Please allow binary PPA->-proposed copying for language packs

[Martin Pitt]

$ copy-package.py -yb -p ubuntu-langpack -s dapper --to-suite dapper-proposed language-pack-kde-bn
12:15:52 INFO creating lockfile
12:15:57 ERROR Cannot copy binaries from PPA to PRIMARY archive.

At least for language packs it would be good to copy them with binaries, since re-building them in -proposed takes a lot of time (usually we talk about several hundred packages), and is fairly pointless as far as I can see. Either we trust the unsigned PPA archive enough to allow copies to -proposed in the first place, then it doesn't matter whether we copy sources or binaries. Or we don't trust it, then we should generally forbid PPA->Ubuntu copying (but that would be quite impractical, too).

[Julian Edwards (julian-edwards)]

This is an easy change, but "buyer beware" that not all PPAs are trustworthy. However, your langpacks are obviously fine.

This is a good one for Muharem to do to pick up some experience with the scripts.

[Martin Pitt (pitti)]

I still don't quite understand about which trust we speak here. For allowing source copy, but not binary, it obviously means that you think that someone can externally tamper with the .deb packages in a PPA, but not with the source packages. Can you please explain this in some more detail?

Of course not all PPAs are trustworthy, but that's why we don't copy random packages from random PPAs into Ubuntu. But that equally applies to source and binary packages.

[Celso Providelo (cprov)]

Well, it's not only 'trust' but also compatibility, since the PPA and the PRIMARY archive contexts can easily diverge, it's very easy to copy binaries that won't work in the desired destination. Copying only the source it will possibly fail to build if there are problem, causing less disturb in the PRIMARY archive.

But as mentioned this is a very high-level check and can easily be demoted if you think it's more inconvenient than necessary, specially at this very restricted audience.

[Martin Pitt (pitti)]

 subscribe ubuntu-archive

Hi Celso,

Celso Providelo [2008-03-06 13:28 -0000]:
> Well, it's not only 'trust' but also compatibility, since the PPA and
> the PRIMARY archive contexts can easily diverge, it's very easy to copy
> binaries that won't work in the desired destination. Copying only the
> source it will possibly fail to build if there are problem, causing less
> disturb in the PRIMARY archive.

Ah, that's indeed a good point. You mean that OGRE-wise, PPA packages
can build-depend on other PPA packages?

> But as mentioned this is a very high-level check and can easily be
> demoted if you think it's more inconvenient than necessary, specially at
> this very restricted audience.

My gut feeling is that this should be enforced on the policy and SRU
verification level, since at least for the langpacks this check just
leads to unnecessary resource consumption. So either converting the
error to a warning, or creating a whitelist of which PPAs are eligible
for binary package copying would work for langpacks.

What do the other archive admins think?

[Sarah Kowalik (hobbsee-deactivatedaccount)]

Yes, PPA packages can build-depend on other PPA packages. Ubuntu "universe" packages can also depend on Ubuntu "main" packages, as Ubuntu 'main' != ppa 'main' - yes, i'm aware that's not documented much, if at all.

Who exactly would be able to copy these packages over?

[Sarah Kowalik (hobbsee-deactivatedaccount)]

My other thoughts include:

* It's not safe to copy over binaries, only sources, for the reasons discussed above

* If we copy sources directly, we still keep the PPA version numbers, which makes it harder to figure out which packages are from unsupported PPA's, and which are from our archives (particularly if pkgbinarymangler gets broken again, and starts mangling ppa, etc).

* Who do we trust to copy random packages across? Do we trust those with existing upload rights, to their component? What if the licences are incompatible, and the uploader hasn't noticed? There's no archive admin group to check for new packages.

[Martin Pitt (pitti)]

ATM, only archive admins with drescher ssh access are able to run copy-package.py.

You convinced me that copying binaries is not generally safe. However, I do believe it is safe for langpacks:

 * There is a restricted team who is able to upload to the ~ubuntu-langpacks PPA (Arne Goetje and me)
 * The packages do not need to be pkgbinarymangled
 * We know that the source packages only use build-essential.
 * We never automatically start the copying process, it needs to be kicked off by an archive admin.

[Muharem Hrnjadovic (al-maisan)]

RF 5862