Source packaging - alternatives

[Ian Jackson <ian@chiark.chu.cam.ac.uk>]

I've been reading the discussion ...

Firstly, I'm glad to have disposed of the `byte-for-byte original
source archive' idea (and that some of the people I thought were
advocating this were merely advocating that we should be able to
extract the original source files somehow from our source archive,
perhaps in a differently named directory or some such).

It seems to me that the `we want a single file' idea is perhaps
starting to be a problem, and that some of the alternatives people
have suggested may have some merit.

I'll therefore describe to you an alternative proposal to the one I
described last weekend (the one with a single `ar' archive).  I'd like
to see more discussion about this, as I'm still not convinced that all
the possible issues have been raised.

Please don't bother having long flamewars about the merits of one
thing versus another if you're just trying to convince the other
people of your correctness.  It's me and Bruce you need to convince, I
think :-).

Here's the alternative I've dreamed up:

* The source package is three files:

 - hello_1.4-3.dsc
  DSC= Debian Source Control (suggestions for better extensions
  welcome).  This contains a dchanges/debian.control-like format, for
  example:
    Source: hello
    Version: 1.4-3
    Architecture: any
    Depends: gcc         { standard dpkg control file syntax }
    Generates: hello     { names of binary packages, comma-separated }
    Data-MD5sums:
     faa56f7d564b1972f66a2d17ddf97413  hello_1.3-4.diff.gz
     d2cb670eee141fc08eaa4a794b8b68fe  hello_1.3.orig.tar.gz
  This would optionally be PGP-signed.  The `Architecture: any' means
  that the source is arch-independent, but the binary isn't.
  `Architecture: all' would mean it was a truly arch-independent
  package (documentation, for example).

 - hello_1.3-4.diff.gz
  The Debianisation diff, as we have now.

 - hello_1.3.orig.tar.gz
  The original source code, reorganised if necessary into a tarfile
  that unpacks into a subdirectory called hello-1.3 or perhaps
  hello_1.3.

* Issues:
 - Perhaps we need to think again about these hyphens in the context
  of source packages, so that we can distribute GNU source tarfiles
  unchanged.

 - Uploading a new package which only has changes to the diff becomes
  trivial.  You have to supply a new .dsc and a new .diff.gz, but you
  can just name the old original source in the .dsc.

 - We need a dpkg-source script to unpack the tarfile and apply the
  diff safely (and it can automatically change debian.rules to be
  exectutable), but people can do it themselves if they want.  Also,
  we need a dpkg-source script which runs diff and checks that there
  are no differences that diff can't handle (deleted files, retargeted
  links, &c).

 - We need to store the .dsc somewhere when the source is `opened up',
  ie, made into a filesystem tree.  Either this should be put
  somewhere when dpkg-source unpacks an archive, or perhaps it should
  have some canonical name in the Debianized source archive
  (debian.sourcecontrol perhaps).  The dpkg-source script can produce
  the Data-MD5sums and Version fields, and check the Source field, so
  only Soource, Architecture, Depends and Generates would be needed
  here.

* As a reminder, the `one file' format I favour at the moment is an `ar'
archive with members for the control file, diff, original source
tarfile and optionally signature.

Ian.