Env and Stacks/Playground repository (draft)

This page is a draft only
It is still under construction and content may change. Do not rely on the information on this page. This document will eventually contain a roadmap for implementing the Playground repository. It will outline what the playground repository is and what groups, manpower, and other resources will be needed in order to implement it.

The Playground repository gives contributors a place to host packages that are not up to the standards of the main Fedora repository but may still be useful to other users. For now the Playground repository contains both packages that are destined for eventual inclusion into the main Fedora repositories and packages that are never going to make it there. Users of the repository should be willing to endure a certain amount of instability when using packages from here.

All packages in Playground must play nice - no bad licenses, no proprietary software, no patented software.

Description

Policies

• Packages must follow the Legal Guidelines. In particular, the license for all packages must be approved in the Legal Guidelines.
• Packages may violate other Fedora Packaging Guidelines.

How the repository works

Packages for the repository are built in COPR. The COPR owner can propose the repository as a whole for inclusion into the Playground repository by marking it as such in COPR. Repositories/packages successfully built and satisfying the Playground repository's Policies are copied into the Playgroud repository.

• How do the updates work?
  • The Playground repository follows the rolling release model. One yum/dnf repository is provided for each Fedora release-arch combination. The repository's repodata is continuously regenerated. All the builds in the COPR repositories that are selected to feed the Playground repository are composed once a day and pushed to the Playground repository and its mirrors.
  • This is similar to the Rawhide repository.
  • Initially, the Bodhi update system will not be used.
  • These decisions were made on the March 4, 2014 meeting.

• Does it have an additional testing repository?
  • Initially, there won't be an additional testing repository. If packagers want to provide some testing packages, they can create an additional COPR that will contain these testing packages.
  • This decision was made on the March 4, 2014 meeting.

• Self hosting: All packages in the playground repo are buildable using only packages in the Fedora Main Repo and the Playground repo.
  • This decision was made on the March 11, 2014 meeting

Identified needs

Need	How necessary	Groups to Coordinate with
Disk space for the yum repositories (Open question -- is this mirrored?)	Necessary	Infra
Ability to mark an individual COPR for inclusion in the Playground repository	Necessary	Copr devs
Continuously regenerating repodata	Necessary	Infra
Daily composes of the Playground repository	Necessary	Infra
Copr deployment that's considered reliable enough to build packages for this repo	Very nice to have	Infra/Copr devs
Build from a git repository URL and revision hash	Optional but nice to have	Copr devs
deltarpms	Optional but nice to have	Releng
Mirroring/mirrormanager	Not in F21	Infrastructure/releng

Open Questions

We'll need to answer these questions and by their answers, flesh out the Description and add additional work items to the Identified needs section.

• signing?
  • it takes 4 months to implement in Copr
  • Important but also time consuming
  • Need coordination with releng (will they actually compose the playground repos?), infra (run sigul), and copr devs.
  • mmaslano to talk more with msuchy about this

• will fedup support upgrades with packages there?

• Does it need to be mashed in order to get multilib support?

• Will there be any review of COPRs/packages that will become part of the Playground repository?
  • We are aiming at an automatic review that will check if the COPR/packages satisfy the Playgroud repository's Policies.
  • The automatic reviewing service will first attempt to do a fully automatic package review, falling back to human intervention only on known trouble cases such as Obsoletes.

• Does the review differ depending on who is building the package (cla+1 vs in the packager group)?

• Do we trust the person whose repo/package was accepted into the Playground repository to keep it up-to-date and address serious bugs/security issues?
  • Just telling users that they should keep up with the security issues themselves is not a solution since that's well understood to be near impossible.
  • The problem with reactive removal of such packages from the repository is that this doesn't remove packages from users' systems.
    • Although the problem of package removal also exists in Fedora's main repos, it is mitigated somewhat since there we have a larger maintainer pool for addressing orphans, short lifecycle means that abandoned packages disappear in about a year, and packagers packaging things for the main repo have a higher bar to entry and are generally more serious and knowledgeable.
    • One possible solution is to set up an empty package that obsoletes such a problematic package.
    • Another solution is to have the fedora-playground-release package which has obsoletes like: Obsoletes: badapp-$version.
    • If a person misuses the community's trust by intentionally packaging malware or not fixing serious security issues found in his packages, then we could blacklist his FAS account which would prevent inclusion of his packages in the Playground repository.

• Do we allow conflicts with packages in the main repo?

• Do we allow replacement of packages in the main repo?
  • Do we allow "backdoor replacement" of packages in the main repo? ie: Let's say I have a package in the playground repo: NetworkManager2.1. And that conflicts with NetworkManager. Is that allowed? Is it allowed as long as it doesn't have any virtual provides/obsoletes that would automatically allow it to replace the package in the main repo?

• Do we allow conflicts between packages in the Playground Repo?

• Do we allow replacement of other packages in the Playground Repository? (How do we stop this in our implementation?)
  • Do we allow "backdoor replacement" in the playground repo?

• How do we deal with multiple versions of same package provided by different COPRs?

• Do we expect people to package stable/usable software in the Playground repository?
  • If we would want to enforce the content of the repository to be something stable, then we would be back to approving things individually.
  • Probably some packages will be more unstable than others and that's fine.
  • We could at least put up some guidance that would promote the idea that the Playground repository should contain stable/usable software (similar to the first goal of the Rawhide repository) and that bleeding edge/"eats your babies" software should be rather put into a COPR (with a warning description next to it).

Problems

1 Big repo vs multiple small ones

Ideally users would enable just one "playgrond" repo and would get all nice updates. However this has several issues:

• We'd need support in rel-eng for multiple versions of identical package (problems with composes)
• Users would get *all* playground packages not just ones they are interested in
• There is no way to specify which packages from playground to install (or they are inadequate)

Most likely better approach is repo-of-repos where:

• Each project has a COPR repo (already done since that's how they are built)
• Playground repo contains these repo files
• We can add GUI support for enabling on per-feature basis (i.e. install playground repo for "Dajngo 1.6" or "Chromium" or ...)
• Possible conflicts are between features. It's not ideal but that way there *can* be conflicts and they are not catastrophic. People who want to test django do not necessarily want to test Chromium (or other way around)