Edgy Third Party Package Management

[Jerry Haltom]

Now that Dapper is out the door, I'd like to bring up discussion on a
project of mine. I have brought it up before, but attention was not
gathered... most likely do to the impending release of Dapper.

https://launchpad.net/distros/ubuntu/+spec/apt-third-party

This specification seeks to create a standard methodology and associated
file format by which Third Party ISVs which have no relation to Ubuntu
can distribute software targeted to Ubuntu users. It seeks to do so in a
way which is distribution and package system agnostic.

This specification is different from existing specifications of the same
nature in that it begins with a fairly clear use case and attempts to
narrow it's focus in light of some assumptions. If you don't agree with
these assumptions, you probably won't like the specification. Those
assumptions are:

1. Users want to install software from third parties. Third parties want
to provide software to users.

2. Users expect this installed software to integrate into their existing
OS. One centralized way to report upgrade notifications. One way to
apply an upgrade. One package management system to debug, installed
software and manage dependencies. ISVs would prefer this as it is a
benefit to their user base. Such a benefit makes their users happy and
gets them more business.

3. There is no appropriate way to insure that installed software
distributed by entities with no authenticated relationship with Ubuntu
will not harm a user's system. It is not worth the time to consider a
system that would.

4. Existing systems which attempt to bridge all distributions
(AutoPackage) suck for one reason or another.

5. Ubuntu isn't going to package all of this on their own. They don't
want to or need to, and in some cases aren't allowed to.

Please read and comment. I would like to have this topic brought up in
one or more official channels or meetings. If any core-dev's are
interested in discussing this, please let me know what needs to be done.
I believe it's success requires more than just one person delivering an
implementation. After all, it won't be successful if ISVs don't know and
can't rely on it's presence. The only way this can happen is if it
becomes supported by Ubuntu.

Thanks!