Why is my package being deleted from the AUR?

ryooichi · 2009-01-17 17:40:18

Hello. I am the maintainer of the metasploit-svn (http://aur.archlinux.org/packages.php?ID=23031) package in the AUR. As you may know, metasploit currently advises against using the newer ruby 1.8.7 and recommends using ruby 1.8.6. So I've been trying to submit another package dubbed ruby-1.8.6. I have submitted it several times and it keeps being deleted.

Perhaps someone can tell me why is it being deleted? or suggest some improvement I can make to make it acceptable?

Some options I have thought of are:
- have ruby-1.8.6 install in a way that does not interfere with the regular ruby package (is there a preferred way to do this? install to /opt? (it's already installing to /usr/local/bin which isn't even in the default $PATH) rename the binaries to something like ruby-1.8.6?
- merge ruby-1.8.6 into my metasploit-svn package (this would be a kludge and wouldn't really be taking advantage of the dependencies, etc.)

ruby-1.8.6/PKGBUILD:

# Contributor: ryooichi <ryooichi+aur AT gmail DOT com>
pkgname=ruby-1.8.6
pkgver=300
pkgrel=1
pkgdesc="Ruby is a dynamic, open source programming language with a focus on simplicity and productivity."
arch=('i686' 'x86_64')
url="http://www.ruby-lang.org"
license=('GPL2')
#groups=()
depends=()
makedepends=('subversion')
#optdepends=()
provides=('ruby')
#conflicts=('')
#replaces=()
#backup=()
#install=
source=()
md5sums=()
#noextract=()
_svntrunk=http://svn.ruby-lang.org/repos/ruby/tags/v1_8_6_300

build() {
  if [ -d $srcdir/.svn ]; then
    msg 'Updating...'
    svn up $srcdir
  else
    msg 'Checking out...'
    svn co $_svntrunk $srcdir
  fi
  cd $srcdir
  autoconf
  ./configure
  make
  #make test
  make DESTDIR=$pkgdir install
}
# vim:syntax=sh

Thank you.

kludge · 2009-01-17 18:05:31

have you asked over at aur-general@archlinux.org? bet you'll get a quicker answer there...

ryooichi · 2009-01-17 18:23:34

Good idea. Done. Thanks.

foutrelis · 2009-01-17 20:01:45

First of all, your ruby-1.8.6 package should conflict with ruby (provides and conflicts usually go hand in hand). In regard to your question about why your package is being removed, I'd say it's because ruby exists in the main repos.

I'm not sure what the best thing to do in this situation is. My preferred solution would be to have metasploit-svn work correctly with ruby 1.8.7 (since it's mainly a maintenance release, I can't justify the need for 1.8.6 specifically, especially in the svn snapshots). My second best way to resolve this would be to have metasploit-svn depend on ruby 1.8.6 [depends=('ruby=1.8.6' ...)]; yes, this could require rebuilding ruby 1.8.6 using ABS, but it's a relatively clean solution.

Last edited by foutrelis (2009-01-17 20:02:20)

bender02 · 2009-01-17 21:44:34

How about having a 'ruby-metasploit' package in AUR, with the description clearly stating its purpose?

LTSmash · 2009-01-17 22:28:37

bender02 wrote:

How about having a 'ruby-metasploit' package in AUR, with the description clearly stating its purpose?

Clearly a waste of time, defeating the ABS...

GUYS, if you need an updated package you don't make an updated one for AUR, you use ABS to compile and install it manually... why don't you never learn that AUR ISN'T FOR PACKAGES THAT ARE ALREADY IN THE MAIN REPOS... if you want a newer version, compile it yourself, but do not submit to AUR.

bender02 · 2009-01-17 22:40:35

LTSmash wrote:

GUYS, if you need an updated package you don't make an updated one for AUR, you use ABS to compile and install it manually... why don't you never learn that AUR ISN'T FOR PACKAGES THAT ARE ALREADY IN THE MAIN REPOS... if you want a newer version, compile it yourself, but do not submit to AUR.

The thing is that he needs an *older* version than the one that's in the repos.

And there are still zillions of -beta -alpha -omgsomeslightlynewerbuild versions of main repo packages still in the AUR and noone goes ahead and deletes them...

LTSmash · 2009-01-18 00:21:32

bender02 wrote:

LTSmash wrote:
GUYS, if you need an updated package you don't make an updated one for AUR, you use ABS to compile and install it manually... why don't you never learn that AUR ISN'T FOR PACKAGES THAT ARE ALREADY IN THE MAIN REPOS... if you want a newer version, compile it yourself, but do not submit to AUR.
The thing is that he needs an *older* version than the one that's in the repos.
And there are still zillions of -beta -alpha -omgsomeslightlynewerbuild versions of main repo packages still in the AUR and noone goes ahead and deletes them...

He can still use ABS for that purpose, just uninstall ruby package and compile older from ABS... anyways, what I'd do is to:

a) manually patch metasploit code so it doesn't asks for ruby=1.8.6
, but instead to ask for ruby>=1.8.6

b) ask metasploit devs to fix this

c) compile ruby 1.8.6 from ABS

d) kill myself (just kidding xD)

About the zillions of -beta -alpha -omgsomeslightlynewerbuild versions of main repo packages still in the AUR; this is no justification for them to exist... I mean, let everyone use Windows, since most people do.

bender02 · 2009-01-18 09:01:28

LTSmash wrote:

He can still use ABS for that purpose, just uninstall ruby package and compile older from ABS...

I know, he probably knows; and if I'd want that package myself, I'd probably use ABS as well. It's just that he wants to submit it to AUR, and it doesn't make sense to me to have a PKGBUILD in AUR that requires either a downgrade of an official package, or some nontrivial editing of the official ruby PKGBUILD so as to install 1.8.6 alongside 1.8.7.

LTSmash wrote:

bender02 wrote:
And there are still zillions of -beta -alpha -omgsomeslightlynewerbuild versions of main repo packages still in the AUR and noone goes ahead and deletes them...
About the zillions of -beta -alpha -omgsomeslightlynewerbuild versions of main repo packages still in the AUR; this is no justification for them to exist... I mean, let everyone use Windows, since most people do.

Yea, this was actually more like a cry for the TUs to delete them... although I admit it didn't sound like that.

Stefan Husmann · 2009-01-18 11:51:10

Well, I was the one who deleted the ruby package over and over again. Guys and gals, if you want to upload a package to AUR that is already in one of the repos, at least leave a comment on the AUR comment page. This could be

If you need an old version of ruby as a dependency, create a package ruby-legacy or the like, and add a version number like 'ruby<=1.8.6' to the depends-line.

Stefan Husmann · 2009-01-18 12:07:14

The ruby build process gives you the possibility to set --program-suffix in the configure step. Something like this may work (untested):

# Contributors: John Proctor <jproctor@prium.net>
#               Jeramy Rutley <jrutley@gmail.com>
#               dorphell <dorphell@archlinux.org>
pkgname=ruby-legacy
pkgver=1.8.6
pkgrel=1
pkgdesc="An object-oriented language for quick and easy programming"
arch=('i686' 'x86_64')
license=('custom')
url="http://www.ruby-lang.org/en/"
depends=('gdbm' 'db>=4.7' 'openssl>=0.9.8h-3' 'zlib' 'readline' 'termcap-compat')
makedepends=('tk>=8.5')
source=(ftp://ftp.ruby-lang.org/pub/ruby/stable/ruby-$pkgver.tar.bz2)
md5sums=('e558a0e00ae318d43bf6ff9af452bad2')
options=('!emptydirs' 'force')

build() {
  cd $srcdir/ruby-$pkgver
  ./configure --prefix=/usr --enable-shared --enable-pthread \
    --program-suffix=$pkgver || return 1
  make || return 1
  make DESTDIR=$pkgdir install
  #generate the ri docs
  make -j1 DESTDIR=$pkgdir install-doc
  install -Dm644 COPYING $pkgdir/usr/share/licenses/${pkgname}/COPYING
  mv $pkgdir/usr/lib/ruby $pkgdir/usr/lib/ruby-legacy || return 1
}

Last edited by Stefan Husmann (2009-01-18 14:47:11)

ryooichi · 2009-01-18 17:37:48

Stefan Husmann wrote:

if you want to upload a package to AUR that is already in one of the repos, at least leave a comment on the AUR comment page.

There was a comment, but it disappeared when you deleted the package.

