[Pkg-utopia-maintainers] Bug#946231: Versions, Upstream version versus Debian version

[Simon McVittie]

On Thu, 05 Dec 2019 at 23:07:00 +0100, Geert Stappers wrote:
> Upstream is at version 0.116 ( https://gitlab.freedesktop.org/polkit/polkit/-/tags )
> Debian version is 0.105-something ( https://salsa.debian.org/utopia-team/polkit/blob/master/debian/changelog )
> 
> Debian changelog talks about changes from upstream version 0.114 and 0.116.

The latest upstream version is available in experimental.

The version in unstable is exactly what its version number indicates:
a very old upstream version, with the majority of the upstream changes
from later versions backported into it via debian/patches.

The reason for this is that upstream version
0.106 removed the "localauthority" backend (which
configures polkit via .ini-style files like for example
/var/lib/polkit-1/localauthority/10-vendor.d/org.freedesktop.Flatpak.pkla,
which can be overridden by sysadmin configuration in
/etc/polkit-1/localauthority or /var/lib/polkit-1/localauthority)
and replaced it with a new JavaScript-based backend (which
configures polkit via short JavaScript fragments like for example
/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules, which can be
overridden by sysadmin configuration in /etc/polkit-1/rules.d).

The migration path between the two is not obvious, and some of the Debian
maintainers of polkit are strongly opposed to it being configured with
JavaScript files, so at the moment we are stuck with polkit 0.105.

One day, I want to stop patching changes from 0.11x into 0.105,
and instead start patching the "localauthority" backend into 0.11x,
so that we can stick to the upstream version in all respects except
for the configuration backend. However, all the maintainers of polkit
(both in Debian and upstream) mostly work on other things, so it's rare
that someone has enough uninterrupted time to do something like that.

There has been some upstream unhappiness with the current configuration
arrangements, mostly because the mozjs library that is used for the
JavaScript interpreter does not have a stable API; so it is possible that
a newer upstream version will either change the configuration language
(again), or change the JavaScript implementation to something more friendly
(most likely a smaller interpreter like duktape).

    smcv