#781063 commons-httpclient: should be removed from Debian during the Stretch release cycle

Package:
src:commons-httpclient
Source:
commons-httpclient
Submitter:
Markus Koschany
Date:
2018-12-23 17:36:03 UTC
Severity:
important
Blocked By:
Bug Title
800991

  1

 jets3t: depends on obsolete libcommons-httpclient-java library

normal stable testing unstable almost 11 years ago

800994

  1

 axis: depends on obsolete libcommons-httpclient-java library

normal stable testing unstable almost 11 years ago

801000

  1

 commons-vfs: depends on obsolete libcommons-httpclient-java library

normal stable testing unstable almost 11 years ago

800975

  1

 ant-contrib: depends on obsolete libcommons-httpclient-java library

normal stable testing unstable almost 11 years ago

800990

  0

 jakarta-jmeter: depends on obsolete libcommons-httpclient-java library

normal stable testing unstable about 8 years ago

#781063#5
Date:
2015-03-23 23:23:36 UTC
From:
To:
Quoting https://hc.apache.org/httpclient-3.x/

"The Commons HttpClient project is now end of life, and is no longer
being developed. It has been replaced by the Apache HttpComponents
project in its HttpClient and HttpCore modules, which offer better
performance and more flexibility."

I think it would be best to retire this library during the Stretch
release cycle and to switch all reverse-dependencies to

https://packages.qa.debian.org/h/httpcomponents-client.html

The current list of r-deps:

Reverse-Build-Depends-Indep
===========================
* activemq
* ant-contrib
* biomaj
* commons-vfs
* ivy
* jajuk
* jakarta-jmeter
* jenkins
* jenkins-htmlunit
* jenkins-json
* jftp
* jspwiki
* libexml-java
* libjboss-common-java
* libowasp-antisamy-java
* libreoffice
* libspring-java
* maven-docck-plugin
* mule
* openid4java
* wagon
* wagon2

Reverse-Build-Depends
=====================
* axis
* eclipse
* jabsorb
* jackrabbit
* jets3t
* libopenws-java
* libxmlrpc3-java
* lucene-solr
* not-yet-commons-ssl
* spring-build
* triplea
* wsdl2c
#781063#10
Date:
2015-03-24 11:30:06 UTC
From:
To:
I don't think this is a good idea. commons-httpclient is a very popular
library, even in its older incarnation. Removing it could make it harder
to bring new libraries or applications to Debian.

Emmanuel Bourg
#781063#15
Date:
2015-03-24 11:51:04 UTC
From:
To:
Hi,

well, this contradicts what Debian already recommends to users. The
package description of libhttpclient-java states:

"HttpComponents Client is a successor of and replacement for Commons
HttpClient 3.x. Users of Commons HttpClient are strongly encouraged to
upgrade."

It will be much harder in the future to fix security issues when there
is no upstream support and apparently commons-httpclient won't be
developed anymore in favor of libhttpclient-java and Co. The
dependencies should be changed whenever possible to the new and
maintained implementation because this is what we do for all libraries
and applications across the distribution. There will be cases where it
is not as simple but at least we should try to reduce the security risk
and maintenance burden.

Regards,

Markus
#781063#20
Date:
2015-04-13 16:27:19 UTC
From:
To:
Hi Emmanuel,

This could be the case, however, the package has not seen maintainer uploads
in a very long time and has a number of issues. Security issues went
unaddressed for months. If it's important to keep it, it should be well-
maintained.


Cheers,
Thijs