Re: gnulib and distros

[Jim Meyering]

Hi Sylvain,

[this thread started here:
 http://thread.gmane.org/gmane.comp.lib.gnulib.bugs/15559 ]

Sylvain Beucler <address@hidden> wrote:
> FYI, Debian apparently does not accept new packages that bundle
> gnulib, asking to rebootstrap with their packaged copy instead.
> http://packages.debian.org/search?keywords=gnulib

That policy is contrary to the gnulib development model,
and is almost guaranteed to cause trouble.
I hope they change it.

If they're going to package gnulib, they have an obligation to understand
enough of its development/use model to know that requiring all packages
to use the same version of gnulib is likely to cause subtle and
hard-to-diagnose failures.  I sure hope they don't try to impose such
a requirement on any package I care about.  coreutils release tarballs
(built with a very specific snapshot of gnulib) undergo significant
testing.  If you rebuild it against a different snapshot, not only do
you invalidate much of the testing, but you can also easily introduce
build failures and run-time bugs.

> Just to know, what do you think about it? Afaics the Debian 'gnulib'
> package is refreshed monthly with a git checkout dated "this month's
> 1st day at 00:00". Since gnulib is a 'no release' project I'm not sure
> about it. Usually I perform some testing of my copy of gnulib and I
> refresh it only after a release. At the same time it makes it easier
> (though not automatic, since it's a build-time dependency) to update
> all Debian packages using gnulib should there be a security fix.

No simple or easily automated approach will work.