Jonas Smedegaard <jo...@jones.dk> writes: > Now, some may argue that I am describing a case for package pinning > here, and that *might* be true but I don't know that yet - because the > proposed change to the system does not exist yet so I cannot really know > that yet. Possibly the implementation will be so that I continuously > need to check if some new non-free blobs was introduced and block those, > instead of the current situation of not needing to do anything actively > to keeping most possible risky "stuff" away from my systems.
I feel like Debian already offers multiple mechanisms to prevent installation or updates of packages, both specific packages and packages by suite, archive, etc. I'm dubious that we need some additional extra-special mechanism just for firmware, as opposed to documenting the many and varied mechanisms we already support for pinning old packages, disabling automated upgrades, and so forth. We need some way to clearly label non-free firmware packages so that you can apply whatever installation or upgrade policy locally that you want to apply, but solution #5 provides that by keeping the non-free firmware in a separate archive area (which apt calls "components") to which you can apply different apt policy. Given your problem description above where you want to manually review each new non-free package, I suspect you will want to pin the non-free firmware archive area to something like priority 1 (similar to experimental) so that you can access those packages but they're not otherwise installed or upgraded. Another option would be priority 100, which would give automatic upgrades but not new installs. I'm assuming we'll continue to maintain the invariant that free packages won't depend on non-free packages, so unless you install a non-free metapackage, you presumably won't get new non-free firmware packages without seeking them out. We may want to install such a metapackage by default when the non-free-firmware-enabled installer is used (leaving open the question of whether that's the only installer or not), but you could remove it, of course. (I suspect you, like me and probably most other Debian contributors, make pretty extensive modifications to the installed package list after installing a new system, and have lists of packages that you always add or always remove.) -- Russ Allbery (r...@debian.org) <https://www.eyrie.org/~eagle/>