Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Message-ID: <4F97057B.8030804@l3s.de>
Date: Tue, 24 Apr 2012 21:56:43 +0200
From: Matthias Pfau <pfau@l3s.de>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:11.0) Gecko/20120329 Thunderbird/11.0.1
MIME-Version: 1.0
To: user@cassandra.apache.org
Subject: Inconsistent dependencies
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi there,
we just noticed that cassandra is currently published with inconsistent 
dependencies. The inconsistencies exist between the published pom and 
the published distribution (tar.gz). I compared hashes of the libs of 
several versions and the inconsistencies are different each time. 
However, I have not found a single cassandra release without 
inconsistencies.

This is a serious issue for us as we are using pom dependencies for 
development/testing and a tarball distribution for production. Over the 
long term it is very likely that we run into problems because sth. does 
not work as expected.

I had a look at the build process of cassandra and noticed that all 
dependencies that are included in the tarball are actually versioned in 
the libs directory. Unfortunately, these dependencies do not match the 
ones that are placed into the pom. Is there any reason for doing so?

The first things that came to my mind for solving the issue are:
a.) Remove the versioned dependencies and use ivy to retrieve the needed 
dependencies for compilation and packaging
b.) Create a fat jar that includes all dependencies of cassandra and 
publish that fat jar, too
c.) relabel all dependencies from the lib folder and republish them, too.

What do you think?

Kind regards
Matthias