Fedora based MeeGo = NoGo! - Page 25 - maemo.org

Stskeeps | # 241 | 2010-03-25, 05:59 | Report

Originally Posted by attila77 View Post

Free and Open Source Software is not about telling *other* people what and how they should use.

Man, you'd think otherwise dealing with some of the fanatics at times

attila77 | # 242 | 2010-03-25, 11:40 | Report

A fanatic is a fanatic regardless what colors he's flying on the flagpole

FOSS does tend to get a bit more emotional as the concentration of people in there for personal reasons is much higher than in other ecosystems. Also, well organized companies have the luxury of having dedicated staff with actual people skills talking to other people, while in the FOSS pool the sometimes missing 'right' combination of people and tech skills required for a successful project/collaboration makes things a bit difficult at times. And of course all this is completely OT, but so is the whole thread after the first couple of pages

The Following 2 Users Say Thank You to attila77 For This Useful Post:
Mandor, Texrat

Mandor | # 243 | 2010-03-25, 12:28 | Report

Originally Posted by attila77 View Post

Zimon, please, for the last time - let Debian folks care about Deb(ian). Free and Open Source Software is not about telling *other* people what and how they should use.

That being said I also like to point out the different meaning of "free" between community backed distro and commercially backed distro.

Of course, you are always free to join whichever fits you the best. That was probably the purpose of that thread in the first place.

Nonetheless I enjoyed this discussion on Debian vs Fedora security. Never knew their was people who felt Debian was not secure (rightly or wrongly).

Mandor | # 244 | 2010-03-25, 12:41 | Report

Originally Posted by Stskeeps View Post

Man, you'd think otherwise dealing with some of the fanatics at times

The FOSS movement could not survive without a strong sense of community and dedication from its members. You are hence bound to some degree of fanaticism. Frankly without some of its most engaged members (fanatics if you prefer) there would be no FOSS at all. I am not saying we should all become like a certain Richard Stallman but the man has my respect.

You have to swim against the current sometimes eh ? (wink and kudos at you).

zimon | # 245 | 2010-03-25, 16:29 | Report

Originally Posted by attila77 View Post

Zimon, please, for the last time - let Debian folks care about Deb(ian). Free and Open Source Software is not about telling *other* people what and how they should use.

I've tried to use words should/would/could instead of imperative ones.

But this weak security policy affects also me, because I am using N900. So it is not only Debian's problem. It is also my problem.
So I think I am entitled to say "the problem should be fixed".

http://manpages.ubuntu.com/manpages/...ebsigs.1p.html
However debsigs and debsig-verify currently are not ported to Maemo5.
Also, seems like debsigs is not even very common and disabled on most of the DEB-based systems:
from http://purplefloyd.wordpress.com/200...-deb-packages/

Originally Posted by

Note: on most distros, dpkg/apt will not check the signature of a package when installing it, even if a signature is present. This checking can be enabled by removing the --no-debsig line from /etc/dpkg/dpkg.cfg.

I appreciate all those extra, -devel, -testing deb packages people have provided, but I am concerned about developers installing themselves also deb-packages without authenticity check.
http://www.google.com/search?q=site%...dpkg+-i%22+deb
https://garage.maemo.org/plugins/wik...id=1382&type=g

Thompson's Trojan Compiler type of crack needs to get inside developers community only once, and it will be hard to detect and remove. There already may be such Trojan horses, but we certainly would not want even more.

Right now, we are in Maemo5 practically as easily crackable as iPhone users are:
http://blogs.zdnet.com/security/?p=5836

Last edited by zimon; 2010-03-25 at 18:11. Reason: authentication/authenticity

assetburned | # 246 | 2010-04-04, 03:09 | Report

25 pages... nope not at this time of the day...

maybe it was said on one of the other 24 pages that i haven't read. whatever...

i think that it will be difficult to switch to another system but it isn't wrong.
maybe it is because i have a N900 and so it shouldn't be a big problem for me. it would be something different if i had an older model, then i would see that developers move to the new system and i will be stuck with all the old software and bugs.
back to my situation... i'm in the situation that i have a mobile with a lack of proper software. the developers might be already focussed at the new system (maybe not). but there is something different with the new OS. it will be supported by a lot of different devices and not only limited to Nokia phones. I guess that the N900 (and later) users will benefit from the nettop users who develop apps for there devices and the possibility to use these apps on my device.
Debian might be a good system, but it wasn't designed with a focus on devices with a battery. As a result some of the ways the programmers write there programs are everything but power effective.

