MIME-Version: 1.0
In-Reply-To: <514355cb-b6f1-c220-99fc-b096dcb0b693@bitmessage.ch>
References: <514355cb-b6f1-c220-99fc-b096dcb0b693@bitmessage.ch>
From: William Pitcock <nenolod@dereferenced.org>
Date: Fri, 27 Oct 2017 01:16:19 -0500
Message-ID: <CA+T2pCFsduoT_cX5K=5Ngv-B0Ko2-0iViSS0VPo=WC9FykhJQw@mail.gmail.com>
Subject: Re: Building unofficial packages on Alpine build infrastructure?
To: Oliver Smith <ollieparanoid@bitmessage.ch>
Cc: alpine-infra@lists.alpinelinux.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

On Tue, Oct 24, 2017 at 5:47 PM, Oliver Smith
<ollieparanoid@bitmessage.ch> wrote:
> Dear Alpinists,
>
>
> at least Timo Teras[1] and William Pitcock[2] have proposed, that the
> Alpine package building infrastructure could be used for unofficial
> Alpine packages, when "the new build infrastructure [is] in place".

Yes, I have indeed proposed this.
But the new build infrastructure is not yet in place.

> So postmarketOS[3] is a thin layer on top of Alpine, that provides
> packages to make it work on mobile devices. Currently every user is
> compiling these from source, but we would be very grateful if we could
> use Alpine's infrastructure for building binary packages. That way we
> could focus more on actual development and giving back to Alpine (e.g.
> together with Ad=C3=A9lie, we're currently upstreaming KDE), instead of
> duplicating the effort.

I proposed that we (Adelie and pmOS) might work together, but
unfortunately our requirements are incompatible (LTS vs. non-LTS
KDE).[1]

> For reference, here[4] are our current aports. Especially the device
> folder makes no sense to be upstreamed. We will not build packages that
> contain closed source blobs (our firmware aports will be refactored to
> download these files at installation time[5]).
>
> Thoughts?

Well, I mean, I don't want to tell you what to do, but it seems
foolish to use a package manager which can cryptographically verify
package contents just to download a script which downloads the real
files.
At least, any firmware I would be loading into my phone, I would want
to be delivered to me in a signed package, not downloaded at install
time.
Not to mention that packages which download files in their
post-install scripts are a violation of Alpine policy.

William

[1]: Since we're using footnotes, I might ponder out loud why a phone
OS distribution is concentrating on KDE when they haven't even managed
to check off the "makes phone calls" tickbox yet.[2]
[2]: While I am not involved in sysadmin tasks around here, I am
pretty sure that any such collaboration on buildserver usage would be
dependent on the derivative proving it's viability first.  See also
checking off the "makes phone calls" tickbox.