Re: Unmaintained Repository Was: Spoke too early

[James Westby]

On Sun, 2009-04-26 at 11:58 -0400, Martin Owens wrote:
> More usefully would be to assess the bit-rot, number of bugs, any
> critical or security issues which makes it dangerous. [...]
> baring any security issues I see no reason why it should be removed.
> (although I'm sure these things are assesed in due process)

You are correct, these things are usually assesed.

However, while a package may not have any known security issues now,
there's nothing to say that it doesn't have some unknown ones, and 
if there is no upstream then it reduces the chances that they
will be found and dealt with.

Usually more pressing is the question of who cares for the package. 
There is a cost to keeping the packages around, and while it is usually
small, it is not negligible. If we keep the package in the repositories
then it would be reasonable for users of the package to assume that they
could get some level of support for the package.

> The other option is to move these things to an "unmaintained" repository
> where users can have the initiative to install things they want but also
> be made aware of it's unmaintained nature (perhaps even encouraging
> developers to maintain it). At least then people wouldn't have to go
> digging around for PPAs.

This isn't necessarily a bad idea, however I don't think I would like to
see it.

Firstly, there is the question of bugs, as it would still be possible to
file bugs against these packages in Ubuntu, without any clue given 
to the user that they are using an unsupported package. This would
reflect badly on the distribution.

Secondly, there is the question of user awareness of what they are 
doing. Simply enabling the repository to install something would then
lead to it not being clear which packages you install later are 
unmaintained. It would be possible to teach the packaging tools about
this, but it would be a significant investment I fear (though one that
may be useful for making third party repositories more palatable).

I would think that PPAs would be better in some respects, as while
we would have less control over the contents, the fact that they are
more targeted is a benefit here.

It would be quite easy to write a script that grabbed each removed
package and uploaded it to a PPA, however it's not necessarily going
to build, if it does it may not work correctly any more, and further
it may be being removed for a very good reason (being terminally 
vulnerable to remote exploits for instance).

Thanks,

James






-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Unmaintained Repository Was: Spoke too early

[Scott Kitterman]

On Sun, 26 Apr 2009 15:02:21 -0400 Martin Owens  wrote:
>
>> At the point where Kdvi was removed:
>> - All important features that had been reported as missing in Okular 
compared 
>> to Kdvi, had now been added to Okular.
>> - Kdvi is unmaintained.
>> - Kdvi is an KDE3 application where a KDE4 replacement exists.
>> So those three things combined was the reason for removing it.
>
>Ah so the important part here is not that it's unmaintained, but that
>it's superseded with a package that should (in theory) offer all the
>features.

Particularly in this case because it was part of the KDE3 - KDE4 
transition.  The separate kdvi package was a bad hack that really shouldn't 
be left around any longer than strictly necessary.  

If you look at the "kdvi" source package in Intrepid you'll find it's 
really kdegraphics from KDE3 renamed, so it's removal from Jaunty wasn't a 
standard removal at all.  That package's existence in Intrepid at all was a 
complete oddity that I only took on due to the legitimate complaint about 
it providing functionality that no other package in the archive provided.

Scott K

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Unmaintained Repository Was: Spoke too early

[Martin Owens]

> At the point where Kdvi was removed:
> - All important features that had been reported as missing in Okular compared 
> to Kdvi, had now been added to Okular.
> - Kdvi is unmaintained.
> - Kdvi is an KDE3 application where a KDE4 replacement exists.
> So those three things combined was the reason for removing it.

Ah so the important part here is not that it's unmaintained, but that
it's superseded with a package that should (in theory) offer all the
features.

Regards, Martin Owens


-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Unmaintained Repository Was: Spoke too early

[Andreas Wenning]

Hi Martin

On Sunday 26 April 2009 17:58:20 Martin Owens wrote:
> Hey Andreas,
>
> > The fact is, that we don't like to have unmaintained packages in the
> > archive, kdvi in this case is one of them. It was re-introduced in
> > intrepid solely to fill the gap for some features missing in okular. (If
> > some people starts maintaining it and releases new versions, it can of
> > course be packaged again).
>
> There is an interesting protocol here, you remove any package which is
> no longer maintained upstream? Do you have a page where you keep the
> relevant rules about these things? I would like to read up on it.

I'm sorry if that sounded to definite. I think you read my words a bit too 
harsh there. The "don't like" simply means that it counts to the negative side 
of keeping the package.

> I wouldn't think that removing unmaintained packages just because they
> no longer have an upstream maintainer to be a bad idea, limiting and too
> destructive of user choice.

Exactly; I completely agree!

> More usefully would be to assess the bit-rot, number of bugs, any
> critical or security issues which makes it dangerous. This package here
> looks like it works in jaunty, baring any security issues I see no
> reason why it should be removed. (although I'm sure these things are
> assesed in due process)

The transition to KDE4 from KDE3 has left a large number of packages which 
slowly is being ported to KDE4 or is being replaced by new applications in 
KDE4.

Kdvi is one of those and in the situation that upstream has replaced it with 
Okular. There is of course the situation where important features are not in 
place in the new application, and that was the reason for keeping Kdvi.

At the point where Kdvi was removed:
- All important features that had been reported as missing in Okular compared 
to Kdvi, had now been added to Okular.
- Kdvi is unmaintained.
- Kdvi is an KDE3 application where a KDE4 replacement exists.
So those three things combined was the reason for removing it.

> The other option is to move these things to an "unmaintained" repository
> where users can have the initiative to install things they want but also
> be made aware of it's unmaintained nature (perhaps even encouraging
> developers to maintain it). At least then people wouldn't have to go
> digging around for PPAs.

An interesting thought. Installing the package from the previous version of 
Ubuntu is also an option in many cases. And that would actually give you some 
form of "maintenance" of the package at least until the EOL of the previous 
release.

But again, the packages will normally not be removed solely because of it 
being unmaintained. Normally it is a combination of that and the package 
simply not working or being replaced.

> MOTO: What has been made, is available; what is yet to be done, costs to
> do.
>
> Although what to do about packages such as the recent Eclipse packages,
> which are maintained upstream, but not in our packaging.
>
> Best Regards, Martin Owens

Regards,
Andreas

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Unmaintained Repository Was: Spoke too early

[Anzan Hoshin Roshi]

2009/4/26 Martin Owens 

>
> The other option is to move these things to an "unmaintained" repository
> where users can have the initiative to install things they want but also
> be made aware of it's unmaintained nature (perhaps even encouraging
> developers to maintain it). At least then people wouldn't have to go
> digging around for PPAs.
>
>  
>

I think that's an excellent idea.

Yours,
Anzan
-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Unmaintained Repository Was: Spoke too early

[Martin Owens]

Hey Andreas,

> The fact is, that we don't like to have unmaintained packages in the archive, 
> kdvi in this case is one of them. It was re-introduced in intrepid solely to 
> fill the gap for some features missing in okular. (If some people starts 
> maintaining it and releases new versions, it can of course be packaged again).

There is an interesting protocol here, you remove any package which is
no longer maintained upstream? Do you have a page where you keep the
relevant rules about these things? I would like to read up on it.

I wouldn't think that removing unmaintained packages just because they
no longer have an upstream maintainer to be a bad idea, limiting and too
destructive of user choice.

More usefully would be to assess the bit-rot, number of bugs, any
critical or security issues which makes it dangerous. This package here
looks like it works in jaunty, baring any security issues I see no
reason why it should be removed. (although I'm sure these things are
assesed in due process)

The other option is to move these things to an "unmaintained" repository
where users can have the initiative to install things they want but also
be made aware of it's unmaintained nature (perhaps even encouraging
developers to maintain it). At least then people wouldn't have to go
digging around for PPAs.

MOTO: What has been made, is available; what is yet to be done, costs to
do.

Although what to do about packages such as the recent Eclipse packages,
which are maintained upstream, but not in our packaging.

Best Regards, Martin Owens


-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Spoke too early

[Andreas Wenning]

On Sunday 26 April 2009 12:05:29 Vincenzo Ciancia wrote:
> Yes, in the end tex users may be more keen to do things "by hand", but
> it should have been added to the release notes (can they be modified
> now?). Sorry for coming up about this too late. However: kdvi was in the
> jaunty archive until very recently, so I could not have reported it
> before.

The fact is, that we don't like to have unmaintained packages in the archive, 
kdvi in this case is one of them. It was re-introduced in intrepid solely to 
fill the gap for some features missing in okular. (If some people starts 
maintaining it and releases new versions, it can of course be packaged again).

To identify these features we need to rely on people telling us about it 
through bug reports or other means, as none of us are heavy dvi users. I've 
been checking both launchpad and bugs.kde.org but couldn't find anything about 
the forward dvi search. Please file a bug against okular (source: kdegraphics) 
about it (and any other problems / missing features), then we don't forget 
them and can add it as a feature request upstream; making the developers aware 
of it is the only way we can get it fixed / added.

Quite a large number of packages are being removed each release; and adding a 
list of removed packages to the release notes does not really make much sense, 
unless we're talking core-functionality or could give serious problems to some 
people. Encouraging people to install unmaintained software in the release 
notes kind of defeats the purpose of not posing people to security risks.

Regards,
Andreas
-- 
 ,-¤.  Kubuntu Linux
¤; http://www.kubuntu.org
 `-¤'  Linux for Human Beings


-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Spoke too early

[Vincenzo Ciancia]

Il giorno sab, 25/04/2009 alle 20.44 +0200, Andreas Wenning ha scritto:
> 
> 
> Until now I've only heard talk about the reverse search, and that was
> the 
> reason for bringing kdvi back in Intrepid. You might be right that
> forward 
> search doesn't work in Okular; then that is indeed a valid request,
> that we 
> need to take upstream if it is not already there.

> It is not possible to re-add kdvi at this point. But I've just tested,
> and 
> installing the kdvi package from intrepid works fine in jaunty; so
> that is a 
> possible solution for now.

Yes, in the end tex users may be more keen to do things "by hand", but
it should have been added to the release notes (can they be modified
now?). Sorry for coming up about this too late. However: kdvi was in the
jaunty archive until very recently, so I could not have reported it
before.

Vincenzo



-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Re: Spoke too early

[Andreas Wenning]

On Saturday 25 April 2009 18:46:50 Vincenzo Ciancia wrote:
> I spoke too early: okular does reverse search but not forward searches:
> it only supports a "-p" switch. When working with multi-file latex
> documents it is very comfortable to have the viewer switch to the edit
> point.

Until now I've only heard talk about the reverse search, and that was the 
reason for bringing kdvi back in Intrepid. You might be right that forward 
search doesn't work in Okular; then that is indeed a valid request, that we 
need to take upstream if it is not already there.

> Please do not get me wrong: I like okular and hope it will be able to
> replace kdvi. I understand the desire to get rid of kde3 applications in
> a kde4 installation; probably patching okular to accept forward searches
> (and kile to use the same syntax) is very simple and will come soon, but
> in the meantime could kdvi be re-uploaded?

It is not possible to re-add kdvi at this point. But I've just tested, and 
installing the kdvi package from intrepid works fine in jaunty; so that is a 
possible solution for now.

Regards,
Andreas
-- 
 ,-¤.  Kubuntu Linux
¤; http://www.kubuntu.org
 `-¤'  Linux for Human Beings

-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss

Spoke too early

[Vincenzo Ciancia]

Il giorno sab, 25/04/2009 alle 18.29 +0200, Vincenzo Ciancia ha scritto:
> Il giorno ven, 24/04/2009 alle 20.14 -0400, Scott Kitterman ha scritto:
> > 
> > Precisely. I packaged kdvi  from KDE 3 kdegrapics as a stopgap to
> > provide 
> > this capability in Intrepid since no KDE4 package provided it in KDE
> > 4.1.  
> > It's time has now passed.
> > 
> 
> Indeed, okular is doing reverse searches. Thank you for the effort in
> intrepid. To the benefit of other users stepping by here, to have
> reverse searches in okular one must configure an editor in okular
> settings (e.g. kile) and then shift+doubleclick will trigger reverse
> search.
> 
> Vincenzo

I spoke too early: okular does reverse search but not forward searches:
it only supports a "-p" switch. When working with multi-file latex
documents it is very comfortable to have the viewer switch to the edit
point.

Please do not get me wrong: I like okular and hope it will be able to
replace kdvi. I understand the desire to get rid of kde3 applications in
a kde4 installation; probably patching okular to accept forward searches
(and kile to use the same syntax) is very simple and will come soon, but
in the meantime could kdvi be re-uploaded?

I think it was in jaunty at least until the beta am I wrong? 

Vincenzo
 




-- 
Ubuntu-devel-discuss mailing list
Ubuntu-devel-discuss@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel-discuss