FAQ Why Build Java Code From Source
From Gentoo Linux Wiki
| General • Portage • Wiki |
Author : Karl Trygve Kalleberg <karltk@gentoo.org>
Updated : 2005-02-21
Why should I build Java packages from source?
Let me give you a few reasons:
- End-users may want to manually patch or tweak the sources between src_unpack and src_compile.
- The USE flags will normally impact on which features are to be compiled in, and which dependencies we want to allow.
- When security flaws are found, we want to issue a hotfix immediately. It is not always feasible to wait for the upstream project to make a new release. With binary-only packages, the only fix we can offer is disabling the software entirely by masking it.
- It is common that we need to apply Gentoo-specific tweaks and intermediary patches when upstream takes a long time to issue a new release, which is almost always only possible when we compile from sources.
- There is an obvious correspondence between the source code and the resulting binaries, so the user is guaranteed that there are no trojans hiding in the binaries (we don't guarantee the lack of trojans in the source code itself, but at least it's easier to find there).
- We guarantee to our users that the source exists and compiles properly, the basis of regular open-source development.
- For immature library packages, where documentation is often scanty, the user can easily run javadoc on the sources, as a stop-gap measure, without needing to dig out the source code from upstream.
- In the future building native compiling from Java source code using gcjx for example could become a serious option. If we try to add all packages to the tree in a way where they are getting built from their source code, we could easily make it possible in the future to create native binaries from Java packages. With binary packages this isn't possible if upstream doesn't provide native compiled packages.
