Re: [Fedora-packaging] review guidelines vs packaging guidelines

[Nicolas Mailhot]

Le Jeu 23 août 2007 12:58, Patrice Dumas a écrit :

>  Ok, I didn't understood it that way. But it isn't true, the
> guidelines
>  are setup such that having no ownership of a directory is impossible. 
I'm not so sure. The lax guidelines are more ambiguous, at no time do
they clearly say "every directory must be owned" (with single or
multiple owners). They say "the rule of thumb is everything must be
owned but there are exceptions". And then proceed with some examples
where every directory is accounted for without explicitely stating
this is a hard rule. I don't think the OP would have been so happy
with the lax version if he had understood them to enforce this rule.

IMHO since the documented "exceptions" are clearly targetted at perl
modules, it would be better to create a perl-filesystem package and
forget about all the complex A/B convolutions in the guidelines. But
that's for the perl SIG to discuss.

-- 
Nicolas Mailhot

review guidelines vs packaging guidelines

[Patrice Dumas]

On Thu, Aug 23, 2007 at 01:14:45PM +0200, Nicolas Mailhot wrote:
>  
>  Le Jeu 23 août 2007 12:58, Patrice Dumas a écrit :
>  
>  > Ok, I didn't understood it that way. But it isn't true, the guidelines
>  > are setup such that having no ownership of a directory is impossible.
>  
>  I'm not so sure. The lax guidelines are more ambiguous, at no time do
>  they clearly say "every directory must be owned" (with single or
>  multiple owners). They say "the rule of thumb is everything must be 
Indeed. It would be much more clearer if there was, in addition to all
the explanations, a simple sentence saying, maybe as a conclusion of all
the examples:

"In any case there should never be any unowned directory appearing after
a package uninstall."

--
Pat

review guidelines vs packaging guidelines

[Nicolas Mailhot]

Le Jeu 23 août 2007 15:34, Patrice Dumas a écrit :
>  On Thu, Aug 23, 2007 at 01:14:45PM +0200, Nicolas Mailhot wrote:
> >
> > Le Jeu 23 août 2007 12:58, Patrice Dumas a écrit :
> >
> > > Ok, I didn't understood it that way. But it isn't true, the
> > guidelines
> > > are setup such that having no ownership of a directory is
> > impossible.
> >
> > I'm not so sure. The lax guidelines are more ambiguous, at no time
> > do
> > they clearly say "every directory must be owned" (with single or
> > multiple owners). They say "the rule of thumb is everything must be
>
>  Indeed. It would be much more clearer if there was, in addition to all
>  the explanations, a simple sentence saying, maybe as a conclusion of
>  all
>  the examples:
>
>  "In any case there should never be any unowned directory appearing
>  after
>  a package uninstall." 
Who can add this ?

-- 
Nicolas Mailhot

review guidelines vs packaging guidelines

[Toshio Kuratomi]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Nicolas Mailhot wrote:
>  Le Jeu 23 août 2007 15:34, Patrice Dumas a écrit :
> > On Thu, Aug 23, 2007 at 01:14:45PM +0200, Nicolas Mailhot wrote:
> >> Le Jeu 23 août 2007 12:58, Patrice Dumas a écrit :
> >>
> >>> Ok, I didn't understood it that way. But it isn't true, the
> >> guidelines
> >>> are setup such that having no ownership of a directory is
> >> impossible.
> >>
> >> I'm not so sure. The lax guidelines are more ambiguous, at no time
> >> do
> >> they clearly say "every directory must be owned" (with single or
> >> multiple owners). They say "the rule of thumb is everything must be
> > Indeed. It would be much more clearer if there was, in addition to all
> > the explanations, a simple sentence saying, maybe as a conclusion of
> > all
> > the examples:
> >
> > "In any case there should never be any unowned directory appearing
> > after
> > a package uninstall."
>  
>  Who can add this ?
>   
New clarified language.  Packaging Guidelines:
'''
In general, your package should own all of the directories that it
creates but the situation is more complex than in the case of files
because many packages put files into the same directories. The rule of
thumb is that your package should own all of the directories it creates
except those owned by packages which your package depends on. *However,
there are times when you should own more than this.*  If the directory
hierarchy your package is located in may change due to updates of
packages you depend on, then you need to take care to own those pieces
of the hierarchy.
[snip examples]

In any case, there should never be any unowned directories after a
package is uninstalled from the system.
'''

The one change and one addition are meant to clarify that owning more
directories can be permissible but owning less is not.

