5 ms·

Is there greater context here that helps explain what's going on? Reading the comments in the thread didn't clarify much for me as someone unfamiliar with NixOS

by 63 5y ago

Is there greater context here that helps explain what's going on? Reading the comments in the thread didn't clarify much for me as someone unfamiliar with NixOS, their apparently unique Python packaging scheme, and Home Assistant.

res0nat0r 5y ago
He just doesn't want anything of his included in nixpkgs because he doesn't want to deal with anyone opening Github issues against his repos if there happen to be build / installation issues that are coming from some kind of failure in the nixpkgs install / build process.
- Isthatablackgsd 5y ago
  Also they offered various options to appease the author including code forking and the author rejected them all. Basically the team exhausted all of their options to make this author happy but the author seem not to understand the reality of FOSS. This author shouldn't be in the FOSS if the author is going to roadblock every options despite his licensing explicitly allows including the codes.
  - res0nat0r 5y ago
    Agreed. If he wants to be stubborn like this he just should change his licensing so it can't be included anywhere else upstream and that would put an end to it.
- lucideer 5y ago
  That's speculative on his part (noone has opened any issues with him, neither coming from nixos nor from any other repackaging). The nixos guys also offered various proposals to him to completely avoid any support burden on his part, all of which he roundly rejected. Seems he's just being unreasonable for the sake of it tbh; I can't see any logical reasoning behind it all.
  - res0nat0r 5y ago
    Not sure why I'm being downvoted for what he explicitly lays out from the link above: If users experiencing issues with the ambee library in this package, they will knock on my door. And I'm not willing to support that or accept that burden. Especially as I don't see a good repacking reason in this case. > Seems he's just being unreasonable for the sake of it tbh; I can't see any logical reasoning behind it all. I agree.
  - dwild 5y ago
    > That's speculative on his part (noone has opened any issues with him, neither coming from nixos nor from any other repackaging). Which is the whole point of acting on it before it happens... It's crazy the amount of entitlement I see toward open-source developers. You don't like his stance, then fork it and support it yourself. You are already lucky to have a good base to work on, you shouldn't even be entitled to that!
    - deleted 5y ago
      [deleted]
    - univalence 5y ago
      They explicitly offered to do that, and also suggested 3 other solutions to address his concern, and he shot all suggestions down with what amounted to "I already told you what I want: Don't repackage my code." The only entitlement form the nixos devs has been using a right which Frenck explicitly chose to provide when licensing his software. In the end, the will have to fork it, and probably maintain a fork of HM, since he is relicensing it to disallow repackaging.
Macha 5y ago
It sounds like Home Assistant by default pulls the (EDIT: Home assistant specified, not latest) version of the package from PyPI at runtime and loads it dynamically. The point of NixOS is reproducible builds, that is if you build a given nix environment you will always get the same code. Dynamically pulling from PyPI at runtime defeats that. The author doesn't want any way of downloading the code other than getting "the supported version" from PyPI, as they don't want to deal with support requests for issues that are fixed later. They are likely worried that packaged versions will become stale, and users will expect support for specific versions, which they are unprepared to offer. I think the offers from NixOS of having to enable config flags to get this enabled which make it clear it's not supported by upstream should be fair. Part of open source is that others are free to modify your code, and if you have a problem with that you're not really ok with the idea of open source.
- f311a 5y ago
  His project has zero issues created. It's a pretty small and simple library. Why would users report to his project when installing Home Assistant? That's not usually how it works and Home Assistant has a lot of other dependencies.
- NathanKP 5y ago
  Yeah I really wouldn't want to use anything that dynamically pulls a package from PyPI at runtime, because I don't trust this guy not to add a vulnerability to the code at a later point in time.
  - pas 5y ago
    Okay, so ... I know someone might, but really who will audit any of his existing code? (Sure, that's slightly different than identifying such an auto-update point and then trying to do a supply-chain attack. But do maintainers look at what they package? In how much detail?)
    - NathanKP 5y ago
      That's the point of packaging it... you review it at the time that you package it, and then you review it each time you update it in the future. Should always do a simple diff at minimum to see what changed. That's just part of being a responsible open source user.
Denvercoder9 5y ago
I think the greater context is that the Home Assistant developers are somewhat hostile to people running, and especially packaging, their software outside of their own supported methods (which are Docker containers or their own full OS). It's somewhat understandable as it creates a support burden for them, but especially given the enthusiast nature of the community this doesn't seem like a smart decision. There's been some outrage in the community about the developers deprecating platforms before.
- aequitas 5y ago
  > I think the greater context is that the Home Assistant developers are somewhat hostile to people running, and especially packaging, their software outside of their own supported methods.. The person proposing the Nix package is a Home assistant developer afaik, so that would be weird.
  - SuperSandro2000 5y ago
    Yes, fabaff is a bigger home-assistant contributor to my knowledge and started to help out packaging a lot of the missing python libraries for NixOS.
  - Denvercoder9 5y ago
    Well, Home Assistant is a large project with lots of contributors, so it's not surprising that its developers don't have a singular opinion. However, this is the impression I get from the official announcements and other interactions I've seen on GitHub. Another incident was when they deprecated/unsupported installing it on a generic Linux install last year, which they had to (somewhat) back down from after community outrage.

by 63 5y ago

res0nat0r 5y ago

He just doesn't want anything of his included in nixpkgs because he doesn't want to deal with anyone opening Github issues against his repos if there happen to be build / installation issues that are coming from some kind of failure in the nixpkgs install / build process.

