Details
-
Bug
-
Status: Open
-
Minor
-
Resolution: Unresolved
-
None
-
None
-
any Debian-based OS
Description
It is very much against Debian procedure and policy for a package build process to download dependencies from the internet. There are a lot of reasons for this; among them, guaranteed build repeatability, security auditability, non-reliance on websites remaining available, and license auditability.
The thrift Debian packaging (in contrib/) should use Maven in offline mode, if Maven is actually required for the Java build phase. Build-dependencies should be expressed as a list of Debian packages under "Build-Depends:" in debian/control.