Re: Documentation on handling of orig.tar.gz files for Developer's Reference or for Debian Policy
On Mon, 01 Nov 2004 10:58:55 +0100, Frank Küster <frank@kuesterei.ch>
said:
> ,----
>> A repackaged .orig.tar.gz [...] must not contain any file that does
>> not come from the upstream author(s), or whose contents has been
>> changed by you.
> `----
That sounds reasonable to me. oir.tar.gz is supposed to be
_upstream's_ sources. not a mix of stuff from upstream plus stuff
added later. It may not have _all_ the upstream provided things, if
we can't distribute them.
> This poses the following questions:
> 2. Do you think that - although alternative methods exist - a binary
> file may be changed or added by creating a new orig.tar.gz file?
No.
> Or do you think this must be done by adding a uuencode'd file (or
> similar) in diff.gz?
That is the eay it is usually done, yes.
> 4. What is the right place to document the changes made to the
> orig.tar.gz file? Some possible places would be
> - the get-orig-source target in debian/rules (see Policy 4.8)
Not visible enough.
> - a README.Debian-source in the debian directory (i.e. in the
> diff.gz)
This sounds fine, since this can then also be shipped with the
binary .deb file.
> - a README.Debian-source file added to the orig.tar.gz
Nothings gets added to the upstream in orig.tar.gz
> Personally, I think that the last possibility should be a
> requirement. The main reason is that I think that our archive should
> be a good source for Free Software even when one does not want to
> use the Debian Operating System (and indeed we provide lots of
> mirrors for software with no or only a couple of mirrors). It would
> be annoying if one had to download the diff.gz just in order to
> learn what was changed in the orig.tar.gz file.
If you get the .dsc fle, or you get the .deb, which are the
units we distribute, you shall have exact;ly what was done to the
upstream tarball. Not having you download the diff.gz is not
valuable enough to destroy the invariant that we add nothing to the
orig.tar.gz, or that everything in the orig.tar.gz came from the
upstream author. Violating these basic invariants for the sake of
something as ephemeral as optimizing for bandwidth would be a
fallacy; bandwidth costs decrease ast. apt-get source foo is as valid
a way of getting sources from debian as any (indeed, getting the
source package may be the _only_ supported way of getting sources
from Debian).
Since the modification is available whenever you get a source
or binary package from Debian, documenting it in a README file in the
debian diff is eminently satisfactory, in my opinion, and it has the
least element of surprise, in that we did not add anything to a file
meant to carry sources from the upstream author.
manoj
--
Well, the handwriting is on the floor. Joe E. Lewis
Manoj Srivastava <srivasta@debian.org> <http://www.debian.org/%7Esrivasta/>
1024D/BF24424C print 4966 F272 D093 B493 410B 924B 21BA DABB BF24 424C
Reply to: