Gives package-installs-apt-sources lintian error

[Iain Lane]

The oem packages trigger the "E: package-installs-apt-sources" lintian error. It's deliberate we install apt sources though, so this should be overridden I think.

[Iain Lane (laney)]

$4, wondering if you can take a look at this please?

[Łukasz Zemczak (sil2100)]

As mentioned by Laney on IRC, might be a good thing to include that in the OEM MIR template: https://wiki.ubuntu.com/MIRTeam/Exceptions/OEM

[Shih-Yuan Lee (fourdollars)]

E: oem-qemu-meta: package-installs-apt-sources etc/apt/sources.list.d/oem-qemu-meta.list
N:
N: Debian packages should not install files under /etc/apt/sources.list.d/
N: or install an /etc/apt/sources.list file.
N:
N: Package sources are under the control of the local administrator and
N: packages should not override local administrator choices.
N:
N: Packages whose names end in -apt-source or -archive-keyring are
N: permitted to install such files.
N:
N: Refer to the sources.list(5) manual page for details.
N:
N: Severity: serious, Certainty: possible
N:
N: Check: files, Type: binary, udeb
N:

[Shih-Yuan Lee (fourdollars)]

How about using the debdiff to solve the problem of oem-qemu-meta in Ubuntu focal archive?

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "oem-qemu-meta_20.04~ubuntu4.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Iain Lane (laney)]

Hmmmm, it looks like I still get the lintian error:

E: oem-qemu-meta: package-installs-apt-sources etc/apt/sources.list.d/oem-qemu-meta.list

can you check again please?

If you can't get this to work, it'd be OK to document on the wiki page I think.

[Shih-Yuan Lee (fourdollars)]

/usr/share/lintian/profiles/debian/ftp-master-auto-reject.profile of lintian 2.62.0 on focal has included package-installs-apt-sources so it is not overridable.

[Bin Li (binli)]

@4$,

If we want fix it, we should rename oem-qemu-meta to oem-qemu-meta-apt-source. Should we fix it or document it at wiki page? Thanks!

https://lintian.debian.org/tags/package-installs-apt-sources.html

 E package-installs-apt-sources

Debian packages should not install files under /etc/apt/sources.list.d/ or install an /etc/apt/sources.list file.

Package sources are under the control of the local administrator and packages should not override local administrator choices.

Packages whose names end in -apt-source or -archive-keyring are permitted to install such files.

[Bin Li (binli)]

Or oem-qemu-meta depend on oem-qemu-apt-source to install the sources.list file.

[Iain Lane (laney)]

Please don't rename the binary packages. The way we implemented updating looks at packages matching "oem-*-meta" so we'd have to update that if we change it.

Honestly I think it's fine to ignore this particular one.

[Shih-Yuan Lee (fourdollars)]

@laney,

We want to deploy CI/CD for the meta packages.
It is annoying to see https://lintian.debian.org/tags/package-installs-apt-sources.html breaking the lintian test.
I support the idea of comment #12.
Could we make oem-qemu-meta depend on oem-qemu-apt-source to install the sources.list file to fix this problem?

[Simon Quigley (tsimonq2)]

(With my ~ubuntu-sponsors hat on, unsubscribing since there is nothing to sponsor.)

[Iain Lane (laney)]

On Wed, Jul 15, 2020 at 08:19:28AM -0000, Shih-Yuan Lee wrote:
> We want to deploy CI/CD for the meta packages.
> It is annoying to see https://lintian.debian.org/tags/package-installs-apt-sources.html breaking the lintian test.
> I support the idea of comment #12.
> Could we make oem-qemu-meta depend on oem-qemu-apt-source to install the sources.list file to fix this problem?

I'd rather not please. I think it needlessly increases the size of the
apt indexes for everybody, and we should just make our tooling ignore
the lintian tag. It's a shame it can't be overridden - if you want to
take that up with Lintian upstream that would be OK.

Cheers,

--
Iain Lane [ <email address hidden> ]
Debian Developer [ <email address hidden> ]
Ubuntu Developer [ <email address hidden> ]