Strawman: eliminating debdiffs

[Kees Cook]

Hi,

On Wed, Oct 01, 2008 at 06:13:08PM +0200, Michael Bienia wrote:
> The question is why are so few patches forwarded upstream? Is it because
> the people forget it or because they find it to complex (jump through
> too many hoops)? Or simply don't care?

I've found myself hampered by a few things:
 1) additional work due to upstream policies:
    - only want patches against HEAD
    - require specific formatting
    - require test cases
    - require documentation
    (none of these are _bad_, they're all important, but it certainly makes
     upstreaming more of a challenge to a new contributor)
 2) hard to find the place to file a patch.  Many upstream have multiple
    locations where a patch might go, and it takes time and study to
    figure out where the preferred (or, perhaps, effective) location is.
 3) (a variation on the above) silent/slow upstream -- a patch is either
    ignored, or never committed.  This tends to be the state of most of
    my Gnome and Freedesktop (Xorg) patches.  (Debian tends to swing
    wildly from either end of the extreme: instant feedback or ignored.)

I find #2 to be the biggest problem -- even projects that use the same
issue tracker as another project (see SourceForge, LP, Debian) aren't
going to respond to patches the same way -- some want them all in a
mailing list AND the patch tracker, some want them only in the tracker, etc.
Some upstream are very aggressive about a new contributor making mistakes.
Some upstream document totally the wrong location to send patches
(see OpenSSL).

> If people find it too complex, we should see how we can make it easier
> instead of forcing them to get it forwarded first. This won't make more
> patches get forwarded but just less bugs fixed in Ubuntu. So it's a
> lose-lose situation instead of a win-win one.

There is presently no standard way I've seen to document _how_ to send
patches to upstreams, along with what their requirements are.  LP does
a nice job so far of hooking to bug trackers, but patch submission is
a totally different beast.

-Kees

-- 
Kees Cook
Ubuntu Security Team