[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Bug#161593: apt-utils: apt-ftparchive fumbles on signed debs



On Sun, Sep 22, 2002 at 10:08:26PM -0700, Randolph Chung wrote:
> > Apt refusing to deal with ar files that have the Debian components in
> > the proper order, but which were generated by the only ar program that
> > Debian provides is *perverse*.
> 
> The patch to handle the / case in apt is a one-liner. I can commit 
> that (again) into apt... but I agree with Jason's point that we need 
> to be careful about this -- GNU ar format is more than just /, so if 
> we are really commiting to support that, there're many more changes 
> that need to happen in dpkg/apt, and I'm not sure that's where we want 
> to go...

We should be liberal in what we accept and conservative in what we
generate.  For years we've said .debs are "just ar files", but we
committed ourselves to a SysV-style ar(1) on the system a long time ago.
Something's got to give.

> it seems to be reasonable that "standard" Debian deb creation tools 
> should create debs in the same format.... debsigs shouldn't be silently
> converting debs to different ar formats....

It only did so because I shared the completely ridiculous assumption
that you could create a Debian package ("which is just an ar file")
using the ar(1) command.

I don't mind changing debsigs to generate a more politically-correct
Debian package file format.  What I mind is the pretense that the
actual behavior of the ar(1) command doesn't matter, and can be safely
ignored; that is, we don't have to actually fess up to the fact that
we've been deceiving people about the practicality of being able to use
"standard tools" to "manipulate Debian packages".

At the very least, Debian should provide a BSD-style ar command that
will operate on .deb files in a politically correct fashion.  I'm open
to suggestions for what it should be called, and (I'm going to regret
this), I'm even prepared to package it.

However, I think a *better* solution is:

1) Make dpkg and apt understand SysV/GNU ar files; *and*
2) Patch ar from GNU binutils to be able to generate BSD-style ar files; and
3) Prominently document the requirements we make of .deb files in deb(5).

-- 
G. Branden Robinson                |          You live and learn.
Debian GNU/Linux                   |          Or you don't live long.
branden@debian.org                 |          -- Robert Heinlein
http://people.debian.org/~branden/ |

Attachment: pgpJQz4lnPSAm.pgp
Description: PGP signature


Reply to: