[gentoo-dev] [RFC] package.deprecated to mark packages deprecated and report dependencies

[gentoo-dev] [RFC] package.deprecated to mark packages deprecated and report dependencies

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1112 bytes --]

Hi,

leio asked me yesterday for the possibility of marking packages
as deprecated, so that CI would issue warnings when other packages
depend on them.  I think that's quite a good idea, so I'd like to
propose a simple implementation for it.

The idea is to provide profiles/package.deprecated using the same format
as package.mask.  However, unlike the latter it wouldn't cause any user-
visible results but only affect pkgcheck (and possibly repoman, if
someone writes the check).

Basically you'd put something like:

  # name <email> (date)
  # We don't like this package anymore, so we want to remove it ASAP.
  dev-foo/bar

  # name <email> (date)
  # Old slot is not nice at all.
  dev-bar/frobnicate:0.1

  # name <email> (date)
  # Nononono, don't use that.
  <dev-zoo/elephant-
11.0

This would cause matching packages to be marked as deprecated.  It
wouldn't affect normal install behavior but pkgcheck/CI would complain
if any package had a dependency that can only be satisfied
by the deprecated packages.

What do you think?

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-dev] [RFC] package.deprecated to mark packages deprecated and report dependencies

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 877 bytes --]

Hi,

I like the idea. This will allow the following change in workflow:

When you now want to last-rite app-misc/foo for example, you would
schedule a CI run. I.e. create a pull request against Gentoo repository
at GitHub containing your package.mask entry. When the results will be
available, you will start filling bugs against packages depending on the
package you want to get rid off. Once all depending packages are gone,
you will commit the mask. However, this process can take some time and
in theory someone could add a new dependency on your package in the
meanwhile...

Thanks to the new package.deprecated file we would have a check in real
time against current repository. And once all CI warnings are gone you
can commit the mask.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-dev] [RFC] package.deprecated to mark packages deprecated and report dependencies

[Mart Raudsepp]

[-- Attachment #1: Type: text/plain, Size: 2027 bytes --]

Ühel kenal päeval, R, 16.08.2019 kell 19:58, kirjutas Thomas
Deutschmann:
> Hi,
> 
> I like the idea. This will allow the following change in workflow:
> 
> When you now want to last-rite app-misc/foo for example, you would
> schedule a CI run. I.e. create a pull request against Gentoo
> repository
> at GitHub containing your package.mask entry. When the results will
> be
> available, you will start filling bugs against packages depending on
> the
> package you want to get rid off. Once all depending packages are
> gone,
> you will commit the mask. However, this process can take some time
> and
> in theory someone could add a new dependency on your package in the
> meanwhile...
> 
> Thanks to the new package.deprecated file we would have a check in
> real
> time against current repository. And once all CI warnings are gone
> you
> can commit the mask.

I imagined it more in terms of replacing that PR CI run to get the
initial list and start signaling that we want it to go away. However
packages shouldn't be put in there that are really still used a lot
(say, x11-libs/gtk+:2).
I don't think it should nag maintainers using repoman (or pkgcheck in
the future) by default (at least for pre-existing cases), but included
in a CI run as lower prio warning to be able to quickly search through
the list to see what the state of things is, if it's realistic to
really get rid of it by filing the bugs, etc. And it should warn for
completely new packages, if they add a dep on it. Bonus points if the
CI check can signal that a deprecated use isn't the case anymore in a
newer revision already - to signal that it's a matter of clean-up work
there.
But that's just my thoughts, and what you propose is also an
improvement. Though with that kind of approach I would instead mark it
up and push that to main tree, and then do the bugs from the refreshed
report with the low prio warnings instead though; or remove the entry
if it's still too much and unrealistic.


