[Fedora-packaging] PHP packaging policy notes

[Christopher Stone]

On 7/6/06, Toshio Kuratomi <toshio at tiki-lounge.com> wrote:
> On Wed, 2006-07-05 at 23:58 -0700, Christopher Stone wrote:
> > On 7/5/06, Enrico Scholz <enrico.scholz at informatik.tu-chemnitz.de> wrote:
> > > Again: rpm does not allow to require a certain program (PHP) version;
> > > you can require a certain package version only.
> > >
> > > And btw; packaging guidelines are handling this case already:
> > >
> > >   | First, if the lowest possible requirement is so old that nobody has a
> > >   | version older than that installed on any target distribution release,
> > >   | there's no need to include the version in the dependency at all.
> > >   | ...
> > >   | As a rule of thumb, if the version is not required, don't add it just
> > >   | for fun.
> > >     [http://fedoraproject.org/wiki/Packaging/Guidelines]
> > >
> > >
> > > > Please do not ask me to lower the quality standards that pear packages
> > > > expect by not providing this information in my spec files.
> > >
> > > You are not lowering quality standards when unneeded and non-working
> > > things like "Requires: php >= 4.2" will be omitted.
> >
> > Unneeded? by whom? Fedora's rpm? other package maintainers for other
> > distributions?  Some poor sap who built his OS from scratch who is
> > trying to determine what he needs installed for your package?  Somone
> > who only wants to upgrade your package and not their whole system?
> >
> > Oh I forgot, version dependencies dont work on Fedora (LOL).
> >
> No.  Version dependencies don't work as you're expecting in current rpm.
>
> > We are not adding this information because it's fun, and we are not
> > adding requirements for packages that are so old nobody will have them
> > installed.
> >
> You are adding requirements for package versions which are not relevant
> for Fedora, which is what the guidelines are saying should be avoided.

How is it not relevant?  If I use FC4 and a pear pacakge I want is on
FC5, should not installing the FC5 package do some version checking or
are we to assume that every fedora user is using only packages from
their distro release?


>
> > Can we please close this silly discussion or does anyone here actually
> > agree with Enrico?
>
> Enrico has the following points:
> 1) rpm's handling of Epochs means that versioned dependencies reference
> package versions, not upstream versions.  Because of this, including the
> version in the rpm when it is unnecessary for all the distributions we
> are supporting is misleading and potentially hurts packagers on other
> distributions.

Yes, but there are no php-pear packages that use epochs and very
likely that none ever will.   Yes, there is a 0.0000000001% chance
that some php-pear package might one day use an epoch.

The argument that version numbers potentially hurt other packagers on
other distributions is ludicris.  The version numbers on pear packages
refer to the upstream versions in 100% of all cases.  Claming that
epochs are going to screw things up for everyone is just silly, it's
not going to happen.

>
> 2) Using a versioned dependency pulled verbatim from a README file
> ignores the patches applied by the Fedora maintainer to the base
> package.  If the README says "Requires php >= 5.0.1 because of a bug in
> earlier versions" but the Fedora maintainer has backported fixes to
> these bugs for the 5.0-4 package, then using a naive versioned
> dependency of Requires: php >= 5.0.1 is wrong.

Well duh, if you are stupid enough to make a patch to php and not
include the patched version in your requires because the README says
otherwise, then you are too much of an idiot to be packaging for
Fedora to begin with.  Again the "points" being brought up seem more
like "grasping at straws" or "way off topic/off base".

>
> 3) The packaging guidelines already state when it is appropriate to
> include versioned dependencies and this is not one of them.  This means
> we're deciding whether to make an exception for php/pear packages rather
> than making new policy.

No. The packaging guidelines indicate when you should NOT use version
numbers specifically saying not to use them if the package they refer
to is older than redhat 6.2 which is pretty old.  Oh and not to add
the just for fun.

Unless there is some other text you are referring to?  We are not
deciding to make an excption to any rules.


>
> The point you seem to be making is that PEAR packages include a lot of
> information about the versions of upstream releases that are required.
> You'd like to include this in the spec file to help other packagers use
> this outside of Fedora.

Or other packagers inside Fedora who do not necessarily have a
pristine standard setup, for example someone with FC5 installed with a
few cherry picked FC6 rpms updated.

>
> Currently, I'd be disinclined to make an exception for php/pear
> packages.  That could change depending on how compelling the answers to
> the following two questions are:

WHAT EXCEPTION?!  Please indicate the exact text you are referring to
about this so called "exception".

>
> Since PEAR packages provide this dependency information, why should we
> include it in the spec file?

Why not?  You havn't convinced me yet that we are going against any
guidelines here.

Why should we include dist tags? Why should we include version numbers
in changelogs?  Why should we add comments in our spec file? etc etc.
(I dont expect you to answer these questions, I just trying to make a
point).

Hell let's just give up any hope of making a good package and change
all Guidelines to read "Just do the minimal amount that is necessary
to make your package work with the version of Fedora which you use".

>
> Enrico's points 1 & 2 mean that adding version information unnecessarily
> can mislead foreign packagers rather than help them.  Why do you think
> those points don't apply to PEAR packages?

Because the argument is based off a false premise.  He uses the
argument that since rpm has epoch capabilities, then all version
numbers in all spec files are totally meaningless because epochs are
not used by upstream packages.  Therefore since the bind package uses
epochs we should never use version number requirements in any other
packages especially packages that will most likely never have any need
for the use of the epoch field.  QED.