launchpad-users team mailing list archive

[Celso Providelo <celso.providelo@xxxxxxxxxxxxx>]

On Fri, Jun 19, 2009 at 7:41 AM, Martin Pool <mbp@xxxxxxxxxxxxxx> wrote:
>
> 2009/6/19 Celso Providelo <celso.providelo@xxxxxxxxxxxxx>:
>
> > I understand your problem, although I find it very unlikely that we
> > will open the gates for binaries generated outside LP, because it
> > defeats a very important aspect of PPAs, trusted source -> binary
> > path.
>
> It is a bit strange to me that the PPAs would potentially trust
> Richard to upload source, but not trust him to upload binaries.  I
> suppose source packages have a level of auditability, perhaps after
> the fact, that binaries do not.

Exactly, from the user perspective, at least the common one, losing
the ability to go back to the source, and trace changes, is bad.

OTOH, I do recognize that this is a policy enforced for the ubuntu
official repository, not necessarily for PPAs, where the *trust* exist
between the user and the group of people driving the PPA. At this
level, if I trust Richard to upload good sources, I will probably
trust him to upload good binaries for architectures that launchpad
can't build.

>From the code point of view, accepting binary uploads for unsupported
architectures wouldn't be that hard to implement, however publishing
them in a way it's clear that they were not generated by Launchpad
might be involving (they would not be signed by the default PPA
signing-key, for instance).

Anyway, I guess there is a lot of room for discussion in this area so
the sooner we start them the better.

I don't think there is any bug already reported that represent this
request properly. Can you please file one ?

> > We can always fallback to the official ubuntu backports repository or
> > the debian one (which was the original way of solving this) and/or
>
> Can we get ppc debs into the official backports?  If so, that would be
> a good way to proceed.

You can get your patches through the official ubuntu backport
procedure, which will result in an official backport source package
that will build ppc binaries for the series where ppc is supported.

I suggest you to talk with the someone in the ubuntu-core team, they
maintain bzr and will know the procedures better than me.

> > maybe hosting the signed debs in Bzr project in LP.
>
> If we just want to publish the files it's easy enough to put them in
> Launchpad downloads, and in fact that's what I suggested Richard do
> for now.  But it does have the substantial drawback that it no longer
> integrates nicely with apt.

Right, it's not ideal, but at least we will have download counters (a
rough approximation of how many people are affected by this problem).

--
Celso Providelo <celso.providelo@xxxxxxxxxxxxx>
IRC: cprov,  Jabber: cprov@xxxxxxxxxx, Skype: cprovidelo
1024D/681B6469 C858 2652 1A6E F6A6 037B  B3F7 9FF2 583E 681B 6469