Isthatablackgsd 5y ago
Also they offered various options to appease the author including code forking and the author rejected them all. Basically the team exhausted all of their options to make this author happy but the author seem not to understand the reality of FOSS. This author shouldn't be in the FOSS if the author is going to roadblock every options despite his licensing explicitly allows including the codes.
- res0nat0r 5y ago
  Agreed. If he wants to be stubborn like this he just should change his licensing so it can't be included anywhere else upstream and that would put an end to it.
lucideer 5y ago
That's speculative on his part (noone has opened any issues with him, neither coming from nixos nor from any other repackaging). The nixos guys also offered various proposals to him to completely avoid any support burden on his part, all of which he roundly rejected. Seems he's just being unreasonable for the sake of it tbh; I can't see any logical reasoning behind it all.
- res0nat0r 5y ago
  Not sure why I'm being downvoted for what he explicitly lays out from the link above: If users experiencing issues with the ambee library in this package, they will knock on my door. And I'm not willing to support that or accept that burden. Especially as I don't see a good repacking reason in this case. > Seems he's just being unreasonable for the sake of it tbh; I can't see any logical reasoning behind it all. I agree.
- dwild 5y ago
  > That's speculative on his part (noone has opened any issues with him, neither coming from nixos nor from any other repackaging). Which is the whole point of acting on it before it happens... It's crazy the amount of entitlement I see toward open-source developers. You don't like his stance, then fork it and support it yourself. You are already lucky to have a good base to work on, you shouldn't even be entitled to that!
  - deleted 5y ago
    [deleted]
  - univalence 5y ago
    They explicitly offered to do that, and also suggested 3 other solutions to address his concern, and he shot all suggestions down with what amounted to "I already told you what I want: Don't repackage my code." The only entitlement form the nixos devs has been using a right which Frenck explicitly chose to provide when licensing his software. In the end, the will have to fork it, and probably maintain a fork of HM, since he is relicensing it to disallow repackaging.

Macha 5y ago

It sounds like Home Assistant by default pulls the (EDIT: Home assistant specified, not latest) version of the package from PyPI at runtime and loads it dynamically. The point of NixOS is reproducible builds, that is if you build a given nix environment you will always get the same code. Dynamically pulling from PyPI at runtime defeats that. The author doesn't want any way of downloading the code other than getting "the supported version" from PyPI, as they don't want to deal with support requests for issues that are fixed later. They are likely worried that packaged versions will become stale, and users will expect support for specific versions, which they are unprepared to offer. I think the offers from NixOS of having to enable config flags to get this enabled which make it clear it's not supported by upstream should be fair. Part of open source is that others are free to modify your code, and if you have a problem with that you're not really ok with the idea of open source.

f311a 5y ago
His project has zero issues created. It's a pretty small and simple library. Why would users report to his project when installing Home Assistant? That's not usually how it works and Home Assistant has a lot of other dependencies.
NathanKP 5y ago
Yeah I really wouldn't want to use anything that dynamically pulls a package from PyPI at runtime, because I don't trust this guy not to add a vulnerability to the code at a later point in time.
- pas 5y ago
  Okay, so ... I know someone might, but really who will audit any of his existing code? (Sure, that's slightly different than identifying such an auto-update point and then trying to do a supply-chain attack. But do maintainers look at what they package? In how much detail?)
  - NathanKP 5y ago
    That's the point of packaging it... you review it at the time that you package it, and then you review it each time you update it in the future. Should always do a simple diff at minimum to see what changed. That's just part of being a responsible open source user.

Denvercoder9 5y ago

I think the greater context is that the Home Assistant developers are somewhat hostile to people running, and especially packaging, their software outside of their own supported methods (which are Docker containers or their own full OS). It's somewhat understandable as it creates a support burden for them, but especially given the enthusiast nature of the community this doesn't seem like a smart decision. There's been some outrage in the community about the developers deprecating platforms before.

aequitas 5y ago
> I think the greater context is that the Home Assistant developers are somewhat hostile to people running, and especially packaging, their software outside of their own supported methods.. The person proposing the Nix package is a Home assistant developer afaik, so that would be weird.
- SuperSandro2000 5y ago
  Yes, fabaff is a bigger home-assistant contributor to my knowledge and started to help out packaging a lot of the missing python libraries for NixOS.
- Denvercoder9 5y ago
  Well, Home Assistant is a large project with lots of contributors, so it's not surprising that its developers don't have a singular opinion. However, this is the impression I get from the official announcements and other interactions I've seen on GitHub. Another incident was when they deprecated/unsupported installing it on a generic Linux install last year, which they had to (somewhat) back down from after community outrage.