Message-ID: <248ffd64e14d87a42d686c73b3293f607aa22571.camel@santalla.io>
Subject: Re: Multiarch container builds, version pinning, and package
 retention policies are fundamentally incompatible
From: Nadia Santalla <nadia@santalla.io>
To: fossdd <fossdd@pwned.life>, Jakub Jirutka <jakub@jirutka.cz>
Cc: ~alpine/users@lists.alpinelinux.org
Date: Tue, 19 Nov 2024 16:32:47 +0100
In-Reply-To: <D5Q93UHIXUAE.2TSDK67WSPG7T@pwned.life>
References: <D5POTZXFUK1H.2LUELCKMXTWER@pwned.life>
	 <E83940A1-CC1C-456C-9F38-539B051B260C@jirutka.cz>
	 <c0ff727d04790e33f05f3904ab1c2f60381c84bb.camel@santalla.io>
	 <D5Q93UHIXUAE.2TSDK67WSPG7T@pwned.life>
Autocrypt: addr=nadia@santalla.io; prefer-encrypt=mutual;
 keydata=mDMEZqa8DhYJKwYBBAHaRw8BAQdA8Zuhl961yt0tiX3JhNa0RPWnPElwryswsXdaPA4jy
 P+0Ik5hZGlhIFNhbnRhbGxhIDxuYWRpYUBzYW50YWxsYS5pbz6ImQQTFgoAQRYhBB7yiOSB3lc3+s
 U7EhiwRbwJ6bUqBQJmprwOAhsDBQkSzAMABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEBi
 wRbwJ6bUqNo4BAJzbmHsX/YI0osEG15Y7pZ6Erfr5XQXGiRxZX+8MBtatAQCf6ZzYgTnLyr3LGu+v
 3kP23iLzHClFL0quxwazXQipCg==
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

Hi, thanks againf or your insights! Answering inline below:

On Tue, 2024-11-19 at 16:13 +0100, fossdd wrote:
> That's why we have stable releases. Stable releases only contain
> security (and bug) fixes.=20

> I never experienced such behaviour, and I do not agree to it. For
> example, pinning versions does not fix security issues.

I think there might be a misunderstanding here. We don't keep pinned
versions forever, or for a long time. The container ecosystem has
toolin that aids with that. An example of this can be:
https://github.com/roobre/renovate-alpine/pull/13

I think getting updates like this is highly beneficial for containers,
for a number of reasons:

- Security. Maintainers *notice* when packages they depend on release
updates and security fixes, and can react by updating and releasing a
new version of their image containing the fix.

- Testing. Some versions break stuff. Receiving updates in PRs allows
for a testing suite to run and ensure the updated dependency still
works. This also applies to new alpine releases, which may contain
breaking changes.

- Reproducibility. What I said earlier, the same container image will
contain the same version. If a maintainer needs to reproduce a problem
that happened one version ago, they can.

> This also applies to every other Alpine installation, even
> containers.
> You still have linked libraries in Alpine containers, which WILL
> break.


I think this is reasonably understood in the container world, while
definitely not on desktop. It is possible that I let versions drift, or
that two packages depend on one another. If that happens, I will adapt
my rules so the bot bumps those dependencies together.
If something breaks badly, the test suite (or even the build) will fail
and I'll know that I need to update the base image first.

That's what I think that retaining old versions for a while (on a
dedicated repo potentially, to save costs and to avoid unaware users
using it) can likely work. There are definitely tradeoffs but I don't
think it's something that people who work with containers daily cannot
expect or work around, with the benefits outweighting that effort.

- N