Why can't we just sudo apt-get install lucee

any major reason why that sometime in the near future we couldn’t just type

sudo apt-get install lucee

Yes I believe so.

@Brad_Wood :point_up: can you expand on the reasoning behind this, I believe we spoke about it a while back but I can’t remember the issues.

@Zackster You’re asking potentially two similar but very different questions.

  1. Can we have an official Debian Lucee package hosted on the main debian server’s that requires nothing more than apt-get install lucee
  2. Can we have a non-official Lucee package that can be installed, but will also require import of a key, updating a source list, and running apt-get update.

Let’s address #1 first.

  • It’s a lot of work to create an official package. You must be sponsored by someone on the “inside” and follow a very strict build process that creates your entire package from source via an exact build process
  • It’s even more work to create a Java-based project. There’s an entire list of requirements just for Java projects-- you must break your entire project apart and have no more than one java lib per Debian package and use a custom class path to load all jars in a manner that no single jar is never installed twice on the same server. Each separate library must follow all the steps in #1 and be individually approved. This basically means re-writing everything about how your project is compiled, built, and installed to follow the Debian guidelines.
  • It’s basically impossible for a large project that contains many libs, some of which may be closed source or of an incompatible license. Just a single Apache 2.0 licensed jar file or a closed source lib in the entirety of Lucee would make this not work at all. Every single jar lib must be in a compatible GPL variant license and submitted separately.

I spent several weeks looking at all this for CommandBox and gave up. It would just be impossible and I don’t even know if their required installation structure even allows for projects that use OSGI to load in 3rd party libs.

Now for option #2. This is a different beast entirely.

  • You simply need to have a .deb package-- who cares how you built it
  • It doesn’t need to follow any standards at all
  • It can package whatever the heck it wants
  • The user must do a couple extra steps of adding your signing key, adding your repo to the source list prior to installing.
  • LAS would need to host a debian repo somewhere and create a deb package for each build.

This is all pretty workable, and we do all of it for CommandBox right now. In fact, I think Denny Valiant had worked on something similar to this at one point in time, but I’m not sure what became of it. (Denny helped us create our CommandBox Debian and RPM packages). It does bring up some interesting questions though:

  • Should the Lucee package bundle Tomcat, or require it as a dependency and just install itself into Tomcat?
  • Should it bundle Apache, or require it, or leave that up to you?
  • Should it have an installer or just be opinionated, ask no questions, and install itself in the same place for everyone?

Most people would probably want to stick to the all-inclusive installer approach where they get to have a say in how it’s installed. This would lead us down the road of roughly how MySQL Server works where you install an initial package and then run a script to “finish” the installation.

$> apt-get install myServerThingy
$> myServerThingyInstaller

That sort of begs the question as how that approach is really any different that what you have right now (simpler actually since the below doesn’t require the custom signing keys and source lists):

$> wget http://downloads.lucee.org/myServerThingy.bin
$> chmod a+x myServerThingy.bin
$> ./myServerThingy.bin

And the final bit is if Lucee upgrades will actually work inside the apt-get framework. In other words, can you get the new version of Lucee like so:

$> apt-get update
$> apt-get upgrade

My guess is no, that won’t work. Lucee has its own update mechanism that updates internally and the apt-get package would probably just end up being a one-time installer. To me, this loses one of the biggest reasons to use your OS’s package manager in the first place! (CommandBox does allow you to upgrade this way, but we’ve become more opinionated to allow for it).

So the TL; DR; is

  • Having an official package is crazy talk
  • Having a custom built package is pretty do-able
  • I’m not sure having a custom built package actually does anything for us other than just sounding really cool.
4 Likes