Package verification and "/usr/bin/install" tool replacements

[Kim Lester <kim@dfusion.com.au>]

Although debian packages may contain md5sums it seems package 
verification is
not available (unless I have missed something).

Also I find the traditional /usr/bin/install type tools rather 
primitive.

As I understand it a debian pkg relies on information in the tar 
archive itself
to store this information.

I had need for both a package verification tool (including minor repair 
abilities)
as well as the ability to verify/fix file/dir/link user/goup IDs and 
modes.
I have developed a pkg system which meets my needs and it happens to be
very similar to the debian system. I would like to move to a debian pkg 
system
but I want to introduce the tools and features of my system.

Some of the ideas I have implemented include a "pkg info" file in each 
package
containing the
	pathname
	uid, gid (numeric)
	md5sum,
	size (useful to humans)
	mode
	symlink target (for symlinks)

a pkgverify command can be run on an installed package and the contents 
of this
pkginfo file are used to ensure the pkg is installed correctly. The 
tool can also optionally
correct missing/broken dirs, symlinks  as well as uid, ,gid, mode info.

The second tool is an install configuration tool.
Say you have built an application you want to deploy. In this case 
we'll assume
it is home-grown and not a 3rd party pkg using configure (for eg).
You have a bunch of files which need to be installed in several 
locations, eg
/usr/local/bin  or /usr/local/pkgname/bin, etc  and so on
Hand crafting a set of "/usr/bin/install" comands is messy.

I have developed a tool that takes a simple file format and uses it to
construct an install tree. It also constructs the pkginfo file I 
mentioned above.
The benefit of this approach is ease of admin and uniformity of results.
It has various nice features like being able to produce multiple 
install trees
(for example a developer-install tree which has include files, or a 
runtime tree
which omits developer info). It is fully configurable and quite simple 
to use.

The third core tool assumes you have a 3rd party program say using 
configure which
does produce a respecable install tree (probably using /usr/bin/install 
itself).
This new tool is like a super-smart find which runs through the local 
copy of the install
tree and constructs the install config file that would otherwise need 
to be built by hand,
It does nice things like grouping include files and man pages into 
separate logical groups.

I have used these tools (and others) to manage some 600 machines with 
around 120,000
files on each split into a few hundred debian-like packages so I know 
it works well.

I'd be interested in sharing this with the debian community if there is 
enough
enthusiasm and incentive to help build these features into the debian 
system
over the next few months.

regards
	Kim