Bug#850156: Please firmly deprecate vendor-specific series files
Package: dpkg-dev, debian-policy
Version: 1.17.27, 3.9.8.0
dpkg-source has a surprising and not-very-well-documented feature,
that it is possible to have in a `3.0 (quilt)' package a
vendor-specific series file, which is used only if the vendor matches
that of the running host.[1]
This feature is a very bad idea. I can see why people thought it
might be nice: it means you can use the same (or very similar) .dsc
(and perhaps vcs history) on different distros.
But it is quite wrong, because it means that the same source package
has different "contents" on different computers.
For example, if I am a Debian contributor and I download the Ubuntu
version of the package and build it to see how it works, I actually
get the Debian version. And vice versa.
The version of the package you get should depend on where you got the
package from, not where you are looking at it.
There are only a handful of packages in current Debian that use this
feature.[2]
Concretely, I would like the following changes made:
In dpkg-source:
* Remove all traces of this feature from the documentation, except to
mention it in the source format 3.0 description as a deprecated
feature.
* Whenever a package is being extracted has a non-default series
file, print a big warning (regardless of whether the non-default
series file is going to be used).
* Warn that dpkg-source in buster will refuse to generate a `3.0
(quilt)' source package containing non-default series files.
* Warn that dpkg-source in buster will never apply anything other
than the default series file (reestablishing a uniform meaning of
all source packages on all computers).
In policy:
* Say that a package MUST NOT contain a non-default series file.
(obviously with an expectation that these newly-declared RC bugs
will not be fixed in stretch)
(And the consequential lintian change.)
I am not yet supplying patches for dpkg-source and for policy, because
I think deprecating this feature will involve some discussion.
Ian.
PS: Of course I have an angle. dgit depends on the assumption that a
source package means a particular tree. This feature breaks that
assumption, and as a result dgit must always fail on packages where
this feature is in use.
[1]
in dpkg.git, 4fa01b70df1dc4458daee306cfa1f987b69da58c
"dpkg-source: correctly create .pc/.quilt_series with alternate series files"
[2] In private email, Guillem wrote to me:
It seems it is "documented" (not very explicitly though, search for
/debian\.series/ in dpkg-source(1)). And several (but not many)
packages at least in Debian use this:
,---
$ apt-file -x -I dsc search 'debian/patches/.*\.series'
ddccontrol: /debian/patches/ubuntu.series
deluge: /debian/patches/ubuntu.series
fail2ban: /debian/patches/neurodebian-backport.series
hexchat: /debian/patches/ubuntu.series
libfreenect: /debian/patches/neurodebian-backport.series
libxbean-java: /debian/patches/bootstrap.series
libxbean-java: /debian/patches/full.series
libxfce4util: /debian/patches/ubuntu.series
lilo: /debian/patches/ubuntu.series
mixxx: /debian/patches/ubuntu.series
packagekit: /debian/patches/ubuntu.series
qjackctl: /debian/patches/ubuntu.series
smuxi: /debian/patches/ubuntu.series
xfce4-smartbookmark-plugin: /debian/patches/ubuntu.series
zlib: /debian/patches/debian.series
`---
Not sure if this is more widespread in other derivatives.
--
Ian Jackson <ijackson@chiark.greenend.org.uk> These opinions are my own.
If I emailed you from an address @fyvzl.net or @evade.org.uk, that is
a private address which bypasses my fierce spamfilter.
Reply to: