Is gentoo still about choice?

[stefan11111]

Some rather important changes have been forced upon gentoo users in the last week.
Eudev and opentmpfiles are being last-rited and masked for removal.
Both of these make it even harder for people to not use anything subsumed by systemd and they needlessly restrict choice.
Eudev is maintained upstream, it recently got 2 new volunteers downstream and is fit for plenty of use cases.
With opentmpfiles, there is even less reason to remove it. The work is already done. All that needs to be done it to keep it in the tree. It takes more work to remove it now that to keep it in the tree.
To me, this looks like we have been divided and conquered enough that finally conquering all systemd opposition is possible.

So this brings me to the question in the title. Is gentoo still about choice?

[NeddySeagoon]

stefan11111,

You don't understand how Gentoo is organised. Nor do most of the posters in the eudev last rite topic in the -dev ML.

Quite simply, Gentoo really isn't organised at all.
It's a collection of volunteers doing their own thing, all building on the work of others.

About the only 'organisation' is the Gentoo council, that determines what happens if one project wants to do something that impacts others.
Even then, only if the projects cannot reach agreement among themselves.

Gentoo devs are not paid to work on Gentoo, they do what interest them, when it interests them.
There are a small number of devs that are paid by their employers to work on Gentoo doing the employers bidding because said employers use Gentoo in their businesses.
Sometimes that work gets into the ::gentoo repo, other times its kept in the employers local overlay.

If this lack of organisation gives an illusion of choice, that all it is. An illusion.
We have several init system because devs re interested in maintaining several init systems. There is no organisation behind that.

Nobody is interested in maintaining eudev in the ::gentoo repo and more, so its being removed.

The Gentoo is about choice mantra has never been true. Gentoo is about what the contributors are interested in. It really is that simple.
There are no conspiracies - Gentoo does not even have the organisation for that.

[matthew2]

Can somebody explain why they'd choose eudev or opemtmpfiles today? Maybe I'm a bit behind, but aren't they just outdated forks now? I saw the hellthread (100+ emails ) in gentoo-dev and do not understand the rationale.

[stefan11111]

Can somebody explain why they'd choose eudev or opemtmpfiles today? Maybe I'm a bit behind, but aren't they just outdated forks now? I saw the hellthread (100+ emails ) in gentoo-dev and do not understand the rationale.

To not touch systemd code.
What is opentmpfiles forked from?

[NeddySeagoon]

stefan11111,

eudev was forked from systemd sometime after it had swallowed udev. udev was its own project at one time.

opentmpfiles was split out of openrc.

[Zucca]

I'll just leave these tmpfiles related links here:

• https://github.com/juur/tmpfilesd
• https://github.com/eweOS/pawprint
• https://github.com/KenjiBrown/hardenedtmpfiles

stefan11111,

• you still have the choice.

[GDH-gentoo]

Eudev is maintained upstream, it recently got 2 new volunteers downstream and is fit for plenty of use cases.

It is not fit for installing libgudev 238 or later, because it can't link to its libudev. And, for a package that claims to be mantained, its maintainers are taking their sweet time to fix the ABI incompatibility that is the underlying cause.

With opentmpfiles, there is even less reason to remove it.

Opentmpfiles has a known, standing CVE, and no upstream to fix it.

Is gentoo still about choice?

You (and many people here) don't seem to be taking into account the actions of the packages' upstreams. The only thing a distribution can do about uncooperative, slow or nonexistent upstreams, is creating and maintaining distribution patches, and that's work that several developers seem to believe that they can't afford.

[stefan11111]

With opentmpfiles, there is even less reason to remove it.

Opentmpfiles has a known, standing CVE, and no upstream to fix it.
How easy is it to exploit?

[GDH-gentoo]

How easy is it to exploit?

If there is a CVE, it can be exploited, period, and that alone constitutes a serious QA problem that makes it unsuitable for being packaged by any respectable distribution. Individual users can, of course, not care about CVEs and install it regardless.

EDIT: BTW, where is the "helltrhead"?

[NeddySeagoon]

GDH-gentoo,

If you need to ask, you really don't want to know. :)

The First Post this time round, is there.
eudev has been last rited before. It got a reprieve as a new upstream took it on.

-- edit --

Its all been said in that ML thread. Several times. Its pointless different people discussing it all again here.
... unless its to put a team together to do the work to keep eudev as a viable alternative to udev.

[GDH-gentoo]

Found it, I didn't realize that archives.gentoo.org is not updating anymore

EDIT: Huh, I'm surprised by Arsen's e-mails. He's still listed as an "active team member" upstream and Boian is waiting for his review... Does he know ?

