[Debian-med-packaging] Bug#776131: gridengine: Should gridengine be removed from jessie?

[Dave Love]

Ondřej Surý <ondrej at sury.org> writes:

> Hi Roland,
>
> On Thu, Jan 29, 2015, at 13:39, Roland Fehrenbacher wrote:
>> My offer to take over still stands. What needs to be done to keep it in
>> jessie? Can we package "Son of Grid Engine" and still get it uploaded to
>> jessie?

A previous attempt was blocked because there was no complete list of
copyright holders (just like for linux, on which I based the package
wording if I recall correctly).  There is no such list, at least
publicly available, like for many packages.  I'm happy to maintain
packaging or appropriate changes if that doesn't block it in future.

> Nope, the only thing you can do is fix the RC bugs to keep the
> gridengine in jessie.
>
> So I guess it would be better to just remove it from jessie, do the work
> on 8.x in unstable and use jessie-backports to provide the usable
> current version to jessie users if there's a need for it.
>
> Cheers,

I don't know what the RC bugs are, but it should be removed for security
reasons if it can't be updated.  It doesn't ship enough to configure
against a user impersonating any other with a uid above a value which is
0 in the shipped configuration, i.e. it provides remote root on all exec
hosts, and probably the master.  (A previous "security" NMU was both
bogus and pointless in view of that.)

libdrmaa should be handled with alternatives.  (I don't know/remember
why there isn't a clash with torque and slurm already.)

To record it for anyone reading later:  SGE releases from
http://arc.liv.ac.uk/downloads/SGE/releases/ have debian-style packaging
installing into /opt, and the attempt at conformant packaging is under
http://arc.liv.ac.uk/repos/darcs/gridengine.debian/ via darcs, hg, or
git.  I thought the latter was also as a tarball, but that's currently
missing, which I'll fix.