
 f1f5a06273f401273b045d22a61a8c815cbed6bfdbb1ee944f5672a8a729076e 2244 maven-verifier_1.8.0-2.dsc
 617e7096c8031d7ffefb9fa6a512f5905700284d82eace4166751534ed071f56 4148 maven-verifier_1.8.0-2.debian.tar.xz
 b6c0afd8e9242f0eecba2b67f4233a23a38742fa817286aa10ae0b1422fb2603 13732 maven-verifier_1.8.0-2_amd64.buildinfo
Files:
 f170a5615c99892370015c4ed0b80992 2244 java optional maven-verifier_1.8.0-2.dsc
 86e56b335ebfd532e3dbdb177dfeca8d 4148 java optional maven-verifier_1.8.0-2.debian.tar.xz
 7bf3b3d4e36cd4bc49a29e521375b3b3 13732 java optional maven-verifier_1.8.0-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEE5Qr9Va3SequXFjqLIdIFiZdLPpYFAmSL1JMUHHRtYW5jaWxs
QGRlYmlhbi5vcmcACgkQIdIFiZdLPpaCBBAAlIhkQ8CkqzL9hY9Gk6g3DZ1ywpQq
xqZOBPjqeM4Du8TqrEOCh656hqIUHqlgSE6AvF+eWX2YpzZlmKHCAl9RvpPYMP7p
HGKTSHB+rhv5hOoWBtJNlDWRsiILHhvn64YCdMhpMqtLf2B1VmDLyZaQIso99mPM
qA/MN5Bffd7Wm9VDy11BXvLEebR1S/FuvQ+derBdebLHAojVRyl4SO0/Y2Y0FtxZ
laUxNWBlP7C/gy2L9scLyO5tK+sl/H+//H9FWJfJKPJUvmEsNZ2wl7BzFsBn4hWt
X3k75lRBaSUt8JySZI6hqFKj2SyGoPJ6vvFJJ96ZaOBeLebkDaPaMDpgvox1Fncp
OS5f2Pt+pNxe52JVZu+znfblciVnQ9wj39kZlDZzbSe9TbaGvfAMGILiFjlxSd92
VIassH4M3BqY7yIRUYlP9EEmDP3C8zfTjsLH+z8oJCOnlyHwYdF7C43Q4EoSzmRG
JQf05MvXovFjQkN33l20Uttwh36VfxCPdz/cpxcfHrLkN0lrcI+ezcIQA+dfS3cc
TjBRZp/Re/2MEdTWUVsfWONGqxGdjKVemgWO78t8sXQhN6jwdjTmc/RrZB2Ywn60
JKtQEezePlriF0O7GlEsdxRdwaR/wtjZlMjG+Ywo/uGbNhRSqLeOfjeBfhi+aWMI
zzS9IVUxUNFKKPY=
=2a0j
-----END PGP SIGNATURE-----

For posterity, I tested locally using network namespaces and described
here [1].  Specifically:

# create a chroot including the build-deps
# (maybe there's an easier way?)

sudo sbuild-createchroot --no-deb-src --chroot-mode=schroot \
   --chroot-prefix=1037064 \
   --include=debhelper,default-jdk,junit4,libeclipse-sisu-maven-plugin-java,libmaven-parent-java,libmaven-resolver-transport-http-java,libmaven-shared-utils-java,libmodello-maven-plugin-java,maven-debian-helper \
   unstable /data/chroot/1037064-amd64-sbuild http://localhost:3142/debian

# create the namespace
sudo ip netns add no-net

# build
sudo ip netns exec no-net sbuild --no-apt-update --no-apt-upgrade \
    --no-apt-distupgrade --no-run-lintian --chroot=1037064-amd64-sbuild

# clean up
/usr/sbin/sbuild-destroychroot 1037064-amd64-sbuild

[1] https://wiki.debian.org/sbuild#Disabling_network_access_for_dpkg-buildpackage