On 11/02/2019 15:01, Sam Hague wrote:

We really need to address the 'wild west' aspect here -- and we need
concrete examples from past two releases.

Possible example, the sodium branch is broken for NetVirt because of the
karaf.shell missing. [1] was pushed to add the pom dependency. Possible
it was something else that caused the issue, but the point is that when
things go unstable and not fixed you get days or weeks of things leaking in.
[1] https://git.opendaylight.org/gerrit/#/c/80253/

Alright, this is a transitive dependency not being declared at point of
use and yeah, broken by genius correcting their use (moving out of API,
using scope=provided).

We explicitly do not guard against this kind of breakage, because that
would require a full autorelease build on each verify. It is caught by
autorelease, though.

What you can do on netvirt side is to clean up your build system to not
rely on transitives, like what bgpcep does:

https://github.com/opendaylight/bgpcep/blob/master/binding-parent/pom.xml#L60

It is by no means perfect and subject to breakage when things change
upstream, but I think that occurs only in case of what would be
considered an API change...

Regards,
Robert