Repository navigation
Conversation
Preserve upstream package names, maintainer metadata, and build dependencies while adopting the Debian packaging improvements. Introduce wforce-common for shared files and account setup, and use ucf to manage daemon configurations across upgrades. Adopt debhelper 13, enable hardening and strict missing-file checks, and install the omitted utility, manpage, and configuration example. Keep Debian-specific release metadata and source patches out of scope.
|
Wow, thanks for this. It will take some time to test and review, so please bear with me. |
|
Hi, first of all thank you for your contribution... Could you please rebase on master branch and resubmit PR ? debian bulleye building was dismissed and an issue with replfwd.conf was solved in the meanwhile. So far I was able to build packages for both bookworm and trixie and run some regression tests just fine. There is only one 'issue' with purging (see later) Tested five scenarios, each in its own fresh container, comparing the new packages against 3.2.0 built from the tag fresh: new install, reinstall twice, remove (keep configs), install again, purge To catch anything left behind, each scenario takes a filesystem snapshot before installing and compares it with one taken after purging. As an extra check, each scenario also starts wforce, trackalert and replfwd the way systemd would: as user wforce, with -s, and they must stay up for a while. ***Works fine
***Possible issue
|
As discussed in #462
Scope
This ports the Debian packaging improvements while preserving upstream’s
package names (
wforce,wforce-trackalert, andwforce-replfwd), sourcepackage identity, maintainer, and existing build infrastructure.
The changes include:
wforce-commonpackage for shared files and system account setup.ucf.libatomiclinking on riscv64 and loong64.wf_dump_entriesutility, itsmanpage, and the configuration example.
Upstream-specific documentation and the historical
/etc/wforce.confmigration are retained.
Two safety adjustments were made when porting the Debian scripts:
temporary configuration files containing credentials are created with
restrictive permissions, and purging the common package only removes
empty shared directories.
As I don't have your build infra, this needs to be heavily tested, and maybe
some bits won't interest you.
Upgrade considerations
Shared-file ownership
/etc/wforce/regexes.yamlmoves fromwforcetowforce-common, whichalso creates the shared system account.
The new packages should be tested as an upgrade from existing upstream
packages, using a strictly higher package version: the transition’s
BreaksandReplacesrelationships use<< ${binary:Version}.Configuration management
Existing daemon configurations transition from dpkg-managed conffiles
to
ucf. The initial upgrade should be checked for preservation ofadministrator changes, credentials, and permissions.
Replication configuration and credentials
The
replfwdmaintainer script registers the unmodified configurationtemplate with
ucf, then replaces any remaining credential placeholdersin the installed configuration. Generated credentials are therefore
treated as local changes.
An upgrade with an unchanged template preserves existing credentials.
If a changed template is offered and the administrator chooses to
replace the local configuration, credentials will be generated for any
placeholders in the replacement file.
The more elaborate handling in
wforceandtrackalertpreservescredentials while accommodating their previous configuration-management
behaviour; it is not required for every
ucf-managed configuration.Although the Debian
weakforced-replfwdpackage was introduced with thisapproach, upstream already ships
wforce-replfwd. Its initial transitionto
ucfshould therefore be checked with an existing, locally configuredinstallation. You can mimick what was done for the two other packages, or
I can directly offer a similar version.
If you don't care about the upgrade path but rather just about the result we
can also simplify trackalert and wforce.
Build compatibility
Debhelper compatibility level 13 and strict missing-file detection
should be exercised on the supported Debian and Ubuntu targets.
The latter intentionally fails the build if installed files are left
unpackaged.
Deliberately not ported
Salsa VCS fields,
watch,gbp.conf, and the Debian copyright file.and its version-specific Boost dependency. Upstream’s
wforce-lua-distand builder-provided libraries remain in use.regexes.yamlsnapshot and the source patchreplacing its build-time download with a local copy.
stdint.hincludes and removing Boostrpath flags.
replfwd.conftemplate patch, whose equivalent is alreadypresent upstream.
Validation status
Shell syntax and the packaging helper steps through binary package
generation were checked using a synthetic installation tree.
This does not constitute a full source build or a successful
upgrade test. As said upwards, some heavy testing is needed. If you
need help please reach out.
The most useful remaining checks are:
configurations, checking that configurations and credentials are
preserved.
A standard Debian
sbuildenvironment will need the upstream-specificdependencies supplied separately.