Package Review Guidelines:
'''
- - MUST: A package must own all directories that it creates. If it does
not create a directory that it uses, then it should require a package
which does create that directory.  Refer to the
[Packaging/Guidelines#FileAndDirectoryOwnership Guidelines] for examples.
'''

I think the confusion in the Review Guidelines is over the extra wording
which only lists exceptions for FHS directories:
'''
The exception to this are directories listed explicitly in the
Filesystem Hierarchy Standard
(http://www.pathname.com/fhs/pub/fhs-2.3.html), as it is safe to assume
that those directories exist.
'''

Directing the reader to the Guidelines for complete details seems better.

Matthias, does this address your concerns?

- -Toshio
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iD8DBQFGzbGeX6yAic2E7kgRAgGmAKCwZZjGKK3Tq76AnakJtPl1Fe4j7ACfUmJT
> aPm8+Mo5pfNIORHHo+J4Vmc=
> =Do6j
> -----END PGP SIGNATURE-----

review guidelines vs packaging guidelines

[Stepan Kasal]

Hello,

On Thu, Aug 23, 2007 at 09:11:10AM -0700, Toshio Kuratomi wrote:
>  New clarified language.  Packaging Guidelines:
>  '''
>  In general, your package should own all of the directories that it
>  creates but the situation is more complex than in the case of files
>  because many packages put files into the same directories. 
the second half of the sentence really confuses me.
I suggest to put period after "creates".

>  The rule of
>  thumb is that your package should own all of the directories it creates 
repeated again?

>  except those owned by packages which your package depends on. 
ok

>  *However, there are times when you should own more than this.*
Again, this puzzles me.  I would say:
"In certain situations, a directory may be owned by two packages.
Typically, more than one package has files in a common directory, but
none of them requires another of them--in that case, each of them
shall own the directory."

>  If the directory
>  hierarchy your package is located in may change due to updates of
>  packages you depend on, then you need to take care to own those pieces
>  of the hierarchy. 
This might be correct, but I'm not able to decipher it; perhaps I
have not encountered such a situation yet.

>  [snip examples]
>  
>  In any case, there should never be any unowned directories after a
>  package is uninstalled from the system. 
Again, I would rephrase. Something like:
"In any case, a system may never contain a file owned by an installed
package whoch would lay below an unowned directory.
(That's because such a directory would remain on the system after the
corresponding package has been removed.)"

I hope my comments help.

Have a nice day,
	Stepan

review guidelines vs packaging guidelines

[Toshio Kuratomi]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stepan Kasal wrote:
>  Hello,
>  
>  On Thu, Aug 23, 2007 at 09:11:10AM -0700, Toshio Kuratomi wrote:
> > New clarified language.  Packaging Guidelines:
> > '''
> > In general, your package should own all of the directories that it
> > creates but the situation is more complex than in the case of files
> > because many packages put files into the same directories.
>  
>  the second half of the sentence really confuses me.
>  I suggest to put period after "creates".
>  
> > The rule of
> > thumb is that your package should own all of the directories it creates
>  
>  repeated again?
>  
> > except those owned by packages which your package depends on.
>  
>  ok
>  
> > *However, there are times when you should own more than this.*
>  
>  Again, this puzzles me.  I would say:
>  "In certain situations, a directory may be owned by two packages.
>  Typically, more than one package has files in a common directory, but
>  none of them requires another of them--in that case, each of them
>  shall own the directory."
>  
> > If the directory
> > hierarchy your package is located in may change due to updates of
> > packages you depend on, then you need to take care to own those pieces
> > of the hierarchy.
>  
>  This might be correct, but I'm not able to decipher it; perhaps I
>  have not encountered such a situation yet.
>  
> > [snip examples]
> >
> > In any case, there should never be any unowned directories after a
> > package is uninstalled from the system.
>  
>  Again, I would rephrase. Something like:
>  "In any case, a system may never contain a file owned by an installed
>  package whoch would lay below an unowned directory.
>  (That's because such a directory would remain on the system after the
>  corresponding package has been removed.)" 
I didn't want to tear up the existing guidelines more than necessary.
But I agree that the wording leaves something to be desired.  How about:

'''
Directory ownership is a little more complex than file ownership.
Although the rule of thumb is the same: own all the directories you
create but none of the directories of packages you depend on, there are
several instances where it's desirable for multiple packages to own a
directory.  Examples of this are:

1) The package you depend on to provide a directory may choose to own a
different directory in a later version and your package will run
unmodified with that later version.
[perl module example here]

2) Multiple packages have files in a common directory but none of them
requires others.
[hierarchy example here]

In all cases we are guarding against unowned directories being present
on a system.  Unowned directories are affected by the umask of the user
installing the package and thus can be a security risk or lead to
packages which won't run.
'''

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iD8DBQFGzct8X6yAic2E7kgRAqC3AJ9GPui1N01ZhbfkK1UpQ9apCMnzeQCeL57r
> 5HQXjwmWXl4xJgt224Vci+I=
> =3ygx
> -----END PGP SIGNATURE-----