[Pkg-privacy-maintainers] Bug#910493: Handle transition from MAT to MAT2

[intrigeri]

Hi,

Daniel Kahn Gillmor:
> On Sun 2018-10-07 10:31:13 +0200, intrigeri wrote:
>> intrigeri:
>>> What matters to me is the users' perspective. I think we should
>>> provide a clear, unambiguous transition path and avoid leaking
>>> technical details to users. So once MAT2 reaches feature parity with
>>> MAT (I think the only real blocker is the lack of a Nautilus
>>> extension; MAT v1's seems to be broken on sid currently but it has
>>> a GUI which mitigates that problem) I think we should:
>>
>>>  - Have mat2 conflicts+replaces mat, remove mat from testing+sid,
>>>    and ship a transitional package called mat that pulls mat2 in.
>>
>> IMO we should do that as soon as mat2 installs the Nautilus extension
>> (#910491).
>>
>> Does this make sense to you? Is there a better way to handle this?

> this all looks reasonable to me as well.

As Jonas reported on #910491, it's unlikely that mat2's Nautilus
extension is in Buster. Ouch! So it's time to think about contingency
plans here.

To me this boils down to this question: do we feel more comfortable
with:

  a) including mat v1 in Buster (so less technical can use its GUI,
     even though its Nautilus extension was broken last time I tried),
     in addition to v2

or

  b) only including mat v2, without any GUI at all (and then add
     Breaks+Replace, get mat v1 removed from testing, and add
     transitional package if there's enough time to go through NEW).

?

I'm personally very uncomfortable with both options :/
But I'm leaning towards not including software when its author
says it's unsupported and has known (security relevant) issues.

Thoughts?

Other data points & ideas:

 - Given the python-nautilus issue essentially requires a transition,
   I doubt we'll find some way to provide desktop integration for mat2
   via buster-backports.

 - One could quickly patch together a Python 2 Nautilus extension that
   wraps mat2's CLI, or the simplest possible Python 3 GUI that does
   not depend on python-nautilus. I'm sure lots of users would be
   thankful if someone did this. There's very little time left to get
   this done and through NEW. But it could be an option for
   buster-backports.

Cheers,
-- 
intrigeri