Bug#537582: libxml-sax-machines-perl: XML::SAX::Machines::SiteConfig and upgrades

[Jonathan Yu]

Hi Niko:

Thanks for taking a look at the package and filing this report.

On Sun, Jul 19, 2009 at 11:11 AM, Niko Tyni<ntyni at debian.org> wrote:
> Package: libxml-sax-machines-perl
> Version: 0.41-3
> Severity: normal
>
> Quoting the fine manual of XML::SAX::Machines:
>
>  WARNING If you modify anything, modify only
>  XML::SAX::Machines::SiteConfig.pm.  Don’t alter
>  XML::SAX::Machines::ConfigDefaults.pm or you will lose your changes
>  when you upgrade.
>
> Unfortunately XML::SAX::Machines::SiteConfig.pm is shipped under
> /usr/share/perl5 in the package and is therefore not a configuration file.
> This means it will be overwritten (or deleted) on upgrades.
That's a good point.
>
> I'm not sure if we can assume that the user is smart enough to place
> a changed SiteConfig.pm under /etc/perl where the changes will not
> be overwritten. If we can't, the severity of this bug should be
> upgraded to 'grave' due to the data loss implications.
>
> We have seen two stable upgrades without any report of breakage, so
> I suspect nobody actually needs to change the defaults. Therefore I'm
> leaving this at 'normal' and I think improved documentation would be a
> satisfactory fix for squeeze. Other opinions would be welcome.
Perhaps a simpler solution would be a documentation patch,
specifically to tell people to put a configuration file in
/etc/perl/... etc.
>
> In the 'grave' case, a fix could be to check the md5sum of an unchanged
> SiteConfig.pm in a preinst script and copy it over to /etc/perl if
> necessary (but obviously avoiding to overwrite anything in /etc/perl.)

I think that sort of thing is kinda tough to do, and prone to being
broken. Ideally, the users wouldn't be editing things in /usr/share
(because they know those files are managed by the system and could be
overwritten) and instead put config in /etc, where it belongs.
>
> The versions of the package in previous stable releases are only
>
>  sarge => 0.41-2
>  etch  => 0.41-2
>  lenny => 0.41-3
>
> so there's most probably just one md5sum to look for.

I'm preparing a documentation patch using quilt, I'll post a reply to
this mail when I have something substantive.