1. Forum
  2. Usenet
  3. LINUX.DEBIAN.DEVEL.MENTOR

  • Automated uploading of packages?

    From David Given@21:1/5 to All on Mon Jul 18 20:30:01 2022
    I have a compiler suite --- the Amsterdam Compiler Kit --- which I'm
    thinking of packaging. Trouble is, it's a bit of a moving target as it
    doesn't have releases and there's a slow trickle of activity making
    changes. I could do a packaging for it and get it reviewed and uploaded,
    but then I'd have to do it again basically every month. This seems like a
    lot of work.

    What I'd much rather do is to get it packaged and reviewed *once*, and then
    set up automation which periodically compiles and uploads new versions from
    the git repository.

    At first glance this seems a bit problematic, as it would require uploading packages which haven't been reviewed by a human. I'd be relying on the automation to spot any potential problems. But, if the packaging's not
    changing --- which should be detectable --- I'm not sure that a human
    review adds much value. The codebase is huge and it'd be just as easy to
    slip something nefarious through a human review as it would with automated reviews.

    So, is there any way in which this could be done? Has anyone worked on
    tooling for it that they can point me at? Realistically it'd make the difference between getting this into Debian and having the .deb files distributed via PPA or as manual sideloads...

    <div dir="ltr">I have a compiler suite --- the Amsterdam Compiler Kit --- which I&#39;m thinking of packaging. Trouble is, it&#39;s a bit of a moving target as it doesn&#39;t have releases and there&#39;s a slow trickle of activity making changes. I
    could do a packaging for it and get it reviewed and uploaded, but then I&#39;d have to do it again basically every month. This seems like a lot of work.<div><br></div><div>What I&#39;d much rather do is to get it packaged and reviewed <i>once</i>, and
    then set up automation which periodically compiles and uploads new versions from the git repository.</div><div><br></div><div>At first glance this seems a bit problematic, as it would require uploading packages which haven&#39;t been reviewed by a human.
    I&#39;d be relying on the automation to spot any potential problems. But, if the packaging&#39;s not changing --- which should be detectable --- I&#39;m not sure that a human review adds much value. The codebase is huge and it&#39;d be just as easy to
    slip something nefarious through a human review as it would with automated reviews.</div><div><br></div><div>So, is there any way in which this could be done? Has anyone worked on tooling for it that they can point me at? Realistically it&#39;d make the
    difference between getting this into Debian and having the .deb files distributed via PPA or as manual sideloads...</div></div>

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andrey Rahmatullin@21:1/5 to David Given on Mon Jul 18 21:50:01 2022
    On Mon, Jul 18, 2022 at 08:25:05PM +0200, David Given wrote:
    At first glance this seems a bit problematic, as it would require uploading packages which haven't been reviewed by a human. I'd be relying on the automation to spot any potential problems. But, if the packaging's not changing --- which should be detectable --- I'm not sure that a human
    review adds much value.
    Ideally, though I have no idea how often this happens in practice, you
    should actually test your package manually before uploading it.

    --
    WBR, wRAR

    -----BEGIN PGP SIGNATURE-----

    iQJhBAABCgBLFiEEolIP6gqGcKZh3YxVM2L3AxpJkuEFAmLVuFYtFIAAAAAAFQAP cGthLWFkZHJlc3NAZ251cGcub3Jnd3JhckBkZWJpYW4ub3JnAAoJEDNi9wMaSZLh apYP/3JDataqFDBWRJQmLZB5VogPN/TgCLLlxV/sGTyZmqRfKAUjpF8by5tsTe8m 3v85R8fx5Xt2oyI99pFX0OVUFbTxa0fx90W/1SstL6sF3s5zKUrqDSwcLDb3+CjQ 1dBy/RYd2lZFF1vpfAmVJPdw0ha7qpaXVwU5/SZAyBcaGVWcDkF/0sSzJvyx/4fm L6oQ0W8zyz9yr6MQhtXEOb0SR7OBJP914VFKVaVADxfNoFp9J2jonLe0kBDF8zL9 8g4PkX/7Wrx7Oq+995byoinvoPbQSn1ACygC47M4DMbpXt7ifa8VCgeQn/Rh1IOx 0ssMZF9Rcr3NcWt+mDYOdsCbJE/uMG//MpmKEKEgRhoAuh5fokbkM8MlN2/kN87m +yB7FNRPx2J3CmZ/NNHrKtiaf2SAbkkP0Thj/dpJ+sS5+KQfsRAm4xCfKrEsVLfz omPBTb/Q1v0QsyruIZTg3CJJhzoEyctNaCeWTtkc0SFRH+X2oiiizoGAOb5/cLii +bCHYTH/p8WPyAOy97sxSaz6WxHJU9BuEGiOP6BpnzR+mXf2QZ+ufFnHjCUKjRiR fyzWOz+o7SE3Wbt2BhrqhSubfa5qoJqgenz54FAzG90oyNgu5+e0pzLMwRuuffsM Nu6FvMndm7OBik7y2k3mh7rrI4K/v1zxXkZBObWOLgAmBbGZ
    =utnN
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)