Stefan Husmann wrote:

If you need an old version of ruby as a dependency, create a package ruby-legacy or the like, and add a version number like 'ruby<=1.8.6' to the depends-line.

Since starting this thread, ruby-1.8.6 has been renamed to ruby-1.8.6-svn to reflect the change to a better location in the ruby svn repository; this one receives the patches automatically. In order to avoid vagueness, I chose a name containing "1.8.6" to be very specific in what you would be getting if you install this package.

Thinking out loud: I must be confused as to the point of the AUR, the trusted user hierarchy, and software repositories in general... exactly how does this package (regardless of what it's called) infringe on Arch or the purpose of the AUR? At this moment, nothing in Arch or AUR depends on ruby-1.8.6-svn (aside from my metasploit-svn package). If somebody, wants this then they install it. If not, they don't. That seems like common sense to me. Ruby 1.8.6 is merely a previous branch... not unlike python 2.6 in comparison to 3.0; and it should be noted that 2.6 is the current version in arch.

You do have a good point and I agree that I could/should find a way to have metasploit-svn depend on "ruby<=1.8.6" and have ruby-1.8.6-svn provide that. Is there anything else that I need to do so that you won't keep deleting it?

ryooichi · 2009-01-18 17:54:43

LTSmash wrote:

if you need an updated package you don't make an updated one for AUR, you use ABS to compile and install it manually

Isn't the AUR simply for sharing PKGBUILD's? I thought that the fact that you could use ABS or makepkg or whatever to do whatever with the PKGBUILD was part of the freedom allowed. Updated, outdated, or just different in some potentially useful way... who cares! I'm not sure why there's all these politics.

Perhaps I incorrectly deduced that the community might possibly benefit from another contributor. I am more than happy to keep my PKGBUILD's to myself because they work for me. Though I will admit that I'm new to Arch and that they probably aren't perfect, but that having them in the AUR does make my life easier. I thought that maybe others would appreciate having a working metasploit-svn in Arch so they could use it for network security, penetration testing, etc. That is my goal.

Stefan Husmann · 2009-01-18 17:56:44

Read this thread. I tried the svn-version you uploaded and it did not even build. Read the aur-package guidelines and try to be compliant to them (regarding empty lines and a conflicts-line). Or try to make a PKGBUILD that can coexist with the ruby from the extra repo. The PKGBUILD I posted above may be a starting point.

ryooichi · 2009-01-18 18:37:43

Stefan Husmann wrote:

Read this thread. I tried the svn-version you uploaded and it did not even build. Read the aur-package guidelines and try to be compliant to them (regarding empty lines and a conflicts-line). Or try to make a PKGBUILD that can coexist with the ruby from the extra repo. The PKGBUILD I posted above may be a starting point.

Roger. I am merging and testing now. Thank you for the help.

Is there a general preference for tarballs versus svn checkouts?

Stefan Husmann · 2009-01-18 18:43:56

Well, at least to svn packages suggest something is bleeding edge, and in the repos we try to deliver stable versions, but other than that there are no rules for that. If there are technical reasons for you to stick to svn versions, go ahead (and do some commenting regarding the reasons ).

LTSmash · 2009-01-18 19:41:27

ryooichi wrote:

LTSmash wrote:
if you need an updated package you don't make an updated one for AUR, you use ABS to compile and install it manually
Isn't the AUR simply for sharing PKGBUILD's? I thought that the fact that you could use ABS or makepkg or whatever to do whatever with the PKGBUILD was part of the freedom allowed. Updated, outdated, or just different in some potentially useful way... who cares! I'm not sure why there's all these politics.

It's not that we take away that freedom, but there must be order in order for the AUR to work correctly. Imagine that you've got 5 or 6 packages that include minimal version changes from the official repos, that would have no use, because THAT'S THE REASON FOR ABS TO EXIST. ABS exists because it's needed to have newer or older versions of software available always, and that isn't AUR purpose... AUR is for sharing, for example, modiefied versions of software, perhaps new features, svn versions too; I dunno, but minor version changes won't cut there..

Perhaps I incorrectly deduced that the community might possibly benefit from another contributor. I am more than happy to keep my PKGBUILD's to myself because they work for me. Though I will admit that I'm new to Arch and that they probably aren't perfect, but that having them in the AUR does make my life easier. I thought that maybe others would appreciate having a working metasploit-svn in Arch so they could use it for network security, penetration testing, etc. That is my goal.

