[fedora-java] Why no Class-Path manifest attribute?

[Florian Weimer]

On 05/29/2013 11:30 AM, Andrew Haley wrote:
> On 05/29/13 10:13, Florian Weimer wrote:
>> The existence of the Class-Path attribute is not widely known, and I was
>> surprised to see it mentioned in the policy.
>
> Yes it is, it's very well-known, and is almost universally rejected.
> It bakes hard paths into jarfiles and overrides -classpath.  In other
> words, it has similar disadvantages to -RPATH.

I finally experimented with this:

   <https://github.com/fweimer/classpath-manifest-override>

The gist appears to be that overriding Class-Path entries is possible if 
the main class is not executed with the -jar option.  We generally don't 
do that in Fedora.  Does this mean Class-Path is still unacceptable? 
It's just that I found it extremely usable in the past.

What are the alternatives?

I built an application using Maven, and it uses the default 
<type>bundle</type> dependency, so Maven copies the class files of the 
dependencies into the application JAR.  As a result, the JAR just works, 
but this is like static linking, with all its problems.  Curiously, the 
Fedora packaging guidelines do not discuss this at all, as far as I can 
tell.

The spec file is here:

 
<https://github.com/victims/victims-client-java/blob/master/victims-client-java.spec>

As you can see, I use the usual Maven packaging framework.

-- 
Florian Weimer / Red Hat Product Security Team