Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision | |||
|
dev:packaging:guidelines [2017/09/26 23:04] coadde removed |
— (current) | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== The Hyperbola Packaging Guidelines ====== | ||
| - | The Hyperbola Packaging Guidelines is the commitment that we, the Hyperbola Project, make to the Free Software Community in general and our users in particular. It is because of this that our packaging guidelines will always follow the philosophy of freedom, privacy, stability and security. | ||
| - | |||
| - | - **Freedom**: | ||
| - | * a) Proprietary software | ||
| - | * b) [[https:// | ||
| - | * c) Binary only firmware or binary blobs. | ||
| - | - **Privacy**: | ||
| - | * a) Software built and patched to be secure from global data surveillance revealed in the [[https:// | ||
| - | * b) Additional hardened packages which remove lower level protocols that may cause privacy leaks, metadata/ | ||
| - | - **Snapshot versions**: Since Hyperbola is a long-term support (LTS) distribution; | ||
| - | * a) If a package version in the snapshot is 1.1.0, and there is a bugfix in 1.1.1, it could be upgraded because it is a revision, not a strong upgrade or a drastic version change. | ||
| - | * b) If a package version in the snapshot is 1.1.0.a, and there is a bugfix in 1.1.0.b, it could be upgraded because it is a revision, not a strong upgrade or a drastic version change. | ||
| - | * c) If a package version in the snapshot is 1.1.0-beta, and there is a final version in 1.1.0, it could be upgraded. | ||
| - | * d) If a package version in the snapshot is 1.1.0-beta without plans for a final version, and there is a 2.0.0-rc, it could be upgraded as exception. | ||
| - | - **Free software projects**: If there is software that contains a stable version, then the upstream version should be blacklisted in Hyperbola. There are examples such as: | ||
| - | * a) The long-term support (LTS) of Linux-libre kernel instead of the upstream one. | ||
| - | * b) The extended support release (ESR) of libre version of Iceweasel instead of the upstream one. | ||
| - | * c) The stable version of Nginx instead of the mainline one. | ||
| - | * d) The still version of LibreOffice instead of the fresh one. | ||
| - | * e) The stable version of GnuPG instead of the modern one. | ||
| - | - **Debian patches**: All packages in Hyperbola contain Debian security/ | ||
| - | * a) Debian does not maintain the required package (eg. OpenRC). In this case, we should use the Devuan or Gentoo patches. | ||
| - | * b) There are no patches available for the required package. | ||
| - | - **HTTPS and tarballs**: All packages in Hyperbola need to be built from the source not from a version control system (VCS). Therefore, all packages should be fixed using the required tarball from its HTTPS site. Exceptions are considered if: | ||
| - | * a) There is not an HTTPS site. In this case, HTTP is the alternative option. | ||
| - | * b) There is not an HTTP site. In this case, FTP is the alternative option. | ||
| - | * c) There is no an official tarball. In this case, tarballs from the official Debian repositories is the alternative option. | ||
| - | * d) There is an official tarball, however it requires download git submodules to be built from the source. In this case, tarballs from the official Debian repositories is the alternative option. | ||
| - | * e) There are no available tarballs. In this case, it should be used in a specific tag or branch from a version control system (VCS) until a final version is available. | ||
| - | * f) There is not support for GNU/Linux in tarballs, tags or branches. In this case, a master branch from a version control system (VCS) could be used temporarily until a final version with GNU/Linux support is available. | ||
| - | |||
| - | <note important> | ||
| - | |||
| - | - **SHA512 or WHIRLPOOL**: | ||
| - | * a) The package is using a version control system (VCS) because it does not contain GNU/Linux support or/and tarballs. | ||
| - | - **GPG**: All packages in Hyperbola should use signature verification. Exceptions are considered if: | ||
| - | * a) Tarballs do not contain signatures. | ||
| - | - **Package release**: All packages contains a release number specific in the pkgrel for package maintainers to make updates to the package’s configure flags inside PKGBUILD. This is typically set to 1 for each new stable upstream software release and incremented for intermediate PKGBUILD updates, however if a package comes from Arch or AUR with modifications made for Hyperbola, then it should set to " | ||
| - | * a) Hyperbola packages were not modified from official Arch or AUR packages. | ||
| - | * b) Hyperbola packages built from a libre replacement project (eg. Linux-libre kernel) or another libre project not included in Arch or AUR. | ||
| - | - **Anti-obfuscation**: | ||