Yeah, we benefit from contributors, I also create pkgbuilds regulary and submit them to AUR, and when I don't want them any longer I simply disown packages I don't want anymore. But I do not submit packages that already exist on the repos... just to change to a minor newer or older version, get it?

ryooichi · 2009-01-18 19:54:16

LTSmash, how would you use ABS to accomplish this?

Btw, I've read the wiki regarding ABS and still truly have no idea why would I use ABS for this. Granted I have little to no experience using ABS... but as far as I can tell, ABS syncs the official PKGBUILD's to my system... then I'd copy some desired PKGBUILD to ~/abs/pkgname/, optionally make any changes, build it with makepkg and install with pacman -U. So I'm assuming you're suggesting that I do this to the regular ruby PKGBUILD? The disadvantages of this method include: I have to manually edit the PKGBUILD for each machine and each time there's an upstream patch. So my deviance addresses these disadvantages: 1) I'm using the svn repo of the branch I want to enable easy incorporation of upstream changes, and 2) I put the PKGBUILD in AUR to make available not only to everyone else, but to myself everywhere. To me, the AUR is a natural extension of the ABS.

Using my method, assuming you've already got yaourt, you do one thing to get a working svn version of metasploit: "yaourt -S metasploit-svn". It'll automatically get ruby 1.8.6 at the highest patch level and each time I update the system via "yaourt -Syu --aur", it'll keep it all up-to-date in a very non-intrusive way (in other words, I don't have to think about it).

Last edited by ryooichi (2009-01-18 20:14:06)

Stefan Husmann · 2009-01-18 21:26:02

I think your would never have been deleted, if you would have documented your thoughts about your package somewhere. Just a sentence like "This is a dependency for metasploit-svn, ruby 1.8.7 is not suited for this task" on the AUR comment page. I never saw such a sentence, sorry. So let us stop talking about politics now, though we surely need some rules to maintain the AUR, they should not suppress useful contributions.

louipc · 2009-06-23 15:10:02

To the TU who was deleting the package:
It's a good idea to leave a comment on the package before deleting it so the users know the reason of the deletion.

Allan · 2009-06-23 15:14:58

To the TU bumping a many month old thread.... don't!

Arch Linux

#1 2009-01-17 17:40:18

Why is my package being deleted from the AUR?

#2 2009-01-17 18:05:31

Re: Why is my package being deleted from the AUR?

#3 2009-01-17 18:23:34

Re: Why is my package being deleted from the AUR?

#4 2009-01-17 20:01:45

Re: Why is my package being deleted from the AUR?

#5 2009-01-17 21:44:34

Re: Why is my package being deleted from the AUR?

#6 2009-01-17 22:28:37

Re: Why is my package being deleted from the AUR?

#7 2009-01-17 22:40:35

Re: Why is my package being deleted from the AUR?

#8 2009-01-18 00:21:32

Re: Why is my package being deleted from the AUR?

#9 2009-01-18 09:01:28

Re: Why is my package being deleted from the AUR?

#10 2009-01-18 11:51:10

Re: Why is my package being deleted from the AUR?

#11 2009-01-18 12:07:14

Re: Why is my package being deleted from the AUR?

#12 2009-01-18 17:37:48

Re: Why is my package being deleted from the AUR?

#13 2009-01-18 17:54:43

Re: Why is my package being deleted from the AUR?

#14 2009-01-18 17:56:44

Re: Why is my package being deleted from the AUR?

#15 2009-01-18 18:37:43

Re: Why is my package being deleted from the AUR?

#16 2009-01-18 18:43:56

Re: Why is my package being deleted from the AUR?

#17 2009-01-18 19:41:27

Re: Why is my package being deleted from the AUR?

#18 2009-01-18 19:54:16

Re: Why is my package being deleted from the AUR?

#19 2009-01-18 21:26:02

Re: Why is my package being deleted from the AUR?

#20 2009-06-23 15:10:02

Re: Why is my package being deleted from the AUR?

#21 2009-06-23 15:14:58

Re: Why is my package being deleted from the AUR?

Board footer