Comment 2 for bug 2054480

Hi Wouter -- thanks for the notes! I don't think anything listed above is a huge impediment to getting nbd-client into main (particularly given the source package itself is already there), but it's all stuff I need to document for the process.

> The test suite mainly tests the server, as that is where most things could go wrong. With one exception, none of the tests even use nbd-client, but instead use a specifically written test client which makes some assertions about server behavior. The one exception simply runs 'nbd-client -l', which requests the list of server exports before immediately exiting, making the test extremely superficial.

I had a brief look at converting the existing DEP-8 suite for autopkgtest use. As you note, for the server side this isn't too hard (I think it's mostly a case of having it use the installed binaries rather than the built ones). I hadn't noticed that the client tests are basically superficial, but as you note the attack surface is small so I don't think it'll be an issue.

> Migrating to the 3.0 formats has not been high on my priority list, mostly because the first few times I tried converting a package it insisted that I use individual patches, which I find to be too involved (if you want individual patches, use git, that's what it's for).

Heh, getting used to the quilt format can take a bit of getting used to. gbp's patch-queue (pq) command makes it less painful, particularly if you're used to working in git (it'll convert between the patch-set of the package and a sequence of git commits and back again). The main concern here is that, while 1.0 format is fine for working in Debian, it makes it harder for us downstream to, for example, revert/edit an individual patch if necessary, whereas this is rather simpler in the quilt format.

Again, I doubt it's an impediment since it didn't prevent the source package from entering main already, and the security team have obviously worked with it backporting patches before; it's just one of those things I needed to document as a potential concern for the MIR reviewer.

> I have since learned about adding single-debian-patch to debian/source/local-options, which solves the issue for me and which I've been slowly converting my packages to. I just haven't gotten around to the NBD package yet in this regard. If it helps, I'm happy to prioritize that.

Interesting -- I hadn't come across that before. Anyway, the last thing I want to do is put work on your plate -- if the MIR review comes back with anything, I'm more than happy to have a crack at it and send patches upstream (though obviously I wouldn't try and foist a packaging format on you -- that's very much your choice!). I'll try and have a look at adding the server-side tests to autopkgtest though, as that seems not too complex and certainly worthwhile.