Hello, On Sat 04 Aug 2018 at 03:28PM -0700, Josh Triplett wrote: > First of all, this isn't something we should allow arbitrary packages to > use. If we have to do this at all, I'd suggest that we explicitly say > that packages should *not* do this in general, and that if they must do > so, any such usage should be explicitly discussed and approved on > debian-devel first, and only after determining that no other mechanism > will work. > > Second, I don't think it's appropriate to guarantee that any package > *other* than those with declared Build-Depends will exist. It's > completely reasonable to build a package with a repository containing > nothing other than its build-dependencies. > > Third, under normal circumstances you are *not* required to have deb-src > lines in sources.list. This would be the first instance I'm aware of > that would require that. > > In the absence of some specific dependency mechanism, this seems like a > fast way to end up with packages that will only build in particular > environments that aren't fully described by their declared requirements > in debian/control. > > Why don't we make a specific exception for d-i in the short term, in the > hopes that in the long term we'll have a way to handle dependencies on > sources (and, for that matter, ways to incorporate the Build-Depends of > another package into your own Build-Depends, though sometimes you'll > just need a subset). I concur with Jonathan and Josh. There are very good reasons for ensuring that these source build dependencies are declarative. We don't know how to do that yet. So, let's rework Ian's patch to note that d-i has an exception, in that it is allowed to access apt repositories. Once we have a better solution actually in use in the archive, it can be written down in Policy. -- Sean Whitton
Attachment:
signature.asc
Description: PGP signature