Re: third-party packages adding apt sources

From	Ian Jackson <ijackson@chiark.greenend.org.uk>
Newsgroups	linux.debian.project
Subject	Re: third-party packages adding apt sources
Date	2016-05-19 20:20 +0200
Message-ID	<rAAIb-3fU-49@gated-at.bofh.it> (permalink)
References	<rAxTX-1sm-3@gated-at.bofh.it> <rAzCp-2Bt-13@gated-at.bofh.it> <rAzM5-2EV-5@gated-at.bofh.it> <rAAf7-2QX-15@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Bas Wijnen writes ("Re: third-party packages adding apt sources"):
> On Thu, May 19, 2016 at 07:15:01PM +0200, Daniel Pocock wrote:
> > Another thing comes to mind: making sure that even if the user
> > explicitly allows some other repository, they are protected from package
> > updates that come along and replace other things like apt itself, libc,
> > bash, gnupg, ...
> 
> I don't think we want to prevent that.  If they want to install a
> package that does that, they can.  However, I think it is reasonable
> to warn them that they should get ready for trouble when installing
> a package that isn't from Debian, and especially if they install a
> new entry into sources.list from an external source.
> 
> I don't see how to technically do such a thing though; the problem is that
> these kind of upstreams often don't care about our (or their user's) systems
> and will inject any code in their package that makes the warnings go away.

If we provided a better, more official, way, that gave the relevant
software provider some kind of semi-approval, then we could probably
persuade the upstreams to start using it.

But I agree that playing core wars against the third party repo
packages is a really really bad idea.  It won't work.  It's a recipe
for craziness.  And it's unethical because it also amounts to playing
core wars against our users - who have, after all, probably decided
that this is what they want.

Ian.

Thread

third-party packages adding apt sources Daniel Pocock <daniel@pocock.pro> - 2016-05-19 17:20 +0200
  Re: third-party packages adding apt sources Paul Tagliamonte <paultag@debian.org> - 2016-05-19 17:50 +0200
    Re: third-party packages adding apt sources Bas Wijnen <wijnen@debian.org> - 2016-05-19 19:00 +0200
      Re: third-party packages adding apt sources "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-05-19 19:10 +0200
      Re: third-party packages adding apt sources Mike Hommey <mh@glandium.org> - 2016-05-20 00:40 +0200
      Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-20 07:30 +0200
        Re: third-party packages adding apt sources Antonio Terceiro <terceiro@debian.org> - 2016-05-20 14:00 +0200
          Re: third-party packages adding apt sources The Wanderer <wanderer@fastmail.fm> - 2016-05-20 14:30 +0200
          Re: third-party packages adding apt sources Ole Streicher <olebole@debian.org> - 2016-05-20 15:00 +0200
            testing is a tool for the release team (Re: third-party packages  adding apt sources Holger Levsen <holger@layer-acht.org> - 2016-05-20 15:10 +0200
          Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-20 20:40 +0200
        Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 08:10 +0200
      Re: third-party packages adding apt sources Tollef Fog Heen <tfheen@err.no> - 2016-05-20 14:50 +0200
    Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 20:20 +0200
  Re: third-party packages adding apt sources Russ Allbery <rra@debian.org> - 2016-05-19 17:50 +0200
    Re: third-party packages adding apt sources Holger Levsen <holger@layer-acht.org> - 2016-05-19 18:00 +0200
  Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 19:10 +0200
    Re: third-party packages adding apt sources Daniel Pocock <daniel@pocock.pro> - 2016-05-19 19:20 +0200
      Re: third-party packages adding apt sources Bas Wijnen <wijnen@debian.org> - 2016-05-19 19:50 +0200
        Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 20:20 +0200
      Re: third-party packages adding apt sources Russ Allbery <rra@debian.org> - 2016-05-19 20:20 +0200
      Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 20:20 +0200
    Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-20 07:40 +0200
      Re: third-party packages adding apt sources Charles Plessy <plessy@debian.org> - 2016-05-20 11:40 +0200
      Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 08:10 +0200
        Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 08:50 +0200
          Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 09:00 +0200
            Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 09:10 +0200
        Re: third-party packages adding apt sources Lars Wirzenius <liw@liw.fi> - 2016-05-21 09:40 +0200
          Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 10:30 +0200
          Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 10:30 +0200
            Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 11:00 +0200
              Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 11:30 +0200
        Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 10:10 +0200
          Re: third-party packages adding apt sources Lars Wirzenius <liw@liw.fi> - 2016-05-21 10:40 +0200
            Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 11:20 +0200
      Re: third-party packages adding apt sources Ole Streicher <olebole@debian.org> - 2016-05-21 10:00 +0200
        Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 11:00 +0200
  Re: third-party packages adding apt sources Hakan Peker <holypeker@manlymail.net> - 2016-05-19 19:50 +0200
    Re: third-party packages adding apt sources Vincent Danjean <vdanjean.ml@free.fr> - 2016-05-20 21:40 +0200
      Re: third-party packages adding apt sources Hakan Peker <holypeker@manlymail.net> - 2016-05-22 16:50 +0200
        Re: third-party packages adding apt sources Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2016-05-22 17:10 +0200
  Re: third-party packages adding apt sources Charles Plessy <plessy@debian.org> - 2016-05-21 05:50 +0200
  Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 07:50 +0200
    Re: third-party packages adding apt sources Adam Borowski <kilobyte@angband.pl> - 2016-05-21 14:40 +0200
      Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-22 03:50 +0200

csiph-web