Re: [PATCH v2] i386-pc: build verifiers API as module

[Colin Watson]

On Wed, Apr 14, 2021 at 03:22:35PM +0200, Daniel Kiper wrote:
> On Tue, Apr 13, 2021 at 12:13:02PM +0800, Michael Chang via Grub-devel wrote:
> > On Mon, Apr 12, 2021 at 03:15:53PM +0200, Daniel Kiper wrote:
> > > On Fri, Mar 26, 2021 at 06:01:01PM +0100, Daniel Kiper wrote:
> > > > After some thinking it seems to me we can do this. I can take "i386-pc:
> > > > build verifiers API as module", "kern/misc: Move grub_printf_fmt_check
> > > > to gfxmenu" and similar patches into 2.06. I will revert after the
> > > > release all the patches which adds ifdefery or make code ugly and do not
> > > > benefit other platforms than i386-pc. This way you will have support for
> > > > small MBR gaps in 2.06 and I will have clean code after 2.06 release.
> > > >
> > > > Does it work for you guys?
> > >
> > > Does anybody care?
> >
> > Could you please consider not reverting them ? For me it is worse than
> > keeping them as distribution specific patch, as we will have a hard time
> > to explain what's going on when we have to reintroduce them in rebasing
> > to commits later to 2.06.
> 
> Colin, Michael, how long are you going to support small MBR gaps?

Quite honestly?  My intention is to continue supporting them until
there's no viable technical alternative, or until somebody figures out
how to effectively (and ethically!) collect data indicating that the
number of affected users is negligible.  Given the complexity of fixing
affected systems, and Debian's long-standing commitment to incremental
upgrades, I find myself unable to justify breaking systems in this state
when it's something I can avoid.  Clean code is a noble enough goal, but
I rank it lower than maintaining the ability for real systems in the
wild to upgrade.

I certainly expect that the number of affected systems will decrease
organically over time, though I have little intuition for the absolute
numbers involved.  The only real (anec)data point I have is that any
time I release packages that unintentionally break this I get several
bug reports about it in quick succession, and I generally work on the
assumption that only a smallish percentage of users are engaged enough
to file bug reports and so each report probably represents many more
affected users; but I know this is very fuzzy.

I have on my to-do list an item to add something to the Debian release
notes about this, since that's a way to reach less-engaged users who
won't read the GRUB manual or mailing lists.  That will likely help to
some extent, although I can't say how much.

(That said: for various reasons my available time to contribute to GRUB
has been pretty low for some years anyway, particularly since it stopped
being something I did on work time, and Debian would probably be served
better by a more active maintainer, so I expect to be looking around for
somebody to gradually replace me over the coming months and years.  So
maybe it won't be me whom you need to persuade anyway ...)

Cheers,

-- 
Colin Watson (he/him)                              [cjwatson@debian.org]