How ever, Nokia (and we) need more users for these operating system to get more developers and more apps!

npsimons | # 247 | 2010-04-07, 04:55 | Report

Originally Posted by titan View Post

UPDATE: according to MeeGo developers MeeGo is going to be a new independent distribution
which uses the RPM format for packages but which is incompatible to Fedora or OpenSUSE,
i.e. there is no upstream distribution from which one could simply install addon software from.
see http://lists.meego.com/pipermail/mee...ry/000147.html

Maemo has been similar to outdated versions of Debian. Additionally, the /opt problem makes
it more difficult to port current Debian packages to Maemo.
The current discussion on MeeGo-dev is about whether MeeGo should be based on a popular upstream distribution
or whether all third-party software should be ported from scratch.
According to Quim Gil Harmattan ("Maemo6") will use apt/dpkg but be a fully MeeGo implementation.
-----------------
The decision to switch completely to a Fedora/RPM based distribution is IMHO a very bad idea,
especially for ARM based devices.

Debian/Ubuntu has officially supported ARM ports of the distribution for years,
while Fedora, on which MeeGo and Moblin are based, is still struggling http://arm.koji.fedoraproject.org/pa..._be_fixed.html
and not officially supporting it.
Moblin has nothing to lose from the merger, but Maemo will lose access to relatively
easy ARM ports of Debian software (cf. Jebba etch port) and the Debian standards Maemo users and developers are used to.

The package format themselves may not be very different, but the infrastructure
and the available software differs a lot, i.e. you cannot simply install a package from one distribution on another one.
Maemo, Debian and Ubuntu are LSB compliant and can install rpm packages using alien
but LSB does NOT require the whole distribution to be based on RPM or Fedora!

Another problem for N900 owners is that a seemless upgrade from Maemo5 to MeeGo is very unlikely.

What do you think?

I would have to heartily agree; I upgraded from RedHat to Debian almost a decade ago, after upgrading from Slackware to RedHat years before, and nothing I have seen has convinced me to switch back since. Whenever I hear about a new nifty OSS package, nine times out of ten I can type "apt-get install package-name" and get it within a matter of minutes under Debian; no dependency hell, and no worries about incompatibilities. Maemo has not disappointed in this respect, and I fear for the future of Linux on MIDs if people seriously think that RPM is a superior solution to DPKG+APT.

Granted, I haven't used an RPM based distribution in years (I haven't needed to; Debian inspired my traditional signature of "The more I use other software, the more I like Debian"), but from what I've heard and seen, there's no reason to d suspect that moving to RPM and anything but apt will be anything other than a downgrade.

Even Ubuntu, my second favorite distro to Debian, is based on Debian; all new popular and successful distributions are being built on Debian these days, and for good reason. The package management is superior; notwithstanding all the work put into RPM and yum, Debian has just been too far ahead for too long. Of course, part of that is the care and polish that a typical Debian package has, but I doubt I'll be able to just add "universe-all" or "extra-devel" lines to a yum config file and just install from there.

If there are people who think the devel tools are better on Moblin, they should have ported them to Maemo. If I have to install RedHat or anything besides .debs to develop software on my desktop for N900, forget it; that's almost as bad as having to run MacOSX in VirtualBox to develop iPhone apps, and I didn't sign up for that when I bought an N900.

npsimons | # 248 | 2010-04-07, 05:02 | Report

Originally Posted by fnordianslip View Post

I'm posting to mention that Intel now own WindRiver, and that WindRiver's Linux platform build tools are RPM based.

