Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel > #101511

Re: Finding rough consensus on level of vendoring for large upstreams

Cross-posted to 2 groups.

Show all headers | View raw

On Thu, Sep 2, 2021 at 10:39 PM Phil Morrell wrote:

> Over this last year there seems to have been a noticeable divergence of
> maintainer opinion, on what has become known as vendoring

Embedded copies of code/etc have downsides ...

https://wiki.debian.org/EmbeddedCopies

> It is my reading of the situation that not only has this practice become
> more prevalent across multiple ecosystems since 2008

... but there are many many copies in Debian and they are not going
away upstream.

> [security-tracker]: https://salsa.debian.org/security-tracker-team/security-tracker/-/blob/master/data/embedded-code-copies

Side note: This file is very much outdated, new copies are introduced
all the time and old copies get removed. This has always been the case
and it always will be.

So we need to cope with the consequences of this change toward
embedding in the upstream FLOSS ecosystems.

Personally, my recommendations are that:

Debian package maintainers could investigate upstream tarballs for
embedded copies before each upload containing a new/changed upstream
tarball.

Debian package maintainers could talk to upstream about removing
embedded copies and replacing them with dependencies.

Debian package maintainers could talk to upstream about upstreaming
changes in modified embedded copies, removing the embedded copies and
replacing them with dependencies.

Debian package maintainers could use Files-Excluded or `rm -r` in
debian/rules to ensure that embedded copies are not used by the build.

Debian package maintainers could add hints to the source package about
which embedded copies are definitely used.

Debian security tracker could remove the perpetually outdated list of
embedded copies.

Debian security issue investigators could search the archive for
similar or duplicate code (using the tools listed on the above wiki
page), investigate the build logs for each package found and determine
which packages are affected. This is a lot of work, but given the
level of embedding we already have, it is already necessary.

Also, the issue of static linking is similar; it is here, it isn't
going away and so now we have to cope with it and the problems it
causes are similar to embedded copies.

https://wiki.debian.org/StaticLinking

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

Back to linux.debian.devel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Finding rough consensus on level of vendoring for large upstreams Phil Morrell <debian@emorrp1.name> - 2021-09-03 00:40 +0200
  Re: Finding rough consensus on level of vendoring for large upstreams Jérémy Lal <kapouer@melix.org> - 2021-09-03 01:20 +0200
    Re: Finding rough consensus on level of vendoring for large upstreams Phil Morrell <debian@emorrp1.name> - 2021-09-03 03:10 +0200
      Re: Finding rough consensus on level of vendoring for large upstreams Gunnar Wolf <gwolf@debian.org> - 2021-09-03 17:30 +0200
  Re: Finding rough consensus on level of vendoring for large upstreams Jonas Smedegaard <jonas@jones.dk> - 2021-09-03 02:50 +0200
    Re: Finding rough consensus on level of vendoring for large upstreams Phil Morrell <debian@emorrp1.name> - 2021-09-03 03:40 +0200
      Re: Finding rough consensus on level of vendoring for large upstreams Jonas Smedegaard <jonas@jones.dk> - 2021-09-03 05:00 +0200
        Re: Finding rough consensus on level of vendoring for large upstreams Pirate Praveen <praveen@onenetbeyond.org> - 2021-09-03 18:50 +0200
    Bug#907051: Finding rough consensus on level of vendoring for large upstreams Simon McVittie <smcv@debian.org> - 2021-09-03 11:30 +0200
  Re: Finding rough consensus on level of vendoring for large upstreams Paul Wise <pabs@debian.org> - 2021-09-03 05:30 +0200
  Re: Finding rough consensus on level of vendoring for large upstreams "Bastien Roucariès" <roucaries.bastien@gmail.com> - 2021-09-03 10:20 +0200
  Re: Finding rough consensus on level of vendoring for large upstreams Adrian Bunk <bunk@debian.org> - 2021-09-12 19:20 +0200
    Re: Finding rough consensus on level of vendoring for large upstreams Phil Morrell <debian@emorrp1.name> - 2021-09-15 17:40 +0200

csiph-web