[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: quilt 3.0 source format and dpkg-source/dpkg-buildpackage

Charles Plessy <plessy@debian.org> writes:

> In my opinion, much of the current disagreements come from two false needs:

>  * Apply patches so that dpkg-source -x gives buildable source.

That was the need that had as much or more project consensus as anything
else on my list, and as I recall was the impetus for doing the whole
next-generation source format work in the first place.

> I remember the discussion that took place during DEP1 preparation. It
> already had the outcome that the main patch systems converged on a
> common interface:

>  - Store the patches in debian/patches;
>  - Apply them with ‘debian/rules patch’;
>  - Document specificities in debian/README.source.

If I'm not mistaken, that convergence and standardization actually
happened *after* the 3.0 work was mostly finished.  Certainly after the
2.0 work.

> There were some concerns that applying patches through debian/rules
> could be a security hole. In my opinion – that I already expressed in
> the DEP1 discussion – given that 1) dpkg-source will not extract
> packages that are not GPG-trusted,

Eh?  I'm fairly sure it does for me, although it prints a warning.

> Personnaly, I am completely unconvinced of the necessity of applying
> patches at unpack time, nor of standardising on one particular patch
> implementation instead of using a clear patch interface as the one above
> (parts of which being already in the Debian Policy). If I am not the
> only one having this concern, maybe we could ask the technical comittee
> to give us its conclusions on this matter. I am ready to follow it.

I personally don't have a strong opinion, but there were a lot of people
who felt this was important during the initial discussions.

Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>

Reply to: