Env and Stacks/Playground repository (draft)
The Playground repository gives contributors a place to host packages that are not up to the standards of the main Fedora repository but may still be useful to other users. For now the Playground repository contains both packages that are destined for eventual inclusion into the main Fedora repositories and packages that are never going to make it there. Users of the repository should be willing to endure a certain amount of instability when using packages from here.
All packages in Playground must play nice - no bad licenses, no proprietary software, no patented software.
- Packages must follow the Legal Guidelines. In particular, the license for all packages must be approved in the Legal Guidelines.
- Packages may violate other Fedora Packaging Guidelines.
How the repository works
Packages for the repository are built in COPR. The COPR owner can propose the repository as a whole for inclusion into the Playground repository by marking it as such in COPR. Repositories/packages successfully built and satisfying the Playground repository's Policies are copied into the Playgroud repository. The one Playground repository includes many Copr repositories.
- How do the updates work?
- The Playground repository follows the rolling release model. Data in Playground are more repository of repositories. All the builds in the COPR repositories that are selected to feed the Playground repository are marked as Playground repository content.
- This is similar to the Rawhide repository.
- Initially, the Bodhi update system will not be used.
- These decisions were made on the March 4, 2014 meeting, but after working with dnf plugin was changed.
- Does it have an additional testing repository?
- Initially, there won't be an additional testing repository. If packagers want to provide some testing packages, they can create an additional COPR that will contain these testing packages.
- This decision was made on the March 4, 2014 meeting.
- Self hosting: All packages in the Playground repository are buildable using only packages in the Fedora' main repository and the Playground repository.
- This decision was made on the March 11, 2014 meeting
- Upgrades and broken dependencies
- FedUp will support upgrades with the packages in the Playground repository as if it was a generic third party repository. No special handling of the Playground repository will be implemented.
- Packages in the Playground repository may have broken dependencies. We'll encourage maintainers to keep the package set free of these problems but by its nature (rolling, experimental, having packages who's dependencies change frequently) the Playground repository may have these problems more frequently than the Fedora's main repository.
- We'll also implement a way to automatically notify the package owners about broken dependencies.
- These decisions were made on the March 11, 2014 meeting
- At the moment, the Playground repository is not multilib. This may change in the future if someone devotes the time to make it happen.
- This decision was made on the March 11, 2014 meeting
- Details about content:
- We will provide a kind of "non-blocking review service" and later we will talk about whether we should make it mandatory or not. Coprs won't be blocked by reviews results in the beginning. April 1, 2014
|Need||How necessary||Groups to Coordinate with||Disk space for the yum/dnf repositories||Necessary||Infra|
|Ability to mark an individual COPR for inclusion in the Playground repository||Necessary||Copr devs|
|Continuously regenerating repodata||Necessary||Infra|
|Daily composes of the Playground repository||Necessary||Infra|
|Copr deployment that's considered reliable enough to build packages for this repo||Very nice to have||Infra/Copr devs|
|Build from a git repository URL and revision hash||Optional but nice to have||Copr devs|
|deltarpms||Optional but nice to have||Releng|
|multilib||Optional but nice to have||Releng|
|Signing by obs-signd||Necessary||Copr devels|
|Reviews - automatic service for reviews||Optional||pingou&sochotni|
- Taskotron - basic sanity for inclusion into Playground?
Open Questions might be solved by multiple repos proposal
- Do we allow conflicts with packages in the main repo?
- Do we allow replacement of packages in the main repo?
- Do we allow "backdoor replacement" of packages in the main repo? ie: Let's say I have a package in the playground repo: NetworkManager2.1. And that conflicts with NetworkManager. Is that allowed? Is it allowed as long as it doesn't have any virtual provides/obsoletes that would automatically allow it to replace the package in the main repo?
- Do we allow conflicts between packages in the Playground Repo?
- Do we allow replacement of other packages in the Playground Repository? (How do we stop this in our implementation?)
- Do we allow "backdoor replacement" in the playground repo?
- How do we deal with multiple versions of same package provided by different COPRs?
- Do we trust the person whose repo/package was accepted into the Playground repository to keep it up-to-date and address serious bugs/security issues?
- Just telling users that they should keep up with the security issues themselves is not a solution since that's well understood to be near impossible.
- The problem with reactive removal of such packages from the repository is that this doesn't remove packages from users' systems.
- Although the problem of package removal also exists in Fedora's main repos, it is mitigated somewhat since there we have a larger maintainer pool for addressing orphans, short lifecycle means that abandoned packages disappear in about a year, and packagers packaging things for the main repo have a higher bar to entry and are generally more serious and knowledgeable.
- One possible solution is to set up an empty package that obsoletes such a problematic package.
- Another solution is to have the
fedora-playground-releasepackage which has obsoletes like:
- If a person misuses the community's trust by intentionally packaging malware or not fixing serious security issues found in his packages, then we could blacklist his FAS account which would prevent inclusion of his packages in the Playground repository.
- Do we expect people to package stable/usable software in the Playground repository?
- If we would want to enforce the content of the repository to be something stable, then we would be back to approving things individually.
- Probably some packages will be more unstable than others and that's fine.
- We could at least put up some guidance that would promote the idea that the Playground repository should contain stable/usable software (similar to the first goal of the Rawhide repository) and that bleeding edge/"eats your babies" software should be rather put into a COPR (with a warning description next to it).
- Builds from coprs or whole coprs might get deleted generally. Do we allow that in Playground repository? On meeting on 04/15 we discussed some POVs:
- Allowing to delete those will save some space that is limited now
- With deleting we will lose possibility to get sources for the packages users can actually be using (a question if that is problem for GPL packages was raised -- 2014-04-15 Richard F. states it should be OK as soon as we delete SRPM at the same time as RPMs)
Provide content of Coprs
- Use software written for softwarecollections.org or add fields into pkgdb2 (test instance http://22.214.171.124/) ?
- Display the package(s) in the repository
- Display the date when the package was added
- Display the date when the package was last updated
- Display who owns the package, if a provenpackager a special symbol is displayed?
- Display the status of the package (like if it is bad, unusable, removed, terrific)
- Is package in Fedora, or moving to Fedora? Which version.
- Is the package signed? If not signed do we want to state why? Do we want to include a link to request that this package be considered for signing?
- Are there any tests associated with this package? - automated, manual, etc.
- Does package have broken dependencies? If so, it is marked a certain way.
Which tests do we want to run on Playground repo?
- Is it installable on latest Fedora with Playground repo? (no missing Requires).
SOLVED - 1 Big repo vs multiple small ones
decided - April 1, 2014
Ideally users would enable just one "playgrond" repo and would get all nice updates. However this has several issues:
- We'd need support in rel-eng for multiple versions of identical package (problems with composes)
- Users would get *all* playground packages not just ones they are interested in
- There is no way to specify which packages from playground to install (or they are inadequate)
Most likely better approach is repo-of-repos where:
- Each project has a COPR repo (already done since that's how they are built)
- Playground repo contains these repo files
- We can add GUI support for enabling on per-feature basis (i.e. install playground repo for "Django 1.6" or "Chromium" or ...)
- Possible conflicts are between features. It's not ideal but that way there *can* be conflicts and they are not catastrophic. People who want to test django do not necessarily want to test Chromium (or other way around)