Mart

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-dev] [RFC] package.deprecated to mark packages deprecated and report dependencies

[Matt Turner]

On Fri, Aug 16, 2019 at 10:10 AM Michał Górny <mgorny@gentoo.org> wrote:
>
> Hi,
>
> leio asked me yesterday for the possibility of marking packages
> as deprecated, so that CI would issue warnings when other packages
> depend on them.  I think that's quite a good idea, so I'd like to
> propose a simple implementation for it.
>
> The idea is to provide profiles/package.deprecated using the same format
> as package.mask.  However, unlike the latter it wouldn't cause any user-
> visible results but only affect pkgcheck (and possibly repoman, if
> someone writes the check).
>
> Basically you'd put something like:
>
>   # name <email> (date)
>   # We don't like this package anymore, so we want to remove it ASAP.
>   dev-foo/bar
>
>   # name <email> (date)
>   # Old slot is not nice at all.
>   dev-bar/frobnicate:0.1
>
>   # name <email> (date)
>   # Nononono, don't use that.
>   <dev-zoo/elephant-
> 11.0
>
> This would cause matching packages to be marked as deprecated.  It
> wouldn't affect normal install behavior but pkgcheck/CI would complain
> if any package had a dependency that can only be satisfied
> by the deprecated packages.
>
> What do you think?

I think it's a great idea. It would have been perfect for the
x11-proto/* -> x11-base/xorg-proto transition.

Re: [gentoo-dev] [RFC] package.deprecated to mark packages deprecated and report dependencies

[Aaron Bauman]

[-- Attachment #1: Type: text/plain, Size: 1511 bytes --]

On Fri, Aug 16, 2019 at 07:10:27PM +0200, Michał Górny wrote:
> Hi,
> 
> leio asked me yesterday for the possibility of marking packages
> as deprecated, so that CI would issue warnings when other packages
> depend on them.  I think that's quite a good idea, so I'd like to
> propose a simple implementation for it.
> 
> The idea is to provide profiles/package.deprecated using the same format
> as package.mask.  However, unlike the latter it wouldn't cause any user-
> visible results but only affect pkgcheck (and possibly repoman, if
> someone writes the check).
> 
> Basically you'd put something like:
> 
>   # name <email> (date)
>   # We don't like this package anymore, so we want to remove it ASAP.
>   dev-foo/bar
> 
>   # name <email> (date)
>   # Old slot is not nice at all.
>   dev-bar/frobnicate:0.1
> 
>   # name <email> (date)
>   # Nononono, don't use that.
>   <dev-zoo/elephant-
> 11.0
> 
> This would cause matching packages to be marked as deprecated.  It
> wouldn't affect normal install behavior but pkgcheck/CI would complain
> if any package had a dependency that can only be satisfied
> by the deprecated packages.
> 
> What do you think?
> 
> -- 
> Best regards,
> Michał Górny
> 

I really like this idea as well. It would also benefit the security team to know
which packages need to be fixed/removed before a vulnerable package can be
ridded of.

e.g. the sys-devel/automake:{1.9, 1.10} thing from today...

-- 
Cheers,
Aaron

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-dev] [RFC] package.deprecated to mark packages deprecated and report dependencies

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1559 bytes --]

On Fri, Aug 16, 2019 at 07:10:27PM +0200, Michał Górny wrote:
> Hi,
> 
> leio asked me yesterday for the possibility of marking packages
> as deprecated, so that CI would issue warnings when other packages
> depend on them.  I think that's quite a good idea, so I'd like to
> propose a simple implementation for it.
> 
> The idea is to provide profiles/package.deprecated using the same format
> as package.mask.  However, unlike the latter it wouldn't cause any user-
> visible results but only affect pkgcheck (and possibly repoman, if
> someone writes the check).
> 
> Basically you'd put something like:
> 
>   # name <email> (date)
>   # We don't like this package anymore, so we want to remove it ASAP.
>   dev-foo/bar
> 
>   # name <email> (date)
>   # Old slot is not nice at all.
>   dev-bar/frobnicate:0.1
> 
>   # name <email> (date)
>   # Nononono, don't use that.
>   <dev-zoo/elephant-
> 11.0
> 
> This would cause matching packages to be marked as deprecated.  It
> wouldn't affect normal install behavior but pkgcheck/CI would complain
> if any package had a dependency that can only be satisfied
> by the deprecated packages.
> 
> What do you think?

I like the idea, and I would also like to suggest a small enhancement.

I like the way /etc/portage/package.* work, and I think it is a good
idea to do this with profiles/package.deprecated.

If it is a file, use the file like you are describing, and if it is a
directory, combine all of the files in the directory and use that data.

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]