[Ralphred]

If there is a CVE, it can be exploited, period ~~~ not care ~~~ install it regardless.

I read as far as "a local user", which means I have bigger problems than an exploit from my local overlay, and it's time to take the sword of the mantle piece and start poking intruders., but I get the point.

The Gentoo is about choice mantra has never been true.

Meh, no other* distro allows you to keep "outdated" software around until lack of backward compatibility actually causes breakage (and I don't mean missing lib versions, I mean actual deprecation passing beyond what is "reasonable" backward compatibility). From this point of view, Gentoo's "still being about choice" is the choice of how far off piste you are prepared/able to go to maintain your off piste choices. Whilst "Gentoo OOTB" may not allow/recommend such choices, it certainly makes it easier to do than anything else I've tried.

A suitable statement might be:Gentoo allows as much choice as possible for new users, constrained by the resources available. Seasoned/industrious users may become their own "resource" and expand the "choice pool" further, and with greater ease than any other distro.
If you think of the paradigm: We built a distro for "x" type of user and spread our resources to cover all the cases we could think of/cope with. - whilst the choice mantra may be ostensibly false, the "Gentoo way" means that more choice is inevitable by default; which, in my mind, pushes it squarely into the "least worst option" category (until a semi-sentient AI portage autoconfig app is available, at which point I wouldn't trust it and would still insist on using make.conf 20 years in the tweaking/making).

I think this can be reduced to a fairly simple wisdom: Devs have a responsibility to all Gentoo users, you only have responsibility for the systems you install/maintain; these two things are not the same. They are also the reason overlays exist.

*Arch may do this, but it's defaults annoyed me, so it only lived for ~20 minutes after "finishing the install".

[pietinger]

I do not understand this thread. Why ? Imagine I go to my bank advisor and tell him to give me 100,000 euros. He would certainly understand that as a bank robbery. Because he would never get the idea that I want to have the money "just like that" only as a gift.

What our developers (and all who do something for gentoo) do is a gift. No one is obligated to do anything they don't want to do - because they don't get paid for it. There is no contract and no salary.

How idiotic is it to ask someone: Give me something ! Because I want it !

I myself am a moderator because I want to give back something I have received - as a gift. It was my decision to accept the offered task. If someone should say tomorrow, I should be more often in the forum to fulfill my task even better, it could be that I say:

I do not have to do anything !

I would like to quote here again Ralphred (thanks for your great post) and mark the most important thing:

Gentoo allows as much choice as possible for new users, constrained by the resources available.

Resource means people who are willing to give away their time (and knowledge) for free. If these people no longer have time (or desire) to give something away, then one should say:

"Thank you for doing it earlier. It is a pity that you stop, but of course it is your life. Thanks again."



I would like to take this opportunity to dedicate the last sentence to a great developer, who today - unfortunately - said he no longer had so much time for the forum.

[pjp]

If this lack of organisation gives an illusion of choice, that all it is. An illusion.
We have several init system because devs re interested in maintaining several init systems.

I think there was at one time at least a strong implication of the sentiment of choice. I think the following references support that, although I don't ever recall anything suggesting the Gentoo repository would always contain certain packages or never have packages evicted. I have no idea how difficult it is to circumvent the tools (EAPI versions, virtual dependencies, etc.) that would allow alternatives to system level packages.

About Gentoo implies it, perhaps loosely:

[Gentoo] can be automatically optimized and customized for just about any application or need.

Gentoo Philosophy is more specific (too much editing would have been necessary to highlight the relevant pieces):

Every user has work they need to do. The goal of Gentoo is to design tools and systems that allow a user to do that work as pleasantly and efficiently as possible, as they see fit.

Every user has work they need to do. The goal of Gentoo is to design tools and systems that allow a user to do that work as pleasantly and efficiently as possible, as they see fit. Our tools should be a joy to use, and should help the user to appreciate the richness of the Linux and free software community, and the flexibility of free software. This is only possible when the tool is designed to reflect and transmit the will of the user, and leave the possibilities open as to the final form of the raw materials (the source code.) If the tool forces the user to do things a particular way, then the tool is working against, rather than for, the user. We have all experienced situations where tools seem to be imposing their respective wills on us. This is backwards, and contrary to the Gentoo philosophy.

Put another way, the Gentoo philosophy is to create better tools. When a tool is doing its job perfectly, you might not even be very aware of its presence, because it does not interfere and make its presence known, nor does it force you to interact with it when you don’t want it to. The tool serves the user rather than the user serving the tool.

The goal of Gentoo is to strive to create near-ideal tools. Tools that can accommodate the needs of many different users all with divergent goals. Don’t you love it when you find a tool that does exactly what you want to do? Doesn’t it feel great? Our mission is to give that sensation to as many people as possible.

