Re: About language specific package management tools
On Mon, Jan 26, 2015 at 02:15:22PM +0000, Sam Hartman wrote:
> One huge advantage of teaching our package management tools to
> understand alternate package technologies and convert on the fly is that
> we can use the mirror networks of the language-specific packages.
> Unfortunately, we're fairly picky about licensing issues and legal
> distributability of packages.
The above's fair. But I don't think you can say:
> That's a significant value we add to Debian and it's really important.
and then go on to say that it's hard so we should just wash our hands of
the responsibility by letting our users go direct to upstream and deal
with the problems themselves. Either it's valuable and it's worth doing,
or it's not worth worrying about and not actually that valuable.
It's not like the problem goes away if Debian ignores it: it still hits
the upstream (distributing it in the first place), their mirror network
(redistributing), and users (who might base their code or systems on
libraries that they don't have any right to actually use).
> However, we'll probably find that if
> we tried to automate something we'd discover legal problems.
The fact that CPAN, PyPI and others exist and function puts an upper
bound on the problems that there are to be discovered. It's something
they can manage, so it's something we could manage too.
It's entirely possible that having two levels of vetting would be valuable
to our users -- ie, our current level of NEW checking for "main", and
a CPAN/PyPI/etc "minimal effort" level of checking for "extras". That's
not much different to the main vs non-free split we already have, except
that in this case it'd still be all about promoting free software.
> We'd
> discover confirming DFSG status difficult if we tried and that there are
> probably packages out there our users want that really when you look at
> it aren't actually even redistributable.
That already happens occassionally with stuff in main, cf:
http://snapshot.debian.org/removal/
Cheers,
aj
Reply to: