[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: A proposal for better quality in maintenance of packages by reducing
From: |
Ludovic Courtès |
Subject: |
Re: A proposal for better quality in maintenance of packages by reducing scope |
Date: |
Tue, 30 Mar 2021 10:35:03 +0200 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) |
Hi Léo,
Léo Le Bouter <lle-bout@zaclys.net> skribis:
> I would like to propose that we reduce the scope of the maintenance we
> do in GNU Guix and establish a list of packages that we more or less
> commit to maintaining because this is something that we can do and is
> attainable, for example, we could remove desktop environments that we
> can't maintain to good standards realistically and focus our efforts on
> upstreams that don't go against our way of doing things, that are
> cooperative, that provide good build systems we can rely on for our
> purposes, etc.
>
> I propose we also add some requirements before packages can go into
> such a maintained state, like a working and reliable updater/refresher
> with notifications directed to some mailing list when that one finds a
> new release, a reduced amount of downstream patches and a cooperative
> upstream with who we preferably have some point of contact to solve
> issues or gather more insider knowledge about the software if we need,
> a working and reliable CVE linter with proper cpe-name/vendor and
> notifications going to a mailing list we all subscribe to, etc..
> probably lots of other things are relevant but you see the idea.
>
> It should also be possible to filter out packages that are not declared
> to be in this maintained state, for example, in the GNU Guix System
> configuration.
I think most would agree with the general ideas. What’s more
complicated is the implementation. What’s “good standards”? What’s
“realistically”? How do we tell whether “upstream is cooperative”?
Whether a package is “maintained”?
However, concrete actions we can take is identify shortcomings of
existing tools (I’m glad you reported a bunch of ‘guix refresh’
failures!) and missing tools (a tool that would automatically
refresh/build and push patches to a branch would be great), and work on
them incrementally.
Thanks,
Ludo’.