5 ms·
Debian Developer here. Automating some parts of packaging does not remove the important part: reviewing the code, checking for past security issues, adding san
by debian_oldtimer 5y ago
Debian Developer here.
Automating some parts of packaging does not remove the important part: reviewing the code, checking for past security issues, adding sandboxing, removing privacy breaches, testing that package works well.
Packaging for Debian is not meant to be a 5 minutes effort like some other distributions - by design.
It takes work to make sure users can trust some software.
- thomastjeffery 5y agoAll of those parts you mentioned can be done independent of packaging.
- debian_oldtimer 5y agoNo. Packaging is completed when you sign a package and upload it into Debian. Taking responsibility for its quality is part of the process.
- thomastjeffery 5y agoWithin the boundaries of the current system, sure, but it still can be accomplished. So long as builds are reproducible, signing and responsibility can be done entirely at the source control end. If you want an example, just look at Nixpkgs.
- debian_oldtimer 5y agoNo, it's not enough.
- jelmer 5y agoI don't disagree - I'm not suggesting anywhere that this be used to directly upload to unstable. There's definitely a class of users who would like the balance between freshness and quality to be closer to freshness for some packages. There's a big warning on https://janitor.debian.net/fresh https://janitor.debian.net/fresh about the packages not having had human review, and the last paragraph of the blog post mentions this as well. That said, I do believe strongly that we can let automation take care of more of the (boring bits) of the packaging process even for unstable, and leave the interesting bits that automation can't help with to the humans.