Packaging CPAN modules for Fedora, the Oslo QA Hackathon, CPAN::Porters

Sat Mar 8 07:19:32 UTC 2008

On Sat, Mar 8, 2008 at 8:26 AM, Ralf Corsepius <rc040203 at freenet.de> wrote:
>
>  On Fri, 2008-03-07 at 17:19 +0200, Gabor Szabo wrote:
>  > On Fri, Mar 7, 2008 at 11:55 AM, Ralf Corsepius <rc040203 at freenet.de> wrote:
>  > >
>  > >  On Fri, 2008-03-07 at 10:38 +0200, Gabor Szabo wrote:
>  > >  > On Fri, Mar 7, 2008 at 10:23 AM, Ralf Corsepius <rc040203 at freenet.de> wrote:
>  > >  > >
>  > >  > >  On Fri, 2008-03-07 at 09:37 +0200, Gabor Szabo wrote:

>  > Where can I fetch this list from?
>
>  I am using this script:
> ...

thanks I'll try to integrate it into that report.

>  > In addition many corporate users take the distros as "given". They
>  > don't even think
>  > they can ask the distro people to include something in the distro.
>  > That means in many cases the users won't ask and you'll think they
>  > don't need the modules.
>
>  That's the difference between Fedora and "commercial distros".
>  Fedora is a "taylor-the-distro-to-your-demands-by-contributing" and
>  "mutually-share-the-benefits-with-others" distro.
>
>  ... that's essentially the basis of all open source development, which
>  makes the fundamental difference to "commercial OSes" ;)

Most users I encountered don't really differentiate between the distros
they say we use "linux version N" and that does not mean the kernel.
The same people won't know they can ask or get involved in adding more
packages. They just see the whole thing as given.

>  > IMHO there is very little communication between the distro communities and
>  > the Perl community. Some Debian people have started a dialog on the last
>  > YAPC in Vienna and I wish we can increase that even further.
>  > The QA Workshop in Oslo would be a great opportunity for that but if none of
>  > you can come then the next YAPC::EU in Coppenhagen can be also good for
>  > more personal contact.
>  <sigh/> That's fundamental problem "community-driven/maintained" distros
>  like Fedora and Debian: Volunteers don't have travel budgets ;)

Actuall the QA Workshop might be able to finance your trip so if you
have the time
and the willingness to join the workshop, please add yourself to the wiki
http://perl-qa.hexten.net/wiki/index.php/OsloQAWorkshop2008
ASAP and we'll see if the organizers can cover your costs as well.

See below one of my objectives on the QA Workshop.

>  >
>  > The Debian people are saying they don't care too much about what are the
>  > version numbers as long as any single module sticks to its versioning
>  > model.
>  Well, ... It definitely doesn't apply to rpm-based distros such as
>  Fedora.
>
>  Choosing "versioning models" has always been problematic and
>  controversial in general, as well as has synchronizing two different
>  versioning models been problematic.
>
>
>  > What we can do is come up (if you have not done it yet) with a mapping solution
>  > that will easily map most of the CPAN version themes to the way Fedora does it.
>  > We can include this in Kwalitee metrics of CPANTS.
>  > Then when you encounter a module that does not use any of those version themes
>  > you can politely point the author to that document.
>  There have been dozens of such cases in Fedora-rpms/CPAN-dists in rpms history :(
>
>
>  > So what is the definition of a version number in Fedora?
>  Fedora is rpm based. I.e. it internally applies rpm's versioning scheme.
>
>  Unfortunately, elaborating how rpm's versioning works would be beyond
>  the scope of this mail :(

Is that so complex? I mean can't you just write it down as a regex?
Isn't that   \d\d\.\d

>  > >  > >  - Think about the licenses you apply. Write Free software.
>  > >  >
>  > >  > Do you have examples you encountered where it is not so on CPAN?
>  > >  I don't have a concrete example at hand, but there have been plenty of
>  > >  such cases.
>  > >
>  > >  Most CPAN dists apparently are maintained by individuals, who actually
>  > >  don't care much about licensing.
>  >
>  > You are right on the fact that most distros are maintained by individuals but
>  > I don't seem to be able to find prof for the second part.
>  Do I have to dig out the cases we've encountered?

No, but I'd appreciate if you also copied me next time you encounter one.

>
>
>  > >  You might not be aware about it, but there are people who considers the
>  > >  original "Artistic" license to be non-free (One of these groups is the
>  > >  FSF: http://www.gnu.org/licenses/license-list.html)
>
>
> > Do you say that Fedora includes only code which comes with an FSF
>  > approved license?
>  No. We once had the rule to include only package which carry an OSI
>  approved license, but ... rules have been weakened ... I don't want to
>  reheat this controversy at this point.
>
>  Fact is: Opinions on what to consider Open/Free SW diverge.

Options differ but Artistic 1.0 is OSI approved.
But that's not the point of my initiative anyway.

>  > It would be more constructive to give reasonable wishes what would you like
>  > to see in the CPAN distros - license vise - in order to make it easier
>  > for you to build rpms.
>  OK, my advice to CPAN module authors:
>  * Clearly and properly copyright your works.
>  * Always apply a widely used and commonly acknowledged license to your
>  works.

OK so there is CPANTS with it Kwalitee metric.   http://cpants.perl.org/
I'am trying to collect clear - automatically verifiable signs that can be
added to CPANTS to mark a module as "easily_repackagable"
or maybe "easily_repackagable_by_fedora".

That would allow you - the Fedora maintainers - to communicate some of
your wishes to the CPAN authors community. For this we'll have to come up
a better (read: algorithmic) definition of do you mean by
1) good version numbering theme
2) the above two points about licenses so
    - how can I verify the existence of clear and proper copyright?
    - what are the preferred licenses for Fedora?

No I am not expecting it to be a one-off answer. It is an iterative process.

>  > Would that be enough for you to have that field or you don't care about that and
>  > you prefer to have the license in the source files? Is there any
>  > format that might
>  > help you?
>  No. As with any arbitrary package, review will have to look into each
>  and every individual file a tarball contains, because this is what
>  legally matters.

Does the legal process require the usage of eyeballs or can this "look into"
be done programmaticaly? In any case, we might be able to include
an check into CPANTS that will give you a first indication and the module author
a feedback even before you encounter a problem.

>  > Maybe they can get away with that as currently most of the Perl community
>  > uses and recommends CPAN.pm and CPANPLUS as ways of module
>  > installations *because* there are not enough modules in the various
>  > Linux distros.
>  CPAN and CPANPLUS are contradicting package managers.
>  Like any other package manager they do not harmonize well with other
>  package managers (such as rpm or dpkg).
>
>  Linux users are strongly advised not to use them.

You see how incompatible are the current recommendations of the Linux packagers
and the Perl people?

Lately I have also arrived to the conclusion that if you are not
interested in bleeding
edge Perl development then you should use only the modules supplied by your
OS or Perl vendor. For that having only 1000 modules is way too low.

I am using a wide range of Linux distros as I am a consultant and
every client uses somethings else. I encounter missing modules on
daily bases so I have no choice
but to use CPAN.pm.
One of my larger objectives with this project is to change that.

>  > So where shall I send my wish list of CPAN modules I would like to see
>  > in Fedora?
>  Join Fedora and contribute to it if you need some CPAN modules on
>  Fedora: http://fedoraproject.org/wiki/PackageMaintainers/Join

My way of contribution would be to improve the description in
CPAN::Porters http://search.cpan.org/dist/CPAN-Porters/
to improve the report of the available modules in all distros
http://www.szabgab.com/distributions/
and to add metrics to CPANTS to mark CPAN packages as
"easily_repackagable".

I'd really appreciate your help in those in order to make your work
as Fedora packager smoother.

Gabor
ps. As Dave Cross also mentioned, even TPF - The Perl Foundation
might give you a sponsorship.