#2475 proposal: let's develop the idea of a new repo for lightly-maintained packages
Closed: Rejected 3 years ago by zbyszek. Opened 3 years ago by mattdm.

For context in the future, this thread: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/NWLQXCDTBKAXSKSPLZRGDFJMMAIYRI5C/#QONWWVRLERBHND4LC6WJ5UF733VOCUUU about the Java stack and module maintenance. The Java packaging team at Red Hat prefers the option given by Modularity to have build-only packages, because their stack has a lot of dependencies like tomcat which are only needed as part of the build deps tree but aren't shipped in RHEL. This isn't ideal for Fedora, of course.

I'd like to move forward with David Cantrell's suggestion https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/QONWWVRLERBHND4LC6WJ5UF733VOCUUU/:

I don't know why we haven't explored
creating an additional repo of shared build deps or even just "rawer"
packages that maybe don't get the maintenance attention that other
packages do. We already know that goes on, but the packages are just
part of the main repo. So instead of classifying them collectively
and keeping them open for shared and collaborative maintenance, we
want to make them hidden build deps in modules?

I think this fits pretty nicely into, well, Rings of policy. Can we figure out how to make this work? I think it'd be an improvement on the status quo.


If a proposal can be fleshed out in the form of a Change that describes how we could structure this and make it usable, then we could look at it in the context of that manner.

However, I personally caution against the idea of buildroot-only packages. A big part of what makes a Linux distribution successful is the ease of getting users to be interested to contribute and help maintain the software they are interested in. The Red Hat Java team operates under the assumption that nobody wants to help support Java on Linux. If that's truly the model we're going to be operating under, then this makes some sense.

But this seems bizarre to me, since the Fedora Java stack is the upstream for almost the entire RPM ecosystem for Java. At least I know that SUSE builds their Java stack based on ours. Has there been any outreach to get the SUSE Java team to collaborate with us in Fedora, as the SUSE Rust team does?

I think the emphasis here should be on "rawer" (as David put it) rather than on buildroot-only specifically. Because while I understand the ideal, in practice, people shovel in dependency packages begrudgingly and once they are in do minimal maintenance. I wish they wouldn't, but I also understand that people's time is valuable -- both for their jobs and as a volunteer. As you say, people are here to contribute and help maintain the software they are interested in. The other stuff is (sometimes-surprise!) baggage.

The RH Java team, to their credit, doesn't want to do this -- they feel like if they're the maintainer of a package they need to be responsible for it, but that they don't have the time to properly do so. But as a consequence, we have the situation we're currently in where no one is really happy.

This is a place to provide a kind of middle ground. I imagine it to be available but off by default on end-user systems. And there needs to be an easy way for someone who is interested in the package to promote it to the Fedora package collection proper with very little friction.

Also, orphaned packages could be moved here, and perhaps only retired if they fail to build or have unresolved CVEs.

I really don't like the idea of another repo. I think thats a ton of overhead and complexity. Another thing to build another thing to ship another thing to determine rules for moving into and out of, more stuff for maintainers to worry about, etc.

How about instead we make another state? A package can be maintained, orphaned, retired or dependency (or whatever you want to call it).

Packages in that state have bugs assigned to a mailing list and have a template in bugzilla that explains what that means. Interested parties can watch those packages.

Packages in that state can have any packager commit to them? (or perhaps we just leave that to provenpackager?)

One thing I am not sure of is if we are talking about just packages you need to build other things here? Or are we talking about some other states?

I think the idea is worth discussing.
I don't care too much about the specific form: whether a separate repo, or some tag using rpm metadata, or even some dist-git annotation like @kevin mentioned above. What I care about is that a) the process is lightweight, b) users are able to enable those additional packages for local installation with minimal fuss, c) maintainers are able to transition packages between the two states with minimal fuss.

I like the idea of making such packages more open to non-owner contributors.

Also, I think that if some proposal is fleshed out, we should query packagers to see how many packages would actually enter this new state. If it's hundreds or less, I think we just shouldn't bother.

May I suggest to move this discussion to the devel mailing list, where we are not that likely to create echo chambers? Many Fedora contributors who have opinions about this are not following FESCo tickets.

Did we move this discussion to the mailing list or is that still pending? I'm looking back through list archives and can't anything obvious, but I may have overlooked it.

Metadata Update from @dcantrell:
- Issue tagged with: meeting

3 years ago

Metadata Update from @dcantrell:
- Issue untagged with: meeting

3 years ago

Metadata Update from @zbyszek:
- Issue tagged with: meeting

3 years ago

This was discussed in today's fesco meeting:
Agree: Close this ticket and discuss more on devel for a concrete proposal (+7, 0, 0)

(But please note that there is general sentiment that just annotating packages wouldn't give us much. The discussion veered towards visualization of open bug counts and making it easier to find packages that need help. See the logs for details: https://meetbot.fedoraproject.org/fedora-meeting-2/2020-11-18/fesco.2020-11-18-15.00.log.html).

Metadata Update from @zbyszek:
- Issue untagged with: meeting
- Issue close_status updated to: Rejected
- Issue status updated to: Closed (was: Open)

3 years ago

Log in to comment on this ticket.

Metadata