Hi, On 2/10/22 6:55 PM, Sam Hartman wrote:
Over time, if people see the value in migrating toward something more people understand, the probability of people seeing the value and migrating increases.
What we are absolutely missing is a workflow for software that does not have well-defined releases that are supported by upstream, or that release through separate packaging infrastructure with a different feature set than ours, but this is largely not a technical problem, but a social one.
The technical side is easy: we already know how to ship arbitrary snapshots from git, and for situations like in npm where multiple version-locked dependencies might need to be co-installable, we can probably think of a mapping onto package names that allows us to do so.
On the social side, our users have a certain expectation of support for a stable release that we have cultivated over the years, and this has usually been with explicit help from upstream, because we can neither expect packagers to also become upstream maintainers for out-of-support versions nor users to update to unstable or experimental versions before reporting a problem.
Users of the npm ecosystem have different expectations than traditional Debian users: their infrastructure is online-only, fast-paced, support for older versions is less expected, but dependencies on older versions can be expressed and will be honoured.
Resolving this conflict will require more than a change in workflow, and I'd argue that packages where this conflict does not exist are already well served with the two major existing workflows ("version control in the Debian archive" and "version control in git, with salsa").
Simon
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature