Debian discusses principles for package maintenance
Achieving consensus among Debian Developers on technical topics and
procedures can be, to put it mildly, challenging. Nevertheless, that
is exactly what Otto Kekäläinen has tried to do with a proposal that
would set up "principles all Debian packages should follow to be
open for collaboration in package maintenance
". In the near term,
it seems unlikely that the proposal will be accepted, but the
discussion may be effective at improving collaboration nonetheless.
Ending single-developer maintainership of Debian packages has been a popular
topic of discussion this year. Current
Debian Project Leader (DPL) Andreas Tille made building redundancy,
"whether it's maintaining infrastructure or managing non-leaf
packages
", part of his platform
during the 2024 DPL
election. He also spoke about this in his "Bits from the DPL"
talk at DebConf 2024 in Busan, South Korea. Video of the talk is
available on the DebConf site.
Tille wrote in his platform that he envisioned a future
where "every crucial task in Debian
" is handled by at least two
people to "ensure comprehensive backup and support
". He would
also like to see adoption of packaging standards,
make it mandatory to maintain packages on Debian's GitLab instance,
called Salsa, and to use its continuous-integration tools. If voters
were attached to single-maintainership of packages, he suggested that
they should "probably rank me below 'None of the
above'
".
Discussion part one
Ending single-person maintainership, and packaging practices in
general, were a
major topic of discussion on the debian-devel mailing list during the
run-up to the election in April. The conversation started on a
non-public mailing list, presumably debian-private, but it was moved
to debian-devel and then re-titled "finally end single-person maintainership
".
In the first message, Pierre-Elliott Bécue is quoted as saying that "this whole
situation is a plea to finally end single-person
maintainership of packages
", and that all packages should be
collaboratively or team-maintained. What that situation was
remains unclear, but that did not hinder the ensuing discussion. Tille quoted
another message from Wouter Verhelst, in which Verhelst expresses
skepticism that mandating multiple maintainers is the way to ensure
that Debian packages are well-maintained. He says that Debian should
not try to fix packaging problems "by introducing a rule that is,
at best, affecting something only very weakly related to the problem that
we are trying to solve
". Tille then
asks whether mandating use of Salsa, would be a step in the
right direction.
Bernd Zeimetz replied that mandating Salsa was absolutely a sensible step. He upped the ante to say that Debian should also require a common Git layout for packages, and prefer merge requests to sending patches. He also called for packagers to use recent versions of debhelper, presumably a reference to its compatibility levels that reflect changes in Debian policy. Developers can choose which level to target, to avoid breaking changes, but that means that those packages do not comply with more recent versions of Debian policy. In Zeimetz's estimation, adopting those policies would make it easier for contributors to send merge requests to maintainers, or for others to pick up maintenance of a package in the event that its maintainer is unavailable or unresponsive.
Top-down imposition
Philip Hands balked
at the idea of requiring Debian developers to adopt specific
workflows. He said that top-down imposition of practices struck him as
"unlikely to induce joy in anyone involved
". After all,
Debian's contributors are "a self-selecting group of people who are prone to
repeatedly walking the road less traveled
". He also pointed out
that there is no consensus on which Git layout would be best, despite
a proposal that has been in the works for almost a decade.
Raphaël Hertzog first proposed a Debian
Enhancement Proposal (DEP) to "harmonize the layout of Git
repositories used to maintain Debian packages
" in 2014. DEPs are similar to RFCs or Python Enhancement
Proposals (PEPs). An enhancement can be any change to a Debian
process, such as clarifying
policies and workflows for non-maintainer uploads (NMUs), guidelines for
tagging patches, or providing machine-readable
copyright information. The idea behind DEPs is to help organize
discussions, indicate their current status, and provide a record of
decisions. According to the initial DEP
proposal a DEP is accepted when there is consensus among the
"affected parties
", those who would do the implementation or
have their work affected by it.
Hertzog's proposal, DEP-14, is currently in "candidate" status, which means it is considered to be in the implementation and testing stage, but is not yet accepted as part of any authoritative texts such as Debian's policy manual or developer's reference.
Wookey wrote that he was in favor of changing Debian's culture to make it easier to just fix things, but that mandating use of Salsa or team maintenance would be a mistake:
Because so far as I can tell 'use salsa' actually means 'maintain your packages in git'. So far as I can see it is not possible to use our existing 'uscan, patch, sbuild, dupload' type workflows with Salsa. And that's why I'm not using it, and don't want to be made to use it.
Johannes Schauer Marin Rodrigues said
that he had mixed feelings about using Salsa. He described it as a
"big beast with tons of javascript
" that does not play well
with his computer. But, he said, it gave him confidence in what he
uploads and he liked that it would run tests for him while he did
other work. He also liked that he could receive contributions through
Salsa which, unlike Debian's bug-tracking system, would let him know
whether a change broke something or not. At the same time, "I've
also cursed at it enough times to understand the dislike
". He was
not comfortable making it mandatory just because he liked it.
The discussion continued for quite a while without making much
headway. On May 19, Jonas Smedegaard suggested
that the discussion should focus on specific requirements rather than
focusing the discussion on "a single catch-all code forge
". For
example, should Debian mandate VCS-tracking or not, and should it
mandate a specific VCS? If yes, should Debian require a specific
workflow with that VCS, and so on.
