Re: third-party packages adding apt sources

From	Lars Wirzenius <liw@liw.fi>
Newsgroups	linux.debian.project
Subject	Re: third-party packages adding apt sources
Date	2016-05-21 09:40 +0200
Message-ID	<rB9FT-H1-3@gated-at.bofh.it> (permalink)
References	<rAxTX-1sm-3@gated-at.bofh.it> <rAzCp-2Bt-13@gated-at.bofh.it> <rALkd-1uD-1@gated-at.bofh.it> <rB8gN-8mi-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sat, May 21, 2016 at 02:07:53PM +0800, Paul Wise wrote:
> On Fri, May 20, 2016 at 1:34 PM, Vincent Bernat wrote:
> 
> > Totally agree. Our standards are far too high for many upstreams.
> 
> I don't understand the disconnect here. Are upstreams not interested
> in software quality to the extent we are?

I don't think it's that upstreams aren't interested in quality, but
that Debian and (some) upstreams have different opinions on what
aspects of quality are more important.

* Debian: don't embed copies of libraries you use. It makes it harder
  to do security updates in the libraries, makes it harder to use the
  libraries on their own, and makes the Debian package archive
  unnecessarily larger.

  Some upstreams: we embed copies of libraries. It makes it easier to
  install our software, and guarantees us that the library doesn't
  change from underneath us, and that means we don't need to support
  many versions of the library. We're an active project, and if a
  library needs a security update, we do it quickly.

* Debian: it's important to follow Debian Policy and the Debian
  workflow of uploading to unstable and letting packages flow from
  there to testing and stable, if they don't have bad bugs. There's
  thousands of people making packages and things will break if they
  all do the same thing differently.

  Some upstreams: it's OK to cut some corners and do things simply. We
  care about getting the software into the hands of its users as soon
  as possible, and we also don't have a lot of time to spend on
  packaging. From our point of view, packaging is a necessary evil
  that is much too difficult and takes much too much time from us.
  That's effort we could spend on making the software better instead.

* Debian: it's important to have package versions that can be
  supported for many years. We produce a release every two years, and
  support it for at least three, and more if one counts the LTS
  project. Software that changes a lot, or that has an API that
  changes a lot, or that doesn't separate security updates and
  backport those to the version included in a Debian release, make
  this harder for us. We can't generally update to a new upstream
  release whenever there is a security problem, as it would negate the
  point of making Debian releases. For example, the new upstream
  version might require entirely new forests of dependencies, or newer
  versions of dependencies, all the way down to the kernel. For some
  packages that we deem sufficiently important to our users, we deal
  with that, but it is not something that generalises to all packages.

  Some upstreams: we don't support our old releases. We have only so
  much time to spend on this software, and supporting old releases
  would take a lot of effort we don't have time for. That's why we
  embed most of our dependencies into the installation packages we
  make, so that they can be installed onto the Debian releases, even
  if we decide to require more dependencies, or newer versions of
  them.

Et cetera. Debian has one set of quality factors it particularly cares
about, and some upstreams think differently.

-- 
Schrödinger's backup hypothesis: the condition of any backup is
undefined until a restore is attempted. -- andrewsh

Thread

third-party packages adding apt sources Daniel Pocock <daniel@pocock.pro> - 2016-05-19 17:20 +0200
  Re: third-party packages adding apt sources Paul Tagliamonte <paultag@debian.org> - 2016-05-19 17:50 +0200
    Re: third-party packages adding apt sources Bas Wijnen <wijnen@debian.org> - 2016-05-19 19:00 +0200
      Re: third-party packages adding apt sources "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2016-05-19 19:10 +0200
      Re: third-party packages adding apt sources Mike Hommey <mh@glandium.org> - 2016-05-20 00:40 +0200
      Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-20 07:30 +0200
        Re: third-party packages adding apt sources Antonio Terceiro <terceiro@debian.org> - 2016-05-20 14:00 +0200
          Re: third-party packages adding apt sources The Wanderer <wanderer@fastmail.fm> - 2016-05-20 14:30 +0200
          Re: third-party packages adding apt sources Ole Streicher <olebole@debian.org> - 2016-05-20 15:00 +0200
            testing is a tool for the release team (Re: third-party packages  adding apt sources Holger Levsen <holger@layer-acht.org> - 2016-05-20 15:10 +0200
          Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-20 20:40 +0200
        Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 08:10 +0200
      Re: third-party packages adding apt sources Tollef Fog Heen <tfheen@err.no> - 2016-05-20 14:50 +0200
    Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 20:20 +0200
  Re: third-party packages adding apt sources Russ Allbery <rra@debian.org> - 2016-05-19 17:50 +0200
    Re: third-party packages adding apt sources Holger Levsen <holger@layer-acht.org> - 2016-05-19 18:00 +0200
  Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 19:10 +0200
    Re: third-party packages adding apt sources Daniel Pocock <daniel@pocock.pro> - 2016-05-19 19:20 +0200
      Re: third-party packages adding apt sources Bas Wijnen <wijnen@debian.org> - 2016-05-19 19:50 +0200
        Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 20:20 +0200
      Re: third-party packages adding apt sources Russ Allbery <rra@debian.org> - 2016-05-19 20:20 +0200
      Re: third-party packages adding apt sources Ian Jackson <ijackson@chiark.greenend.org.uk> - 2016-05-19 20:20 +0200
    Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-20 07:40 +0200
      Re: third-party packages adding apt sources Charles Plessy <plessy@debian.org> - 2016-05-20 11:40 +0200
      Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 08:10 +0200
        Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 08:50 +0200
          Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 09:00 +0200
            Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 09:10 +0200
        Re: third-party packages adding apt sources Lars Wirzenius <liw@liw.fi> - 2016-05-21 09:40 +0200
          Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 10:30 +0200
          Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 10:30 +0200
            Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 11:00 +0200
              Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 11:30 +0200
        Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 10:10 +0200
          Re: third-party packages adding apt sources Lars Wirzenius <liw@liw.fi> - 2016-05-21 10:40 +0200
            Re: third-party packages adding apt sources Martin Steigerwald <martin@lichtvoll.de> - 2016-05-21 11:20 +0200
      Re: third-party packages adding apt sources Ole Streicher <olebole@debian.org> - 2016-05-21 10:00 +0200
        Re: third-party packages adding apt sources Vincent Bernat <bernat@debian.org> - 2016-05-21 11:00 +0200
  Re: third-party packages adding apt sources Hakan Peker <holypeker@manlymail.net> - 2016-05-19 19:50 +0200
    Re: third-party packages adding apt sources Vincent Danjean <vdanjean.ml@free.fr> - 2016-05-20 21:40 +0200
      Re: third-party packages adding apt sources Hakan Peker <holypeker@manlymail.net> - 2016-05-22 16:50 +0200
        Re: third-party packages adding apt sources Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2016-05-22 17:10 +0200
  Re: third-party packages adding apt sources Charles Plessy <plessy@debian.org> - 2016-05-21 05:50 +0200
  Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-21 07:50 +0200
    Re: third-party packages adding apt sources Adam Borowski <kilobyte@angband.pl> - 2016-05-21 14:40 +0200
      Re: third-party packages adding apt sources Paul Wise <pabs@debian.org> - 2016-05-22 03:50 +0200

csiph-web