Unsurprisingly, I awoke to a disappointing response from the Debian bugs team. The email was sent privately so I wont post it here, but it boils down to “nah man, this is normal”. On a whim, I have therefore asked the Debian TC if they have a policy on quality and correctness review of patches inserted by Debian into upstream software:
On the recommendation of a friend on a business themed social network, I have just sent the following email to owners@bugs.debian.org about my experiences on the Debian bug tracker recently. It will be interesting to see if anything comes of it.
So… a really really long time ago I wrote a small set of PNG utilities called pngtools. They’re not particularly complicated or anything, but a few distros decided to package them, including Debian (and therefore Ubuntu), Gentoo, Mint, and so forth. I’ve talked previously here about resurrecting the old subversion commit history and attempting to modernize the code.
And then something weird happened. A couple of weeks ago a github issue was filed against pngtools. The entire bug report is a single sentence pointing to the Debian bug tracker where people are being… weird. I think perhaps I accidentally overlapped with two things — a slightly entitled user, and people who appear to “karma farm” by pushing bug reports from Debian upstream with the minimum possible level of detail. Certainly when I look at the github history for these users they do not have a good hit rate for reporting bugs which actually result in a fix upstream. I am unclear on why they would be doing this thing if their goal isn’t either to acquire a fix or to earn some sweet sweet made up internet points.
…and its actually a pretty neat idea!
Now admittedly, I encountered extrepo when one of the repos being added to a Docker container build I care about was being unreliable, but that caused me to dig into what it is and how it works and I quite like the idea.
The basic idea is that there are people out there who publish packages for Debian, either as hilarious curl scripts which you’re meant to pipe into a root shell, or as just .deb files which you download and manually install. Instead of being terrible though, what if there was a tool which knew how to provide apt repository configurations for those things? Then, apt would do the right things when the packages changed and so forth. Those configurations could come from a central source which you could also trust to provide the GPG keys that signed those packages. Neat yeah?