ubuntu community update policy (in particulat drupal7)

[Scott Kitterman]

On Tuesday, August 05, 2014 17:50:06 Robie Basak wrote:
> On Tue, Aug 05, 2014 at 12:44:13PM -0400, Scott Kitterman wrote:
> > > This is a fundamental difference between main and universe. There may be
> > > a case for an exception in the case of particular packages (bitcoin is a
> > > recent example), but in the general case I don't think it makes sense to
> > > not offer the packages. Users have a choice as to what they do right
> > > now, and also have the choice of contributing fixes. Removing packages
> > > takes that choice away.
> > 
> > No.  The difference is that for Universe there is generally not someone
> > with an @canonical.com address paying attention to them.  There are
> > plenty of Universe packages that are well maintained and updated.  Some
> > by Canonical people and some by others.  While there is some correlation
> > between Main/Universe and package maintenance, it's not as close as you
> > might think.
> 
> Right - what I mean is that there exists an assurance that all packages
> in main are looked after by Canonical staff for security updates. This
> assurance doesn't exist in universe. I didn't mean to suggest that
> some universe packages aren't looked after - just that there isn't such
> a sweeping global assurance of it.
> 
> > > Instead, users can always opt to not install universe packages (eg.
> > > remove it from sources.list). There's also an argument for not having
> > > universe enabled by default, but I think that a decision was made a long
> > > time ago before I was around on this point. I guess it could always be
> > > revisited, but would probably be one for the technical board to make a
> > > final decision on.
> > 
> > No.  We have one set of sources.list for all of Ubuntu right now.  Many
> > flavors provide packages from Universe, so this would break things and be
> > hard to implement sanely.
> 
> I was thinking of server - presuming that drupal is primarily run on
> server installations. Perhaps this assumption is wrong - but it should
> be fine to disable universe on a server without breaking anything, right?

Yes, but we use one common sources.list across the entire project now.

Server admins using Ubuntu should be clue-full enough to understand the the 
maintenance policy of the distro they are using.  So while it wouldn't break 
anything, I don't think it would gain much.  It's a rat-hole we've been down 
before that I'd rather not repeat.

Scott K