limits for package name and version (MBF alert: ... .deb filenames)

[Osamu Aoki <osamu@debian.org>]

Hi,

In order to manage package file name length below 90 and to have sane
screen for package management, may I suggest to recommend some limits
(for lintian check etc.):

 * package name string should be less than 40 characters.
 * version name string should be less than 30 characters.
   (security updates etc. excluded)

Older part of maint-guide text recommend to use 20 or less for package
name for last 10 years or so.  This may be too short for the modern system
but it is good to have some commonly agreed limits as recommendation.

I will be bumping limit numbers in maint-guide to these.

See below for my rationale with the statistics.

On Thu, Mar 31, 2011 at 01:48:23PM +0100, Steve McIntyre wrote:
> On Wed, Mar 30, 2011 at 09:54:49AM -0300, Henrique de Moraes Holschuh wrote:
...
> >Don't let it go over 250 *bytes* (not characters. UTF-8 and all that...).

Why UTF-8?  We should keep it within ASCII so any system can display all
package file name.  In ASCII range, UTF-8 and ASCII are the same byte
sequence.

> >We really need to curb the long name insanity in the head.  And might as
> >well do it in a way that does not hinder our ability to get data where it
> >is needed, i.e. keep it under 100 chars.
> 
> I'm pushing for a little less than that, then the Joliet problems go
> away. We get an absolute maximum of 103 (Unicode) chars there, so I'm
> going to push for a max of 90 for normal uploads. That allows for
> small amounts of growth for security updates etc.
> 
> >There really is no excuse for such long deb names.  If a naming convention
> >"requires" it, fix the buggy naming convention.

90 is good upper limit but how do we enforce this.

Since this comes from both package name and version strings, let's see
the situation.

Here first number is the length of sting, the second number is number of
such package, and the last number is the cumulative %.
(Data: sid, kfreebsd-amd64)

=== stat for package name string length ===
11 1947 36.9%  --- mode
14 1717 54.7%  --- 50% median
23 611 91.0%   --- 90%
32 89 99.0%    --- 99%
41 12 99.9%    --- 99.9%
52 1 100.0%

Clearly, 20 char is becoming too short for 17% of packages

=== stat for version string length ===
7 8257 53.2%   --- 50% median& mode
12 976 90.1%   --- 90%
20 73 99.0%    --- 99%
30 3 99.9%     --- 99.9%
37 6 100.0%

=== stat for filename string length ===
35 1546 43.4%  --- mode
37 1363 53.0%  --- 50% median
48 569 91.3%   --- 90%
58 61 99.0%    --- 99%
67 11 99.9%    --- 99.9%
76 1 100.0%

Even if we limit the package name to 40 and version string to 30, there
are not much issue.  There is no real impact to the archive as the
following:

=== package name, strings longer than 41 ===
libbusiness-onlinepayment-authorizenet-perl
libbusiness-onlinepayment-transactioncentral-perl
libcgi-application-basic-plugin-bundle-perl
libcgi-application-extra-plugin-bundle-perl
libcgi-application-plugin-anytemplate-perl
libcgi-application-plugin-authentication-perl
libcgi-application-plugin-authorization-perl
libdata-formvalidator-constraints-datetime-perl
libdist-zilla-plugin-changelogfromgit-perl
libdist-zilla-plugin-podspellingtests-perl
libfusioninventory-agent-task-netdiscovery-perl
libfusioninventory-agent-task-ocsdeploy-perl
libfusioninventory-agent-task-snmpquery-perl
libghc6-syb-with-class-instances-text-prof
libglobus-gram-job-manager-callout-error-dev
libglobus-gram-job-manager-callout-error-doc
libjifty-plugin-authentication-bitcard-perl
libjifty-plugin-authentication-facebook-perl
libmoosex-emulate-class-accessor-fast-perl
libmoosex-meta-typeconstraint-forcecoercion-perl
libnet-nationalrail-livedepartureboards-perl
libnet-rendezvous-publish-backend-avahi-perl
libpentaho-reporting-flow-engine-java-openoffice.org
libsyntax-highlight-engine-simple-languages-perl
libtest-http-server-simple-stashwarnings-perl
tryton-modules-account-invoice-line-standalone
tryton-modules-purchase-invoice-line-standalone

All of these are able to wrap name within 40 chars.
(At least less than 50.  only one package exceeds it.)

=== version, strings longer than 30 (unique ones) ===
0.9.15+post20100705+gitb3aa806-2
0.0.0+git20091215.9ec1da8a-2+b2
1.0.0~alpha3~git20090817.r1.349dba6-2
1:2.5.0~alpha4+svn20091009-1+b2
2.1.14+2.6.32.13-201005151340-1
1:2.2cvs20100105-true-dfsg-5+b1
0.9.8+hg20101101.b35a000870cc-1
0.5.10~alpha0+git201005030944-2
1.1.1+ooo-build3.0.0.9+r14588-9
1.2.0~pre3+snap20071004+dfsg-3+b1
3.0~a2+hg1075.9a478044c65c~dfsg1-1

Clearly, all of these are able to wrap name within 30 chars.

I mean there is no reason to have more than 10 uploads a day, timestamp
is best to be limitted less than 11 chars.  Hush can be shortened as
needed.  So it is very easy to keep this within 30 chars.

With these for normal upload, we can meet 
  package(40) + "_" + version(30) + "_kfreebsd-amd64.deb" => 90 characters

Regards,

Osamu