[indiana-discuss] [Fwd: [desktop-discuss] SFE binary packages for OpenSolaris]

[Brian Nitz]

Stephen Hahn wrote:
> * Martin Man <Martin.Man at sun.com> [2007-12-17 14:12]:
>   
>> Bart Smaalders wrote:
>>     
>>> You're missing the point.  ON developers don't build from source
>>> packages; they'll build from a mercurial workspace.  Why would
>>> anyone who's not working on ON compile it from source, and why
>>> should the OpenSolaris community spend the man years needed to
>>> support this?
>>>       
>> Because if you want to make a bug fix for urgent security bug in a 
>> software two years old, it is easier to compile from source package 
>> while adding the .diff, than to search for the right 
>> gate/tag/date/whatever in SCM to obtain the sources...
>>     
>
>   Easier:  maybe, maybe not.
>   
Would it be possible to abstract out the build as a remote service so 
the package manager only sees "build resource", "source patches" and 
"target package" and doesn't care how or where the build is done?  That 
way the user needn't recreate the entire build environment on their 
local machine (which may be a Sun Ray or laptop not necessarily the 
ideal build machine.)   It would also be nice to not have to build all 
dependencies of a package just to apply a 2 line source patch.

Of course you might want to charge for this service ;-)


>> and you are never sure that you actually found the right source that
>> was used to do this build...
>>     
>
>   For Mercurial:  false.  (For Subversion:  maybe.)  Changeset hashes
>   will be encoded into the package--you will know that you have the
>   exact source.  Unless you've got the hash from the tar archive from
>   the past, you cannot reach an equivalent level of assurance.
>
>   - Stephen
>   
This is good.  For supportability I'd love to see a more obvious and 
direct mapping between bugs to source lines to binary package/patch.  If 
we have a verifiable hash, at least we can theoretically trace a package 
(and it's owned binaries?) to its source.  There's quite a lot of work 
to make this all seamless though.