[tor-bugs] #16746 [metrics-lib]: Use a better tool than just Ant and Debian's package manager to manage dependencies

[Tor Bug Tracker & Wiki]

#16746: Use a better tool than just Ant and Debian's package manager to manage
dependencies
-------------------------+-------------------------
 Reporter:  karsten      |          Owner:  karsten
     Type:  enhancement  |         Status:  new
 Priority:  normal       |      Milestone:
Component:  metrics-lib  |        Version:
 Keywords:               |  Actual Points:
Parent ID:               |         Points:
-------------------------+-------------------------
 We need a better way to handle dependencies.  As of now we require
 developers to use Debian stable and install specific packages that add
 their jar files to `/usr/share/java/`.  This approach already breaks as
 soon as there's a new Debian stable version, let alone the fact that
 developers might want to develop on a different operating system.

 I started looking into Maven as an alternative to Ant.  A few thoughts:

  - I didn't find an "official" version of Apache Commons Codec in Maven
 Central, but I instead managed to get rid of that dependency.  I did find
 recent versions of Apache Commons Compress and JUnit.
  - I started working on a [https://gitweb.torproject.org/user/karsten
 /metrics-lib.git/log/?h=maven branch that switches from Ant to Maven],
 though I'm considering to change that towards adding Maven while leaving
 Ant as an option.  I don't see any reasons why that would fail, but I
 haven't tried it yet.
  - One thing I'm yet unclear about is how we would switch other projects
 like Onionoo over to Maven, because Maven only produces one artifact and
 we're currently producing two artifacts: a .jar and a .war file.  I could
 imagine changing that to a single .jar and putting in a command-line
 switch to run either the hourly updater or the webserver.  Not sure about
 downsides here.  If this seems doable, I'd try it out with ExoneraTor
 first, because that one is tiny compared to Onionoo.
  - I also briefly looked into Apache Ivy which wouldn't force us to change
 as many things as Maven would, but figured that the forced Maven switch
 would also lead to a cleaner build process overall.  Happy to reconsider
 if there are arguments in favor of Ivy.

 Other thoughts?  Things that I overlooked?

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16746>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online