Maneage - Tasks: task #15739, Wishlist - Debian patched stable...
You are not allowed to post comments on this tracker with your current authentication level.
task #15739: Wishlist - Debian patched stable or testing or unstable set of sources
Submitter: | Boud Roukema <boud> | ||
Submitted: | Sun 02 Aug 2020 12:34:23 PM UTC | ||
Should Start On: | Sun 02 Aug 2020 12:00:00 AM UTC | Should be Finished on: | Sun 02 Aug 2020 12:00:00 AM UTC |
Category: | None | Priority: | 5 - Normal |
Status: | None | Privacy: | Public |
Percent Complete: | 0% | Assigned to: | None |
Open/Closed: | Open | Effort: | 0.00 |
Sun 02 Aug 2020 06:45:57 PM UTC, comment #3: |
Boud Roukema <boud>![]() |
Sun 02 Aug 2020 03:20:34 PM UTC, comment #2: However, for the users, we can't guarantee that build instructions within Maneage work with the different software versions. It will be their own responsibility to fix any build failure (for example adding/removing a configuration option).
|
Mohammad Akhlaghi <makhlaghi>![]() |
Sun 02 Aug 2020 03:15:55 PM UTC, comment #1: Thanks for the interesting suggestion Boud.
|
Mohammad Akhlaghi <makhlaghi>![]() |
Sun 02 Aug 2020 12:34:23 PM UTC, original submission:
Following up from https://savannah.nongnu.org/task/index.php?15698, a reasonably straightforward, and reasonably automatable, way of significantly increasing the reliability and quality assurance of software in Maneage would be to provide a Debian option. This option would download as much as possible of the software from Debian, with an option to choose either stable (the best checked, including security checks), testing (moderately checked), or unstable (checked by some people with Debian upload rights).
|
Boud Roukema <boud>![]() |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
comment #1:
I mean the source tarballs (pristine-tar) plus (at least) the debian patches, e.g. https://salsa.debian.org/science-team/gnuplot/-/tree/master/debian/patches or https://salsa.debian.org/debian-astro-team/inhomog/-/tree/master/debian/patches or https://salsa.debian.org/debian-astro-team/cfitsio/-/tree/master/debian/patches .
It's the patches that represent a major part of the Debian quality assurance pipeline in terms of fixing source code.
I definitely don't mean downloading the binaries - the Debian build system is only run on 22 different systems currently (9 official, 13 unofficial).
There may be other steps in the build process - checking parameters in debian/control , for example, that we might also want to implement. The debian/rules file often gives security hardening steps for compilation. The question for each step would be: is the advantage in reliability/security worth the cost in needing more tools?
Applying the patches - in the recommended order!!! - would already, it seems to me, implement a significant part of the benefit of Debian.
Yes, that's definitely a good idea!
Would we want to add "our" archival copies of e.g. the debian stable packages in Zenodo/maneage? Or how long-term are the debian archives of orig tarballs and patch lists?
I guess by "commit the changes", you mean to archive them in Zenodo/maneage? My guess is that's probably reasonable. We could either choose to archive the patched files as a "patched archive" - for simplicity - or in the original debian format - for easier checking against the official debian versions.
In terms of software security and reliability, this would seem a big improvement to me. I know you have good software skills :), but it's hard to believe that you really thoroughly checked all the updates to 20-30 or however many packages you updated.