I wonder if this might be relevant, and if they might adapt the WindRiver Linux platform builder for use in Meego?

Personally, I prefer Debian derived distros and don't run anything RedHatish on any of my boxen. I'm concerned for the future of our community, the distro(s) and the devices we have. Today doesn't feel like a good day in that respect.

Oh please, for the love of Zod, don't let the Wind River guys near anything you hold dear. For an operating system that costs thousands of dollars, it's really bad. I've found and fixed things like unclosed 'extern "C" {' in VxWorks header files; stuff beginners would be chided for; who knows what goes on in more important pieces of their code . . .

zimon | # 249 | 2010-04-11, 23:30 | Report

Originally Posted by npsimons View Post

Whenever I hear about a new nifty OSS package, nine times out of ten I can type "apt-get install package-name" and get it within a matter of minutes under Debian; no dependency hell, and no worries about incompatibilities. Maemo has not disappointed in this respect, and I fear for the future of Linux on MIDs if people seriously think that RPM is a superior solution to DPKG+APT.

Granted, I haven't used an RPM based distribution in years (I haven't needed to; Debian inspired my traditional signature of "The more I use other software, the more I like Debian"), but from what I've heard and seen, there's no reason to d suspect that moving to RPM and anything but apt will be anything other than a downgrade..

Package dependency hell problems like these?

Code:

# apt-get update
Hit http://repository.maemo.org fremantle Release.gpg
Ign http://repository.maemo.org fremantle/free Translation-fi
Hit https://downloads.maemo.nokia.com ./ Release.gpg
Ign http://repository.maemo.org fremantle/non-free Translation-fi
Hit http://repository.maemo.org fremantle Release.gpg
Ign http://repository.maemo.org fremantle/free Translation-fi
Ign http://repository.maemo.org fremantle/non-free Translation-fi
Hit http://repository.maemo.org fremantle Release.gpg
Ign https://downloads.maemo.nokia.com ./ Translation-fi
Ign http://repository.maemo.org fremantle/free Translation-fi
Ign http://repository.maemo.org fremantle/non-free Translation-fi
Hit https://downloads.maemo.nokia.com ./ Release.gpg
Ign http://www.amsn-project.net fremantle Release.gpg    
Ign http://www.amsn-project.net fremantle/amsn Translation-fi
Ign https://downloads.maemo.nokia.com ./ Translation-fi
Ign http://www.amsn-project.net fremantle/tcltk Translation-fi
Hit https://downloads.maemo.nokia.com ./ Release.gpg
Hit http://repository.maemo.org fremantle Release
Ign https://downloads.maemo.nokia.com ./ Translation-fi                      
Hit http://repository.maemo.org fremantle Release
Hit http://repository.maemo.org fremantle Release                            
Ign http://www.amsn-project.net fremantle Release           
Ign http://repository.maemo.org fremantle/free Packages/DiffIndex
Ign http://repository.maemo.org fremantle/non-free Packages/DiffIndex
Ign https://repo.codemages.net ./ Release.gpg
Ign http://repository.maemo.org fremantle/free Packages/DiffIndex
Ign http://repository.maemo.org fremantle/non-free Packages/DiffIndex
Ign http://repository.maemo.org fremantle/free Packages/DiffIndex
Ign http://repository.maemo.org fremantle/non-free Packages/DiffIndex
Ign https://repo.codemages.net ./ Translation-fi
Ign http://www.amsn-project.net fremantle/amsn Packages/DiffIndex
Ign http://www.amsn-project.net fremantle/tcltk Packages/DiffIndex
Hit https://downloads.maemo.nokia.com ./ Release
Hit https://downloads.maemo.nokia.com ./ Release           
Hit https://downloads.maemo.nokia.com ./ Release           
Ign https://repo.codemages.net ./ Release                  
Ign https://downloads.maemo.nokia.com ./ Packages/DiffIndex
Ign https://downloads.maemo.nokia.com ./ Packages/DiffIndex
Ign https://downloads.maemo.nokia.com ./ Packages/DiffIndex
Ign https://repo.codemages.net ./ Packages/DiffIndex
Hit https://downloads.maemo.nokia.com ./ Packages
Hit https://downloads.maemo.nokia.com ./ Packages
Hit https://downloads.maemo.nokia.com ./ Packages
Ign https://repo.codemages.net ./ Packages
Get:1 https://repo.codemages.net ./ Packages [70,8kB]
Hit http://repository.maemo.org fremantle/free Packages         
Hit http://repository.maemo.org fremantle/non-free Packages     
Hit http://repository.maemo.org fremantle/free Packages
Hit http://repository.maemo.org fremantle/non-free Packages
Hit http://repository.maemo.org fremantle/free Packages
Hit http://repository.maemo.org fremantle/non-free Packages
Hit http://www.amsn-project.net fremantle/amsn Packages         
Hit http://www.amsn-project.net fremantle/tcltk Packages
Fetched 70,8kB in 10s (6541B/s)
Reading package lists... Done
W: Duplicate sources.list entry http://repository.maemo.org fremantle/free Packages (/var/lib/apt/lists/repository.maemo.org_extras_dists_fremantle_free_binary-armel_Packages)
W: Duplicate sources.list entry http://repository.maemo.org fremantle/non-free Packages (/var/lib/apt/lists/repository.maemo.org_extras_dists_fremantle_non-free_binary-armel_Packages)
W: Duplicate sources.list entry http://repository.maemo.org fremantle/free Packages (/var/lib/apt/lists/repository.maemo.org_extras-testing_dists_fremantle_free_binary-armel_Packages)
W: Duplicate sources.list entry http://repository.maemo.org fremantle/non-free Packages (/var/lib/apt/lists/repository.maemo.org_extras-testing_dists_fremantle_non-free_binary-armel_Packages)
W: You may want to run apt-get update to correct these problems
Nokia-N900-42-11:~# apt-get install uae
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
  uae: Depends: libhildon1 (>= 2.2.10) but 2.2.3-1+0m5 is to be installed
E: Broken packages
(...and SO ON WITH MANY PACKAGES)

