[MIR] distro-info, distro-info-data, and shunit2

[Scott Moser]

This is a Main Inclusion Request for source packages distro-info, distro-info-utils, and shunit2.

== Main Inclusion Request Info ==
* Availability
  distro-info has been in universe since 11.10. The package distro-info-data is essentially split off of that package, and will be new in 12.04.
  shunit2 has been in universe since lucid in its same upstream (2.1.5 version).

* Rationale
  The distro-info package provides a nice way for packages to avoid hard-coding release names and then later requiring an SRU to support new releases. Because it is not in main, packages *in* main cannot use it without providing a fallback to a list of hard coded strings.
  The maas and cobbler packages are just 2 that use this to avoid hard-coding release names or other distro-info.

  shunit2 was selected as a unit test framework to make sure the new sh version of the utilities were functioning as intended.

* Security
  * distro-info, distro-info-data:
    There should be little security concern, as there is only command line tools that are not required to run as root and text in CSV formated data.
    The tools is written in shell, and should be fairly robust against command execution, since it only forks one time (for the 'date' command).
  * shunit2: shunit2 has only been touched once since 10.04, and not for security related or severe bug.

* Quality assurance:
  There is a test suite in distro-info that ensures that data output is as expected. The commands 'ubuntu-distro-info' and 'debian-distro-info' have man pages, and are generally easy to use.

* UI standards
  There is no translation provided in distro-info, distro-info-data, or shunit2. This could be added at a later date, but this is probably just a developer tool, and non-translated output is not terrible.

* Dependencies:
  All build and binary dependencies are in main.

* Maintenance:
  The distro-info-data package has been designed explicitly for simple SRUs. The distro-info package really should not require much maintenance, but is present in debian and has an maintainer active in both Debian and Ubuntu (Benjamin Drung).
  shunit2 has only been touched twice in debian since 10.04. It is a straight sync, and should not cause any issues.

* Background information:
  I'm aware of at least 3 packages that I've been involved in developing (cloud-utils, cobbler, and maas) that use distro-info. I'm sure there are others, and the general idea of removing the requirement of hard coded release names is extremely useful.

Related bugs:
 * Bug 963062: [FFE] distro-info should have posix shell cmdline tool

[Jamie Strandboge (jdstrand)]

I think it is important to note that as of 0.7 distro-info no longer has a dependency on haskell. Please note it did FTBFS because of 3 failing tests.

[Benjamin Drung (bdrung)]

I fixed the build failures and will upload the fix in version 0.7.1 very soon in Debian. In 0.7.1 the custom test suite will be replaced with shunit2, which isn't in main. Therefore shunit2 needs a MIR too. All MIR requirements apply to it.

[Jamie Strandboge (jdstrand)]

shunit2 review:

* In Debian, no important bugs.
* No CVE history
* build dependencies and runtime dependencies are in main
* lintian clean except for one non-important warning:
W: shunit2: wrong-name-for-upstream-changelog usr/share/doc/shunit2/CHANGES-2.1.txt.gz

Please add a bug subscriber. Marking 'Fix Committed'.

[Jamie Strandboge (jdstrand)]

FYI, distro-info pulls in liblist-compare-perl as a Build-Depends, which is in universe. Also, distro-info has now been rewritten again, in C in 0.8. It makes it difficult to ascertain the quality of the package when it is being rewritten every few weeks.

[Jamie Strandboge (jdstrand)]

distro-info-data review:
* In Debian, no important bugs.
* No CVE history
* build dependencies and runtime dependencies are in main
* lintian clean

Please add a bug subscriber. Marking 'Fix Committed'.

[Jamie Strandboge (jdstrand)]

distro-info review:
* In Debian, no important bugs.
* No CVE history
* build dependencies need shunit2, distro-info-data (both covered here) and liblist-compare-perl (not covered). Runtime dependencies are in main
* lintian clean
* has a test suite and it is enabled in the build

Please add a bug subscriber. Marking In Progress since liblist-compare-perl needs to be either added to this MIR or removed as a build-dep. It would be nice to have a comment from the server as to whether or not distro-info is suitable since upstream is volatile.

[Benjamin Drung (bdrung)]

The first rewrite of distro-info (Python -> Haskell) was done to gain speed improvements (it's used for bash completion and is called in bashrc on some systems). The second rewrite (Haskell -> Shell) was done to make a MIR possible, because Haskell is not in main. The third rewrite for just out of curiosity about the speed improvement of C over Shell. C is the fastest language and there is no language in main with a shorter startup time. There is no reason to rewrite it in the (near) future in a different language.

To improve quality, distro-info-data 0.8 comes with a data validation check now.

[Scott Moser (smoser)]

I'm fine with the changes to C, I would have rather not seen the dependency on liblist-compare-perl added.
So, I'm adding the liblist-compare-perl onto this MIR.

Thank you, Jamie.

[Stefano Rivera (stefanor)]

liblist-compare-perl is only being used for the test suite, so should be easy enough to drop

[Stefano Rivera (stefanor)]

Dependancy on liblist-compare-perl dropped in git HEAD.

[Jamie Strandboge (jdstrand)]

Based on everyone's feedback, marking distro-info as 'Fix Committed'. Please feel free to seed once the new version that drops liblist-compare-perl is in Ubuntu.

[Benjamin Drung (bdrung)]

distro-info 0.8.2, which drops liblist-compare-perl, is now in precise.

[Martin Pitt (pitti)]

Promoted distro-info and shunit2. Not sure whether liblist-compare-perl is still needed, but I don't think so.