Main Inclusion Report for libcommons-dbcp-java

Requirements

1. Availability: http://archive.ubuntu.com/ubuntu/pool/universe/libc/libcommons-dbcp-java; available for all supported architectures.

2. Rationale:

   • The Apache Commons Java libraries are basic library blocks used in lots of Java software.

   • The DBCP component is a runtime dependency of tomcat6 (see MainInclusionReportTomcat6).

3. Security:

   • CVE entries: none

   • Secunia history: empty

   • No binaries running as root, this package just provides Java libraries.
   • Network activity: commons-dbcp does not open any port or handle incoming network data in itself.
   • It does not directly process binary or structured data.

   • No source code review. Fortify scanned it as part of its Java Open Review project and they found it to be defect-free.

4. Quality assurance:

   • The package is known to work out of the box without configuration.
   • It does not ask any debconf questions higher than priority 'medium'.

   • Debian bugs: none.

   • Maintenance in Debian is calm.

   • Upstream is calm (last release in April 2007).

   • Upstream bug tracker: no critical bugs.

   • Hardware: the package does not deal with hardware.
   • There is a junit test suite in the upstream source, but it is not enabled in the Debian build.

5. Standards compliance:

   • FHS compliant, Debian Policy compliant (in particular the Java library subpolicy).

   • Packaging system is CDBS, no patches.

6. Dependencies:

   • Build dependencies: debhelper, cdbs, junit, ant and java-gcj-compat-dev are all in main. MIR for libcommons-pool-java (MainInclusionReportCommonsPool) and libcommons-collections-java (MainInclusionReportLibCommonsCollectionsJava) have been filed.

   • Runtime dependencies: depends on libcommons-pool-java and libcommons-collections-java (see MIR links above).

7. Background information:

   • General purpose and context of the package is clear from the package's debian/control file.
   • Upstream calls this software the Apache Commons DBCP component.

Reviewers

MIR bug: https://launchpad.net/bugs/260386

ThierryCarrez