Requesting that private repos be taken down
 

According to this page there are still a lot of personal repositories out there that hold packages for the maemo platform.

I feel that improving the quality control process in the official maemo repos along with other tools to make good software and packaging will mean that users will go to the official maemo.org repositories first to download their software. I also think asking people to take down their repos won't work, for various reasons.

However, others in our community feel differently, and while I won't speak for them, I will try to present their views. Firstly, they see the issue of personal repos as a problem for users since there is no way to do quality assurance on a private repo. If a user downloads something nasty their entire tablet experience is negatively affected.

This negative experience can be avoided if we ask developers to bring their apps "in house" as it were, bring their debs into the official repositories at maemo.org. If we don't do that the feeling is that things will only get worse, more repos will be created and more users will be affected.

I would like the views of the community - what do you think? Should we spend energy and time reducing these repos? Or should we focus on other things?

Thanks!

Re: Requesting that private repos be taken down
 

Historical evidence suggests that people will create their own repos if it's easier (one of the reasons why tooling around QA needs to be so good) and that this does cause problems.

In particular, developer A packages a library into their repo because it's needed for their app. Developer B packages the same library and puts it into Extras.

User comes along and has both Extras and dev-A's repo enabled. There are three problem cases:

1. The two libraries have the same name, but different versions. Both apps require specific naming; but there's been no collaboration or awareness.
2. The two libraries have different names but potentially install into the same place. Again, no standards or collaboration on naming.

These aren't theoretical problems, unfortunately - we've seen them in the past.

Re: Requesting that private repos be taken down
 

You should focus on making it easier to submit applications into Extras. This will make more people do that. The more steps you add to the submission process, the more people will use third-party repos. For example, insistence on auto-builder usage probably makes a lot of people use their own repos.

Re: Requesting that private repos be taken down
 

Err, damnit. I said 3 and only listed 2. Can't remember what I had in mind for the third.

Re: Requesting that private repos be taken down
 

And, furthermore... :p

No, really, fms has a good point, of course and streamlining the process of getting an app(s)/library(ies) into Extras-Devel and then Extras should be one of the easiest processes within the maemo.org toolset. This should include an interactive "wizardy" UI as well as automated Q/A (to some degree).

Of course, via mailing list discussion, I know that Jeremiah is working on this sort of thing.

Until then, is there something that can be done to entice developers to go through the current process of getting into Extras? (Unfortunately, I'm not so sure the "make it easier on end-users" argument will work with a lot of people.)

Developers: What would you like to see happen to facilitate this?

Tim

Re: Requesting that private repos be taken down
 

So you would like to see a system that does not use autobuilder? But how then would we create the binaries that a user would install? And if you just upload a binary to garage, how can we check that it won't erase the user's hard drive, etc?

Are you suggesting we use sbuild and debian native tools or SuSE's Open Build Service?

I don't see any other option other than sending packages through the autobuilder at the moment.

Re: Requesting that private repos be taken down
 

All I am saying is that autobuilder is a barrier to entry at the moment. The more such barriers you introduce, the more likely it is that a developer will not use Extras.

Re: Requesting that private repos be taken down
 

That's an intersting point of view. I though that since we introduced autobuilder one year ago amount of packages in Extras grew significantly.

Re: Requesting that private repos be taken down
 

I think we can say the opposite, too. Using 3rd party unsupported/unchecked repositories is just that - unsupported and unchecked. Users should be aware of that. IMHO The non-presence of an autobuilder in extras would not lower any barriers, it would just make it more of a dumpster (as then it's every developer for himself) - and then there is no difference if it's just one or a hundred repositories as the contents would get quite messed up over time anyway.

Disclaimer: I'm using launchpad ppa's, pbuilder and similar stuff for quite some time so I might be too easy on the autobuilder approach :)

Re: Requesting that private repos be taken down
 

The most painful part is probably preparing the packages, so a 'packagefy' service comes to mind. A sort of py2deb, only server side - IMHO there is no need for the developer to manually know/create .desktop, .service files, experiment with icon sizes, directory layouts, postinst hooks, etc. Of course, when you create the package in that way once, it's always easier to tweak that than start from zero (even if you have helpful Wiki pages).