Maybe some of the protective tooling has made it a little less easy to stick to that original(?) sentiment.

[stefan11111]

Every user has work they need to do. The goal of Gentoo is to design tools and systems that allow a user to do that work as pleasantly and efficiently as possible, as they see fit.

Every user has work they need to do. The goal of Gentoo is to design tools and systems that allow a user to do that work as pleasantly and efficiently as possible, as they see fit. Our tools should be a joy to use, and should help the user to appreciate the richness of the Linux and free software community, and the flexibility of free software. This is only possible when the tool is designed to reflect and transmit the will of the user, and leave the possibilities open as to the final form of the raw materials (the source code.) If the tool forces the user to do things a particular way, then the tool is working against, rather than for, the user. We have all experienced situations where tools seem to be imposing their respective wills on us. This is backwards, and contrary to the Gentoo philosophy.

Put another way, the Gentoo philosophy is to create better tools. When a tool is doing its job perfectly, you might not even be very aware of its presence, because it does not interfere and make its presence known, nor does it force you to interact with it when you don’t want it to. The tool serves the user rather than the user serving the tool.

The goal of Gentoo is to strive to create near-ideal tools. Tools that can accommodate the needs of many different users all with divergent goals. Don’t you love it when you find a tool that does exactly what you want to do? Doesn’t it feel great? Our mission is to give that sensation to as many people as possible.

Does the tool serve the user when it forces you to track and needlessly duplicate work done by gentoo devs?

[pingtoo]

Does the tool serve the user when it forces you to track and needlessly duplicate work done by gentoo devs?

Can you provide a example of what do you mean "the tool" that "forces you to track and needlessly duplicate work"?

Which tool? and how it force you do duplicate work?

I am not sure in Gentoo there is a tool require someone using it with some sort of duplicate effort.

[stefan11111]

Does the tool serve the user when it forces you to track and needlessly duplicate work done by gentoo devs?

Can you provide a example of what do you mean "the tool" that "forces you to track and needlessly duplicate work"?

Which tool? and how it force you do duplicate work?

I am not sure in Gentoo there is a tool require someone using it with some sort of duplicate effort.

The tool in question is gentoo. More precisely, ::gentoo.
Eudev and opentmpfiles are being last-rited. In order for one to be able to keep using them, they have to be put into overlays, and various virtuals will have to me maintained.
This is because there is no /etc/portage/patches for ebuilds.
Thankfully, I am free from (e)udev and friends.
Sadly, I still use opentmpfiles(not on my raspi, as I said on the ml, but on my laptop. I misremembered when I wrote that).

This has/is happening with libressl. See this issue: https://github.com/gentoo/libressl/issues/532
This is not the only example of this, only the latest one.

[Hu]

What work are you duplicating? The developers have ceased supporting those packages and done all the required work to make things stop allowing them as a dependency. If you're duplicating work, it's because you're not copying the work the developers are doing. It reads to me like you are complaining that the developers aren't supporting something you want supported, and now you're being expected to support it yourself or switch to something they will keep supporting for you. It is a bit unfortunate that you need to put in a small amount of work to migrate off the package they abandoned, but that beats doing the ongoing continuous work of maintaining the package in an overlay.

This ties back to what pietinger said above: they were volunteering their time to maintain some packages you liked. They have now decided not to volunteer more time maintaining these packages (eudev, opentmpfiles) because they are not getting enough value out of continuing to do so, in part because with upstream unavailable, the time requirement for maintaining the package increases substantially.

[pjp]

Does the tool serve the user when it forces you to track and needlessly duplicate work done by gentoo devs?

Maybe, maybe not.

The tool in question is gentoo. More precisely, ::gentoo.
Eudev and opentmpfiles are being last-rited. In order for one to be able to keep using them, they have to be put into overlays, and various virtuals will have to me maintained.

I'll quote the relevant part of my post that you excluded or skipped over:

I don't ever recall anything suggesting the Gentoo repository would always contain certain packages or never have packages evicted.

Your example is among the reasons I specifically included that comment. I would categorize the concept of an ebuild as a tool, but not individual ebuilds. A recipe is a tool, but the end result of following a recipe is not.

Eudev and opentmpfiles are being last-rited. In order for one to be able to keep using them, they have to be put into overlays, and various virtuals will have to me maintained.

You answer your own question here. The "tools" include that which facilitates your ability to do so.

This is because there is no /etc/portage/patches for ebuilds.

Maybe no one has done the work for it to be implemented, or there are problems with implementing it.

[pingtoo]

Does the tool serve the user when it forces you to track and needlessly duplicate work done by gentoo devs?

