[maemo-developers] Application Manager and Extras-devel: Dealing with unstable software

[From: Ryan Abel]

Let's say you've got a user, and this user wants to get to something  
shiny, but the only place this something shiny is available is from an  
unstable testing repository. Normally this unstable testing repository  
would not be the sort of place this user would venture into, but the  
application is only there because a few minor packaging issues have to  
be wrapped up (maybe the l10n is split up into a bunch of separate  
packages); or there's just a few more bugs they want to stomp out; or  
they want to give it a week or two of testing before they push it to  
the unstable repository--whatever, so the user decides (perhaps with  
the encouragement of some of their peers) to dive in, add the unstable  
repository and install the application.

So the application installs and runs fine. Perhaps they encounter a  
few of those small bugs that are still being worked on, but nothing  
serious. A few weeks pass without issue, and they see a notification  
for some new updates to a few of their favorite applications, go to  
install them and BAM! one wont install due to a messed up postinst,  
the next now crashes on start and the last now randomly loses data.

What happened? Developers using that unstable testing repository as an  
unstable testing repository uploaded some new unstable versions of  
their applications for some testing, and our poor user ended up as  
collateral damage. So the question is, what can we do to protect users  
from the full fury of Extras-devel while still giving them reasonable  
access to some of the stabler applications in the repository?

Clearly there are a few issues at play here: developers moving  
software to Extras-devel before it's ready (critical crasher or data- 
lose bugs, etc), developers leaving applications in Extras-devel for  
too long (no real bugs, just sitting there unpromoted), and Extras  
lacking a finer granularity of stability levels. The first two can be  
dealt with (up to a point) through developer education, but the last  
can't really be addressed (although I'd be interested if there's any  
history or particular inertia behind the 2-tier setup we have now).  
Simple user education will also have a large effect (yes, you can  
install this, but disable this repository when you're done).

Those issues aside, what can we do at an application level to improve  
the user experience here? An opt-in system for Extras-devel updates  
and installs might be useful (rather than offering the Extras-devel  
version, the user has to request it specifically), visual cues to a  
packages origin (color coding, a small icon) and notices might also  
help ("this package is unstable software, and may contain many  
significant bugs, are you sure you want to install it?"), or even some  
sort of apt pinning system to ignore certain updates.

What are your ideas?

--
Ryan Abel
Maemo Community Council chair