Debian QA Mechanisms

Shachar Shemesh

Lingnu Open Source Consulting

A Few Facts About
Debian

“Employs” almost 900 registered developers.

Over 16,000 binary packages.

Over 8,000 QA assured binary packages released.

Over 15,000 in upcoming release.

Official release installable on 11 hardware platforms, over half the platforms the Linux kernel supports).

Experimental releases include support for two non-Linux kernels.

Relational Look at the Numbers

How Well Does it Work?

Debian – third most popular server Linux distro (after RedHat and Cobalt), and fastest growing one (NetCraft, Jan 2004).

Debian – most popular desktop distro 2003 (34%). 2004 – lost lead to Mandrake, SUSE and RedHat (Debian at 14.8%), but if we aggregate Debian derived, we are back at first with 24.1 (desktoplinux.org).

The Question Remains

How do they do it?

Part I – Dpkg, Debs and Apt

Flavors

Creating packages

Package relationships

Automatic installs

Concurrent Availability

At each point in time, Debian is available in three “flavors”.

Stable – the official “released” version. No changes (frozen), only security fixes and crucial changes.

Unstable – Anyone (permitted) can introduce changes and new packages.

Testing – Taken from unstable, stabilized, and when ready, turns into “stable”.

Each version has a name:

Current stable is “Woody”. Current testing is “Sarge”, unstable is always “Sid”. Next testing will be “Etch”.

The Deb Packages

One form or another of binary packaging is part of (almost) any modern Linux distribution. Of all the packages out there, Deb is one of them.

Enables a sophisticated set of states and dependencies.

Contains all the basics:

Files in package.

Dependencies.

Contains much much more....

Additional Packages Relationship

Depends – A depends on B means that A needs B to be installed for A to function properly.

Recommends – A is strongly tied to B. Installing rsyncrypto without rsync does not hurt rsyncrypto's functionality, but it really makes no sense.

Suggests – Extra functionality. Wine will work perfectly without freetype, but font rendering will suck.

Additional Package Relationships (cont.)

Enhances – Same as suggests, but opposite direction.

Pre-depends – Package A pre-depends on B if A cannot be configured to work without B already installed and configured.

Conflicts – A states that B must be removed before A can be installed.

Replaces – A states that it replaces some or all of the files provided by B.

Package Files

Files – These are the files that consist of the actual package. Debian has a strict policy regarding where files should go (FHS).

Configuration files – Typically, all config files go in /etc/package, and all files under /etc are configuration files.

Dpkg tracks changes to these files, so that they are not accidentally overwritten on upgrade.

Script files – Contain the logic for install, upgrade and removal of packages.

apt-get

One command install of any package from the Debian repository.

Easy to configure for external repositories.

Easy to set up a new repository (apt-ftparchive).

Understands the dependencies, and can suggest intelligent recommendations.

Aptitude – Visual front-end.

Offers a state called “Only keep install if someone needs this package”, to avoid clutter.

Some apt-get Commands

install – installs a package (and deps).

source – download and install the source of a package.

build-dep – install all packages required to build package.

Regenerating a given deb is always just three commands away:

apt-get build-dep package

apt-get source package

dpkg-buildpackage

Quick and Dirty Deb Creation

Create a Package for NetChat

Part II – The Automatic QA Helpers

Debian Rulez!!!

fakeroot

dh_*

linda/lintian

pbuilder

ISO 9000 101

QC – Quality Control: Performing tests to make sure that the product is of sufficient quality.

QA – Quality Assurance: Modifying the generation process so that failures do not happen.

ISO 9000 #1 principle – Instead of manufacturing 100 products, and then discarding 5 in QC, modify your process to produce 95 flawless products.

Before anything else – make the process repeatable.

Once repeatable – make it correct.

Automate the Process:
debian/rules

Makefile executable

The various rules correspond to various stages of the install (clean, build and package).

Provides an automated, hands free mechanism for performing the build and packaging.

ISO 9000 – automatic processes are more repeatable than manual ones.

Utilizing all of apt's advantages requires that you create a debian/rules file for building it.

fakeroot

Some of the debian/rules stages are defined to require root permission.

Usually, there is no reason to actually require root permission.

fakeroot – a wrapper that makes any executable think it's running as root.

Debian Helpers
The dh_* Utilities

Some of the tasks carried out by debian/rules are common to almost all packages

These got a standard set of utilities for carrying them out.

Range from transferring certain files to the right place, to modifying the installation scripts.

Example – dh_mkshlibs generates a postinst and postrm that runs “ldconfig”.

dh_shlibdeps – Calculate the binaries' dependencies.

Partial List of Debian Helpers

dh_builddeb

dh_clean

dh_fixperms

dh_gencontrol

dh_installemacsen

dh_installinit

dh_installman

dh_makeshlibs

dh_md5sums

dh_strip

dh_movefiles

dh_link

dh_installpam

dh_installinfo

The Importance of the Changelog File

If using dh_* tools, debian/changelog will hold the package's changelog ( as opposed to upstream's changelog).

This is the file dh_gencontrol uses to decide which is the current version.

Reduces the possibility of human error.

debian/changelog entries are created using “dch”, so that the syntax is maintained.

One Helper to Rule Them All
dh_make

Adds the “debian” directory to an existing project.

Puts in an initial offer for “rules”, “control”, “changelog” etc files.

In case of an autoconf based project that supports DESTDIR, does almost everything required for a basic package.

Automatic Fault Finders
Lintian and Linda

“Lint” for .deb files.

Excellent tools for detecting human errors and omissions.

pbuilder

Automatic chroot/bootstrap creation tool.

Will install a minimal system + dependencies defined by build-depends.

Will then try to build the package.

An excellent tool for predicting build failures on other machines.

Somewhat Cleaner

Create a package for NetChat

Part III – The Debian Distribution System

The path to getting a package into Debian

The path to becoming a Debian Developer

Leader's front desk secretary's master technical comity?

Getting a Package Included
in Debian

Main – free software.

Non-free – free beer software (at least for Debian) which is not free speech.

Contrib – Free software that requires non-free software for building or running.

Officially, Debian is only the “main” part.

Looking For a Sponsor

Non Debian Developers can become sponsors. Passing all automatic tests is a prerequisite for looking for one.

The Debian mentors mailing list is a good place to find someone who is interested in your package.

The sponsor will typically run his/her own set of tests, some automatic and some manual, and offer additional improvements.

When the sponsor is happy with the result, he will upload the package to the Debian servers.

FTP Masters

Each package being uploaded for the first time must be approved by the FTP Masters.

They form a second set of eyes examining the package for problems.

Their additional experience allows them to catch problems that the sponsor might have missed.

Once uploaded, the package can be “apt-get” installed for any platform supported by Debian, curtsy of the automatic build procedure.

Debian Bug Tracking System

Bugs against the package are filed via the Debian bug tracking system (BTS).

Requests for package status change are filed as bugs against a package called “wnpp”.

ITP – Intend to package.

ITA – Intend to adopt.

RFA – Request for adoption.

Bugs are closed by putting a “closes” line in the changelog.

Ensures that the changelog is up to date.

Non Typical Uploads

Occasionally, a package may be uploaded by someone other than the maintainer:

Security problem – upload by the security team direct to “stable”.

Orphaned package – may get uploads by the QA team.

Any other Debian Developer may choose to fix an orphaned package as well.

Non Maintainer Uploads

If time is an issue, or if the maintainer is not responding, a DD may do a NMU.

Uscan

An automatic tool to compare the version in the Debian archive with the upstream source.

Is used by maintainers to make sure they don't miss an upstream release.

Also used by the ftpmasters to find out whether a maintainer has gone missing.

Becoming a Debian Developer

Show understanding of the Debian process, and the Debian social contract (only free software etc.).

Why do you think I'm giving this presentation.... :-)

Find an advocate. As the advocate must know you, this will typically be your sponsor.

Submit a New Maintainer request.

Cleanest

Create a package for NetChat

Thoughts and Conclusions

Past, Present and Future

Conclusions

ISO 9000 Works
(If You Don't Take it Too Seriously)

The Debian system uses a set of procedures, backed up by technology, to assure quality.

This produced a Linux distribution with unparalleled breadth of coverage, while maintaining a high quality.

Community vs. Commercial

Debian, Gentoo, FreeBSD and OpenBSD are community projects. The rest are commercially managed.

All community OSes cover more HW platforms, and contain more packages, then their commercial counterpart.

Maintainers/package ratio for commercial projects can usually not be beat.

When you manage the packages you use, you know what you manage.

Slipping Time frames

1.1→1.2: 6 months, 474 packages.

1.2→1.3: 7 months, 974 packages.

1.3→2.0: 1 year, 1500 packages.

2.0→2.1: 9 months, 3 platforms, 2250 packages.

2.1→2.2: 1.5 year, 5 platforms, 2600 packages.

2.2→3.0: 2 years, 9 platforms, 8500 packages.

3.0→3.1: still waiting (3 years), 11 platforms, 15,000 packages. Release finally in sight.

Slipping Time frames (cont)

It's clear that the Debian project reached it's limit in it's current method of operation.

Some talk about reducing the number of platforms supported to three (i386, AMD64 and PPC).

The stagnation induced Debian derivatives to yank mind share resources from Debian (Ubuntu, Yopper).

2005-05-14T12:36:11