Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 781881 - New policy on removing old GLEP 81 acct-user/acct-group packages
Summary: New policy on removing old GLEP 81 acct-user/acct-group packages
Status: CONFIRMED
Alias: None
Product: Quality Assurance
Classification: Unclassified
Component: Policies (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Quality Assurance Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 793272 769782
  Show dependency tree
 
Reported: 2021-04-10 00:07 UTC by Sam James
Modified: 2023-07-18 08:21 UTC (History)
5 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-04-10 00:07:07 UTC
We should probably have a policy on now-obsolete GLEP 81 user/group packages.

Plex, for example, had acct-{group,user]/plex, but Plex itself is not currently in treee. It's tempting for developers to last-rite this, but I'm not sure it actually adds anything to remove it -- and if it were removed, we would still surely have to keep it in uid-gid.txt anyway.

So, we should form a specific policy on this and state it clearly. Let me know if there's one I've missed.
Comment 1 Ulrich Müller gentoo-dev 2021-04-10 08:40:46 UTC
> We should probably have a policy on now-obsolete GLEP 81 user/group packages.

I'd say this follows normal policy for package removal. So, if there are no reverse dependencies left, the package should be removed. This won't delete the users and groups from users' systems.

> [...] if it were removed, we would still surely have to keep it in
> uid-gid.txt anyway.

As "historical", yes. Which probably means that the id will be reused at some point.
Comment 2 Ulrich Müller gentoo-dev 2021-04-10 08:44:36 UTC
OK, I just looked at bug 769782 which seems to be a special case. If the package is expected to be readded soon, then it makes sense to keep the user and group.

Not sure if a general policy could cover such individual special cases.
Comment 3 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2021-04-10 08:50:49 UTC
To be honest, I think keeping these packages would reduce potential confusion.
Comment 4 Conrad Kostecki gentoo-dev 2021-04-10 10:28:58 UTC
I think it's ok keeping them, if they maybe will be needed in future.
But couldn't such packages be marked somewhow, if currently no consumers are present? So you could somehow see, if that package is in use.
Comment 5 Marco Scardovi (scardracs) 2021-07-12 20:10:29 UTC
Could I suggest to "update" the GID/UID for these packages with -1 like in GURU/other overlays in order to free up these that can be assigned?
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-07-31 05:55:40 UTC
(In reply to Conrad Kostecki from comment #4)
> I think it's ok keeping them, if they maybe will be needed in future.
> But couldn't such packages be marked somewhow, if currently no consumers are
> present? So you could somehow see, if that package is in use.

Maybe just masking is sufficient?

(In reply to Marco Scardovi (scardracs) from comment #5)
> Could I suggest to "update" the GID/UID for these packages with -1 like in
> GURU/other overlays in order to free up these that can be assigned?

I believe GURU is supposed to use -1 IDs anyway, and we don't need to care about overlays.
Comment 7 Florian Schmaus gentoo-dev 2023-02-20 10:35:10 UTC
I don't quite understand why we would want to keep acct-* packages that became leaf packages for eternity? While the UID reservation should probably be kept, if the acct-* package becomes unused and is unlikely to be reinstated again, then I don't see what we gain by keeping the package(s) around.

On the other hand, obsolete packages in ::gentoo seem to only cause noise and a poor user experience. For example, a user searching for jabber packages performing "eix -S jabber", may be confused by the existence of acct-user/jabber and wondering about its purpose.