Packaging from upstream vs Debian : guidelines?

Contribute Room Apps packaging
1

Hi,
it looks like there are so far no guideline / recommendation regarding the choice to package an app from the Debian package or from binary / source code directly grab from the project.
I think it’s good to let a full freedom to the packager, but good to remind pros and cons of the 2 solutions in https://yunohost.org/#/packaging_apps to make him aware.
In short what’s at stakes (to be completed) and associated tips :

  • Pros to package from upstream
    • faster to provide last version (counterargument : check whether the package is in backports and how reactiv is the maintener wrt previous upgrades)
  • Pros to package from Debian
    • Debian QA :
      • Debian Maintainer can be a first barrier to check for security leaks, anti-features, privacy threats…
      • privacy leaks are considered as bugs and usually patched by Debian
    • better integration in Debian ecosystem
      • conf files are in /etc/ , binaries in /bin/ … easier for admins who are used to dig (a bit) in the command line, help to keep a structured system.
      • lighter disk usage (ex: avoid to duplicate libraries) (counterargument : several libraries (npm, …) are also well managed by YNH

What would be the YNH policy in case for one software 2 YNH packages are proposed : 1 with upstream sources, 1 based on Debian packages ? AFAIK YNH cannot manage conflicts between apps ?

Thanks for your opinions/lights !

1 Like
2

Other elements:

  • Package from upstream allows to install several times a webapp.
  • A lot of yunohost apps are not packaged inside debian.
  • The web apps need to be up to date (the most possible) for security reasons and activate backports could be a mess in some situation.

If there are several packages with the same app, i think we will discuss it and select the app that seems well packaged and the most integrated. If the quality is equivalent, i think the upstream package will be prefered (but it should be case by case).

“Who is committed to maintaining this package?” is also an important question.

You have a specific app in mind ?

1 Like