Paul Gevers asked
if people thought that "mandate" would mean a "should" or a "must" in
policy. He was against the idea of requiring specific policies for
packagers, and said the discussion was "going to be moot
" if
the policy was simply that packagers "should" maintain things a
certain way. He noted that 93% of packages in Debian testing were
already in Git, and 86% of the packages were maintained on Salsa
"so I propose we stop the discussion
". (This information can be
found on the Debian Trends
site.) The discussion did not stop at that point, but it did wind down
over the course of the next few days.
DEP-18
On July 27, Kekäläinen started it up again by sending
a message to the debian-devel list about a draft titled "DEP-18: Enable true open
collaboration on all Debian packages". DEP-18 has five principles that
Debian Developers should follow "in order to lower the barrier for
others to contribute
". The first is that a package's source code
should be stored in version control, using Git. The second is that the
source code should be on Salsa. The third is that developers should
run Salsa CI on the package at least once before every upload to the
Debian archive to ensure a minimum level of quality.
The fourth principle is that developers should allow merge requests (or pull requests, in GitHub parlance) to be submitted. In some cases, developers do host their packages on Salsa using Git, but they have not enabled merge requests through the platform because they do not want to deal with non-email-based workflows. Finally, the fifth principle in DEP-18 is that maintainers should allow changes to be reviewed before packages are uploaded to the archive.
DEP-18 suggests that these principles not be subject to strict
enforcement. Rather, the idea is that the existence of a DEP with
these principles "should alone be enough to drive social
agreement
" According to the FAQ in the draft, Debian will see
benefits as long as most packages follow the principles. In a later
message, he pointed
out that he had chosen a DEP rather than a General
Resolution because he wanted it to be a "fairly soft
mechanism
" that encourages consensus rather than forcing
maintainers to adhere to strict rules.
Web vs. email
One of the objections often raised against adopting a Salsa-based workflow is
the shift from email-based conversations to web-based
conversations hosted in Salsa. Smedegaard objected
to DEP-18's recommendation that developers should enable Salsa's
discussion and review of merge requests via the web
interface. "Where are my options to mirror the data at Salsa, as I
can do with mailinglists and Debbugs, to work with it also
offline?
"
In his reply, Kekäläinen thanked
Smedegaard for maintaining more than 650 packages. "You have
for sure developed an optimal workflow for yourself.
" He
reiterated that the draft does not recommend strict enforcement and
said, "I would not expect you to move away from what you are doing
now
". He acknowledged that following principles 3,4, and 5 would
probably not benefit Smedegaard or his packages, but said DEP-18 was
still useful as a general guideline.
Smedegaard replied
that "ideally
" all of the
packages that list him as a maintainer would be team-maintained. He
invited people to get in touch if they would like to help with their
maintenance. He said that he had failed if the workflow for
maintaining those packages was optimal for him only, and that he had
tried for a collaborative workflow—just not a web-centered
collaborative workflow. Using GitLab might ensure collaboration, but "mono-cultural
collaboration is not the only form of collaboration, and I find it a
problematic one
".
Subset of packages
Schauer floated
the idea of reducing the scope of DEP-18 to a subset of its
principles and a smaller set of Debian packages, such as those
packages marked as essential. He
reasoned that the essential packages are relevant to all Debian
packagers, so they should be used to "set an example of how
collaborative maintenance in Debian is supposed to work
". Luca
Boccassi said
this was a great idea.
After much more discussion, Kekäläinen followed
up with the idea of having the top 150 packages run Salsa CI at
least once before upload. The impetus for this was a bug
in the python3-pkg-resources package that affected a large
number of other Python packages. According to Kekäläinen, the bug
would have been caught by Salsa CI before it had been uploaded to
unstable and causing "everyone to suffer
". Tille suggested
making CI opt-out instead of opt-in for packages in Salsa.
One blocker to this, of course, is that not all of the top 150 are even hosted on Salsa to begin with. Currently, 29 of the packages out of the 150 are not on Salsa at all or using it as their primary source control. Ted Ts'o said that he maintains one of those packages (e2fsprogs); so he looked into enabling Salsa CI, but searching for more information turned up little of use. He had several questions that needed to be answered to make Salsa more accessible to maintainers, such as the benefits of using Salsa CI, what tests it runs, and how to get a simple recipe for enabling it. Kekäläinen said he would update the pipeline information page based on the discussions to make it clearer.
Discussion continues
On August 27, Kekäläinen posted a summary
of the discussion on DEP-18 so far for the benefit of contributors who
didn't want to wade through the more than 140 messages (so far).
One benefit of the conversation mentioned in the summary is that it
brought to light some actionable complaints about Salsa's performance
and reliability "which deterred contribution
". He noted that a hardware
upgrade was underway to improve its performance.
He noted that the discussion had surfaced "the shared pain points in the
packaging workflow beyond just collaboration struggles
":
Work should also continue on DEP-14, git-buildpackage, Salsa CI and other tools to decrease the general friction, and in many places simple documentation updates/overhaul is due to avoid unnecessary fragmentation in workflows that isn't intentional so that we later can more clearly focus on discussion the pros and cons of the intentionally different workflows.
While the conversations have not reached anything like consensus, it seems they have been productive exercises nonetheless. Despite a few small flare-ups, the discussions have largely been genial and informative, with package maintainers interested in ways they can improve collaboration—ideally without giving up their preferred workflows.
Someday, Debian may settle on one true method of maintaining packages, but it would be unwise to wager a large sum of money on that happening anytime soon. In the meantime, though, the project has identified many areas for improvement that may make life better for packagers even if DEP-18 never reaches accepted status.