You have used RPM-based system clearly too long time ago.
Fedora nowadays (and rpmfusion repositories) do not have dependency problems any more.
And it has better debug-packages handling and automatic bug tracking tools (ABRT) than any Debian system nowadays, and I use both Fedora and Ubuntu systems currently.

And it has come more and more important that security of the system is based on solid good security policies which are thought and practised well enough. With DEB-systems the security clearly is flawed and outdated badly. We can notice it daily on talk.maemo.org with instrcutions to download this and that manually (not even from HTTPS-servers) and then blindly installing deb-packages with dpkg -i without GPG-signatures.
For that reason only move from DEB- to RPM-system would be well justified already, also on Debian-PC-distributions.

attila77 | # 250 | 2010-04-12, 11:41 | Report

Originally Posted by zimon View Post

Package dependency hell problems like these?

That particular problem is a repository issue, caused by the disrepancy between the SDK and device firmwares. RPM would have *exactly* the same problem.

Originally Posted by

is flawed and outdated badly. We can notice it daily on talk.maemo.org with instrcutions to download this and that manually (not even from HTTPS-servers) and then blindly installing deb-packages with dpkg -i without GPG-signatures.
For that reason only move from DEB- to RPM-system would be well justified already, also on Debian-PC-distributions.

You cannot enforce security on people who don't want it. Most of the people on tmo don't care if it's RPM, DEB, signed or unsigned, they want to install. If you create obstacles, they will simply go around it (install binaries manually, etc). We've been over this, but it's about policies, not formats. If people don't accept/follow the policies (which they clearly don't), what format is being worked around is completely irrelevant.

The Following 3 Users Say Thank You to attila77 For This Useful Post:
npsimons, sjgadsby, SubCore