Can you provide a example of what do you mean "the tool" that "forces you to track and needlessly duplicate work"?

Which tool? and how it force you do duplicate work?

I am not sure in Gentoo there is a tool require someone using it with some sort of duplicate effort.

The tool in question is gentoo. More precisely, ::gentoo.
Eudev and opentmpfiles are being last-rited. In order for one to be able to keep using them, they have to be put into overlays, and various virtuals will have to me maintained.
This is because there is no /etc/portage/patches for ebuilds.
Thankfully, I am free from (e)udev and friends.
Sadly, I still use opentmpfiles(not on my raspi, as I said on the ml, but on my laptop. I misremembered when I wrote that).

This has/is happening with libressl. See this issue: https://github.com/gentoo/libressl/issues/532
This is not the only example of this, only the latest one.

Thank you for clarification.

In my mind a tool in Gentoo is "emerge", "crossdev", or "catalyst". The ::gentoo is just a big cook book with many recipe on how to build programs. Each recipe was contributed by someone willing to share. However just like any dishes, there is no rule to said a dish mush follow just one specific recipe.

Since Gentoo is not one fixed distro, i.e. no one have a same Gentoo built as the other person. I really don't see how there is some "forces" that compel one to setup in one specific way.

In early day I have long arguments in this forum about "opentmpfile", about how it is not a security issue in term of Gentoo's usage due to it is local exploit in a very wrong usage pattern. And there are many mitigation strategy can prevent the local exploit, However I do agree with Hu's argument that Gentoo cannot knowingly distribute a program with security issue.

[stefan11111]

Does the tool serve the user when it forces you to track and needlessly duplicate work done by gentoo devs?

Maybe, maybe not.

The tool in question is gentoo. More precisely, ::gentoo.
Eudev and opentmpfiles are being last-rited. In order for one to be able to keep using them, they have to be put into overlays, and various virtuals will have to me maintained.

I'll quote the relevant part of my post that you excluded or skipped over:

I don't ever recall anything suggesting the Gentoo repository would always contain certain packages or never have packages evicted.

Your example is among the reasons I specifically included that comment. I would categorize the concept of an ebuild as a tool, but not individual ebuilds. A recipe is a tool, but the end result of following a recipe is not.

Eudev and opentmpfiles are being last-rited. In order for one to be able to keep using them, they have to be put into overlays, and various virtuals will have to me maintained.

You answer your own question here. The "tools" include that which facilitates your ability to do so.

This is because there is no /etc/portage/patches for ebuilds.

Maybe no one has done the work for it to be implemented, or there are problems with implementing it.

See what happened with libressl and the amount of duplicate work needed to support it.

I get that gentoo is run by volunteers, but this model doesn't work for all packages.

Mike Gilbert<floppym@gentoo.org> Mon, Sep 18, 2023 at 6:18 PM
Reply-To: gentoo-dev@lists.gentoo.org
To: gentoo-dev@lists.gentoo.org
Cc: gentoo-dev-announce@lists.gentoo.org
Reply | Reply to all | Forward | Print | Delete | Show original
- Hide quoted text -
On Mon, Sep 18, 2023 at 5:49 AM Sam James <sam@gentoo.org> wrote:
>
> Packages up for grabs:
> acct-group/croc
> acct-user/croc
> app-misc/liquidctl
> dev-libs/hidapi
> dev-python/hidapi
> net-misc/croc
>

Also, sultan leaving means we are down to 1 person proxy maintaining
www-client/chromium.

If you have any interest in helping with this package, please reach
out in #gentoo-chromium on Libra.chat.

Not that I mind chromium going away, but other people might.

[fedeliallalinea]

Not that I mind chromium going away, but other people might.

The "Packages up for grabs" is different from the "Last rites".

[pietinger]

I get that gentoo is run by volunteers, but this model doesn't work for all packages.

What other model would you suggest ? Should some developers be paid ? If so, who should pay for it ?

[sMueggli]

The tool in question is gentoo. More precisely, ::gentoo.
Eudev and opentmpfiles are being last-rited. In order for one to be able to keep using them, they have to be put into overlays, and various virtuals will have to me maintained.

This is a good example that the Gentoo user has a choice. You can keep using them by putting packages into an overlay. Or you can follow this change to have a working operating system with different tools that are doing the same as eudev and opentmpfiles.

It is your choice and you are free to follow your own way. And the same is valid also for the developers to make their choice. Thankfully the developers base their choice on technical facts and not on ideological propaganda.

[sam_]

Please see my previous remarks in one of these threads.

I'm also generally interested in ideas wrt making overlay development a bit easier.