Re: imagemagick@6.9.11-48 to graft or not to graft with 6.9.12-2

[Mark H Weaver <mhw@netris.org>]

Hi Andreas,

Andreas Enge <andreas@enge.fr> writes:
> And please let us agree that in the future, we only backport fixes in grafts
> and do not update version numbers.

I agree that in this particular case, that's what should have been done,
and that we should still try to do it.  It will be several days at least
before I'm able to look at it, though.  Would someone else like to try?

I also agree that in general, we should be more careful to check for ABI
compatibility before grafting.  Moreover, if an update includes
substantial changes other than bug fixes, I agree that backporting the
fixes is highly preferable for grafting purposes.

However, I think it would be going too far to adopt your proposal as a
general rule for all grafts.  In some cases, it can clearly be seen that
an upstream release includes little more than bug fixes.  For example,
if the recent gvfs-1.40.2 security update had required grafting, I would
not have hesitated to do so, and that would have been much simpler and
IMO cleaner than importing the upstream patches into our tree.

I'll also note that fewer imported patches makes for less review work by
those of us who try to keep an eye on changes made to Guix, to help
guard against the possibility of malicious "fixes" being introduced by
our growing list of committers.  Note that this could happen without any
ill intent on the part of the committer, if their development machine is
compromised by a third party.

What do you think?

    Regards,
      Mark