[maemo-developers] Repositories mess: conclusions and actions

[From: Steve Greenland]

According to Tim Teulings <rael at edge.ping.de>:
> Note that debian FTP master as far as I know only check license stuff
> and similar - they do not check the application itself

True.

> The Linux community distributions handle quality differently. They use 
> same small initial checks and then a staged repository. Debian still has 
> a policy and style guides and similar and tries to do automatic checks 
> that guarantee compliance with these guides. However most the actual 
> "crashes" bugs are notices after the software initially entered the 
> repository. In this case a "guide" is still good (and you always get 
> your bugs fixes if it violates the guide ;-)) but quality get a much 
> more diffuse meaning. I'm sure that debian has a number of applications, 
> that don't fulfill all the requirement in the guide.

Depends. The "guide" (aka the Debian Policy Document, aka "policy")
distinguishes between "musts" and "shoulds". Violations of "musts" are
considered Release Critical bugs, violations of "shoulds" are non-RC
bugs. Specific exceptions for specific packages have been made, when
justified.

> In the case we do not need a guide first, but the process will come   
> first and then the guide will develop.                                

Arg. No. The guide is critical. That doesn't mean the first release has
to be perfect, and that it will not evolve, but you need guidelines.
There's a lot of stuff in Debian policy that isn't directly related to
good or bad, but simply choices. Consistency is an extremely valuable
quality, and there's simply no way to encourage it (must less enforce
it) without documented policy.

And while there's quite a lot in Debian Policy that may not apply, or
needs to be reconsidered for the tablet environment, there's a lot
that could be adopted as is. It's certainly better than starting from
scratch. And gratuitous differences should be avoided like the plague.

> The problem is: How to assure that still no important bug (that for
> example kills my device) gets through.

You'll never ensure this. What you can hope is that packages that move
from whatever-we-call-unstable to whatever-we-call-testing have had at
least a few testers before the move. (I'm specifically using "testing"
and not "stable" because I think the Debian idea of the testing repo is
more apropos to the tablet needs.)

I also want to point out the classic "the perfect is enemy of the
good enough". The processes and documents can, and should, evolve as
the needs of the audience and developers evolve. But almost anything
would be an improvement to the existing situation. In particular, the
current situation of encouraging random repositories has absolutely no
protection against bad packages (or malicious packages). Just getting
the all the current .debs, no matter what the source, into the same repo
would be an improvement, because you could remove the bad package from
distribution immediately, rather than having to somehow spread the word
that package foo in repo bar should be avoided.

Regards,
Steve


-- 
Steve Greenland
    The irony is that Bill Gates claims to be making a stable operating
    system and Linus Torvalds claims to be trying to take over the
    world.       -- seen on the net