Jars on Maven Central with debug information

[theit]

Hi,

when you have dependencies in your pom.xml such as the following ones:

<dependency>
	<groupId>org.bouncycastle</groupId>
	<artifactId>bcprov-jdk18on</artifactId>
	<version>1.71.1</version>
</dependency>
<dependency>
	<groupId>org.bouncycastle</groupId>
	<artifactId>bcpkix-jdk18on</artifactId>
	<version>1.71.1</version>
</dependency>
<dependency>
	<groupId>org.bouncycastle</groupId>
	<artifactId>bcpg-jdk18on</artifactId>
	<version>1.71.1</version>
</dependency>

then you can download from Maven central not only the plain dependencies, but also the corresponding Javadoc and source jars. Eclipse IDE for example allows you to dive into the Bouncycastle code, shows you the Java source files when you open a certain class etc., but I cannot debug into the Bouncycastle code because the jars don't have debug information in them.

Can someone tell me the reason for this? IMHO this is quite puzzling...
Wouldn't it make sense to build the Jars with debug information before deploying them to Maven central? Otherwise having source and Javadoc jars are not really helpful there.

[dghgit]

It's really about the size. -debug versions for the provider jars are available. The others can be built from the source as no JCE signing certificate is required.

[theit]

I see your point, but does size nowadays really matter that much? When I compare the debug version with the non-debug version of bcprov-jdk18on 1.72, the debug version is ~11% bigger (~12MB vs. 10,75MB); basically the same difference for bcprov-ext-jdk18on.

I don't really see a benefit in deploying a jar in combination with its corresponding source and javadoc jar to Maven Central, but omitting debug information; especially when it is an open source library. Other popular libraries such as Apache commons, Log4J 1.x or 2.x don't go that way...

IMHO if you care about the size of an application, you should use tools to remove all unnecessary stuff from jars you depend on, such as unused classes, resources etc.

[theit]

I have just seen that obviously starting with Bouncycastle 1.73 there are lots of additional debug artifacts available on Maven Central. First of all, that's great news.

A few questions though:

What really is the difference between, say, bcpg-jdk18on-1.73.jar and bcpg-debug-jdk18on-1.73.jar? The corresponding source and javadoc jars are exactly the same, the main jars seem to contain exactly the same files but have a different size.
The behavior of an application shouldn't be affected if I use the non-debug version or the debug version of a BC dependency, right? Also the runtime speed shouldn't differ.

The only point I see:
During development I should use the debug versions of BC libraries to be able to debug into the code if necessary. When it comes to a deployment (release), I have to modify the pom.xml files to strip out the debug from the artifact ids, create the deployment package / release, again modify the pom.xml files and re-add the debug part into the artifact ids to be able again to debug into the code if necessary etc....

What really is the rationale behind providing both a non-debug and a debug version of the libraries? When it comes to Maven Central, they also have different artifact Ids.
You mentioned size, but is that really such a big deal?

[dghgit]

It is to some people, there's also the issue that some people are uncomfortable shipping files with full symbol table information. It's much harder to tinker with a class file if it's been minimized.

[dghgit]

debug jars are now being distributed on Maven Central for both Java 5 to Java 8, and Java 8+.