2013-04-03: Debian packaging of Git upstreams
Since there's a discussion of packaging software for Debian that uses Git
upstream on Planet Debian
right
now, I
wanted to weigh in and advocate for my current workflow for this
situation, which I'm quite fond of. It's worth noting that I'm also
upstream for quite a few of the packages I maintain, all in Git, and I use
(almost) exactly the same structure for packaging my own software as for
packaging anyone else's. So I have some experience with both sides of
this.
First off, I completely agree with Joey: if upstream is already using Git,
there's no reason not to base the Debian packaging on the upstream
repository, and many, many reasons to do so. One of the biggest
advantages is that when repositories share a common basis and have been
regularly merged, you can easily cherry-pick commits, which is wonderful
for security releases and situations where you need a quick bug fix from
an unreleased upstream branch. I make very heavy use of this when
packaging OpenAFS.
I do, however, like to base the Debian packaging on the released tarball,
if for no other reason than that's the artifact that other people can more
easily confirm. Yes, you can do the same thing with a Git tag, but the
tarball is what upstream considers a release, so if one is available, I
think it makes the most sense to base the packaging on it. I do this even
for my own software.
Thankfully, it's not that difficult to do both. Sam Hartman was the one
who showed me this technique, and (after I used a manual script for some
time for a couple of packages) Guido Günther incorporated the support into
git-import-orig. The key idea is to still import the tarball into the
upstream branch, but instead of making that import a simple commit, you
make it a merge commit referencing the upstream release tag or commit from
their Git repository.
This means that you still get the exact contents of the release tarball on
the upstream branch (and pristine-tar works as normal), but that branch is
also based on the full upstream line of development. Therefore, so is
your packaging branch (master or what have you) since you merge upstream
into it. You can then charry-pick and take advantage of all of the normal
Git features when following upstream development.
This is dead simple to do with git-import-orig. Just add the upstream
repository as a remote for your Git repository, make sure it's up to date
with git fetch and you have the upstream tags, and then pass the
flag --upstream-vcs-tag <tag> to git-import-orig whenever importing
the upstream release tarball. git-import-orig will handle the
construction of the merge commit for you and everything will just work,
exactly like it normally does with git-buildpackage except with a more
complete history.
This support was added in git-buildpackage 0.6.0~git20120324, so it's
available in unstable and testing.
(I was going to update my notes on
Debian packaging with Git to include this information before posting
this, but I see that it will require some restructuring and quite a few
changes to that document and I don't have time tonight. Hopefully soon.)
2013-04-10: Hugo nominee haul
I need to write up new Kindle books, of which there are now quite a few
due to various sales plus the Hugo nominee slate, but I got another set of
paper books and they're sitting in front of me. So here's a list.
Saladin Ahmed — Throne of the Crescent Moon (sff)
Elizabeth Bear — Shattered Pillars (sff)
Ta-Nehisi Coates — The Beautiful Struggle (non-fiction)
Guy Gavriel Kay — River of Stars (sff)
Jenny Larson — Let's Pretend This Never Happened (non-fiction)
Domenica Ruta — With or Without You (non-fiction)
Jay Wexler — The Odd Clauses (non-fiction)
Ahmed's book is the remaining Hugo nominee that I didn't already pick up.
I'm delighted to see the diversity on the Hugo and particularly the Nebula
slate this year, and I'm curious to see the spin that Ahmed brings to the
epic fantasy genre.
Bear's book is the sequel to Range of Ghosts, another book I'm very
much looking forward to reading to but haven't yet. I'm rather behind on
reading Bear's work right now.
Let's Pretend This Never Happened, With or Without You, and
The Beautiful Struggle are all memoirs, of varying degrees of
seriousness. I've gotten hooked on Coates's writing at
The Atlantic,
and I highly recommend it if you've not yet seen it. Domenica Ruta's
memoir is the latest Indiespensible selection.
Jay Wexler's book was recommended by Lowering the Bar, a legal humor blog whose entire archives I'm slowly
reading.
But the highlight of this order is Kay's River of Stars, which is
a sequel of sorts to one of my
favorite books ever. This
is probably the book I'll read during my next vacation.
2013-04-26: WebAuth 4.5.0
Time to finally release three months of work!
This is a very large feature release for the multifactor support in
WebAuth and for the integration with the user information service, which
is the way that WebAuth interacts with local site policy. (Currently, you
still have to write your own to a well-defined protocol, although we do
hope to provide Perl modules to help with this in the future.)
The major driving motivation for this release is to add the infrastructure
required to set long-lived persistent cookies in a browser that contribute
factors to authentications, which allows WebAuth to support "remember this
device" functionality and to only require multifactor from devices from
which a user has not previously authenticated. This includes a new token
type, new attributes the user information service can send (including a
way to invalidate such tokens), and new data that's sent back to the user
information service. The user information service also now has the
ability to add arbitrary additional factors to the current authentication,
something that is intended to provide a hook for a local help desk to
bypass multifactor for a user for some time if required.
This release also contains substantial contributions by Benjamin
Coddington at UVM to improve multifactor interactions, including sending
the OTP type back to the user information service if WebLogin knows it, a
mechanism for the user information service to communicate a message to the
user that's displayed on the multifactor login page, opaque state that can
be sent back and forth between WebLogin and the user information service,
and the ability for the user information service to add specific
authentication factors to the required set for a particular
authentication.
Other improvements in multifactor handling include the ability to set a
lifetime on factors obtained via OTP login, a fix for a long-standing bug
where an initial multifactor factor would satisfy a session requirement
for random multifactor, and logging of even ignored errors when contacting
the user information service.
There are other changes too. This release touches almost every part of
WebAuth. The change to WebAuthForceLogin in 4.4.0 was reverted since, on
further consideration, the original semantics seemed more useful.
Password change handling in WebLogin was fixed (it's been broken for some
time). Apache 2.4 error logging for all modules is much improved, and
mod_webauth and mod_webkdc now produce better error logs for all versions
of Apache. And WebLogin now communicates password expiration times to its
templates in seconds since epoch in addition to a pre-formatted English
time for better localization support.
William Orr contributed a new WebAuthLdapOperationalAttribute directive
for mod_webauthldap that allows it to query operational attributes and
include them in the environemnt.
There are two backward-incompatible changes for WebLogin. First, WebAuth
now supports a user checkbox indicating either to remember their login on
that device or to not remember their login (local site templates can
present it either way). However, proper implementation of this matching
the normal expected wording of "remember me on this device" required
changing the default, so a straight upgrade from an earlier version will
result in no single sign-on. To preserve behavior, either a template
change to add the checkbox (checked by default) or a configuration change
are required.
Second, support for getting password expiration times directly with remctl
to a kadmin-remctl backend has been removed in favor of using data from
the user information service by way of the WebKDC.
Finally, I got to do a lot of cleanup of the API, fix diagosis of undef
passed to Perl XS functions, and fixed a compilation error with Heimdal.
You can get the latest release from the official WebAuth distribution site
or from my WebAuth distribution pages.
All posts