[kobold at debian.org: The future of Zope{2, 3} and Plone in Debian and Ubuntu]

[Brian Sutherland]

On Sat, Nov 21, 2009 at 07:11:25PM +0100, Jonas Meurer wrote:
> hey fabio,
> 
> On 21/11/2009 Fabio Tranchitella wrote:
> > * 2009-11-19 19:44, Jonas Meurer wrote:
> > > did you have time to take a look at this issue yet? i think we should try
> > > to get zope2.12 into debian soon in order to leave enough testing time
> > > before the freeze. unfortunately i'm to busy right now to learn all that
> > > new stuff regaring zope2.12 (buildout etc).
> > 
> > Yes, I tried to get a working zope2.12 for Debian but I couldn't really get
> > anything else than hacks. It seems upstream is trying hard to make
> > impossible the packaging... :(
> 
> too bad :-(
> 
> the question then is how to go on. i do think to have zope2.12 in
> debian is worth maintaining hacks. one reason is that as system
> adminstrator i generally try hard to avoid custom compiled software on
> production systems.
> 
> could you commit your hacks to pkg-zope svn repository? i'll see whether
> i can dedicate some time to zope2.12 packaging in the next weeks.
> 
> i guess there're three ways to go:
> 
> 1) package all required dependencies for zope2.12 as seperate packages,
>    but only package the exact required version. this will breake
>    zope2.12 package once the dependencies packages get updated. i don't
>    consider this as a real solution. at least it's the worst one.
> 
> 2) create a monolithic source tarball with exact versions of
>    dependencies for zope2.12. this is the easiest way to go, but it's a
>    real mess for security team (duplicated code for all dependencies
>    that do exist as seperate packages as well).
> 
> 3) patch/fix zope2.12 source to work with most recent versions of
>    dependency modules, and package all dependencies. this is the
>    cleanest solution. unfortunately i guess that the versioned
>    dependencies are there for a reason, and that dependency modules
>    change their api within minor versions. i don't see another reason
>    why zope2.12 doesn't build with recent versions of the dependencies.
> 
> i clearly neither have skills nor time to work out a solution for option
> three. if you fabio neither have the time, then i guess we're stuck with
> option two. because from what i see we're the only two really interested
> in packaging zope2.12 for debian. i don't know what brian and doko do
> think.

To be honest, I don't use Zope2 anymore and so just don't have the
required dedication or specific knowledge required to package it.

As for your options. Option 3 is the way we're packaging the zope.*
packages and it seems to be working pretty well so far (fabio ?). There
does exist a KGS for the ZTK package which defines a release as an exact
set of package versions, but we basically just ignore that.

We've mostly been getting away with that because we focus on the lower
levels of the package dependency tree where people take more care to
maintain backwards compatibility.

I believe the best way for you to go is a hybrid solution of 2 and 3,
i.e. depend on the ZTK packages we've already packaged separately and
then put the rest of what you need in a monolithic package. This
basically recognizes that the base of the dependency tree is often
stable and backwards compatible while the higher Zope2-specific branches
are not. Perhaps you could use a script similar to the one
Rakotomandimby showed us to do this.

I think if you manage to do the hybrid solution and get the tests
passing for all the packages in the monolithic tarball, then you should
be good. As we package more of the ZTK packages, you can remove them
from the monolithic tarball.

(P.S. we try run the tests on the ZTK packages here, with varying
sucess:
    http://packages.vanguardistas.net/pkg-zope-buildbot/waterfall)

> 
> greetings,
>  jonas



> _______________________________________________
> pkg-zope-developers mailing list
> pkg-zope-developers at lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/pkg-zope-developers

-- 
Brian Sutherland