initial packaging

[adrelanos]

Initial implementation of #259.

Just run

make deb-pkg

and a ../tuf_0.2-1_all.deb will be created .

Then you can install it using:

sudo dpkg -i ../tuf_0.2-1_all.deb

All files from the tuf folder will be installed to /usr/lib/tuf.

And remove:

sudo apt-get purge tuf

Then the /usr/lib/tuf folder will be removed.

There are still some lintian warnings and other issues to be sorted out (prevent adding third party source code files to deb, machine readable license file, maintainer field and more), but before I go into details, please leave some feedback, so I know this approach is worth pursuing and spending more effort is worth it.

---

Other makefile features:

make help

make help
   Show this help.
make dist
   Create package-version.tar.gz from source files in $DISTDIR (default "..").
make undist
   Delete package-version.tar.gz from source files in $DISTDIR (default "..").
make debdist
   Create debian.tar.gz from source files in $DISTDIR (default "..").
make undebdist
   Delete debian.tar.gz from source files in $DISTDIR (default "..").
make manpages
   Create man page from man source folder, which will be stored in debian/tmp-man folder.
make uch
   Store upstream changelog from git log in debian/changelog.upstream.
make install
   Copying the files from the source tree to system-wide directories.
make installsim
   Simulate copying the files from the source tree to system-wide directories.
make deb-pkg
   Create a deb, which will be stored in parent folder.
make deb-pkg-install
   Create a deb, which will be stored in parent folder, and install it.
make deb-install
   Install deb from parent folder.
make deb-icup
   Combination of make deb-pkg, make deb-pkg-install and make deb-pkg-cleanup.
make deb-remove
   apt-get remove make_source_package_name
make deb-purge
   apt-get purge make_source_package_name
make deb-clean
   Delete temporary debhelper files.
make deb-cleanup
   Same as make deb-clean and deletes debuild artifacts from parent folder.
make dput-ubuntu-ppa
   Upload to Ubuntu ppa. Requires functional .dput.cf.
make clean
   Currently same as make deb-clean.
make distclean
   Currently same as make clean.
make checkout
   Fetch from git.
make installcheck
   Check if source files match installed files.
make uninstallcheck
   Check if make uninstall removed all files.
make uninstall
   Delete all installed files.
make uninstallsim
   Simulate what make uninstall would do.
make deb-chl-bumpup
   Bump upstream version number in debian/changelog.
make git-tag-sign
   git tag (-s) sign latest pkg_version_with_revision from debian/changelog. Only a repository sanity check. Not for security purposes!
make git-tag-verify
   git tag (-v) verify latest pkg_version_with_revision from debian/changelog. Only a repository sanity check. Not for security purposes!
make git-tag-check
   Check if current git head is a signed git tag. Only a repository sanity check. Not for security purposes!
make git-commit-verify
   Check if current git head is a signed git commit. Only a repository sanity check. Not for security purposes!
make git-verify
   Combination of tag-check and commit-verify. Only a repository sanity check. Not for security purposes!

[coveralls]

Coverage remained the same at 95.27% when pulling de2ddf5 on adrelanos:deb into dbd7e27 on theupdateframework:develop.

[vladimir-v-diaz]

We are likely to proceed with this approach. I will test the scripts, TUF, and resolve the issue with the third party source code soon.

Thank you for the contribution.

[adrelanos]

First details...

make deb-pkg

lintian

E: tuf: bad-provided-package-name python:any

Wondering what that is.

• https://lintian.debian.org/tags/bad-provided-package-name.html
• https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Source

Package names (both source and binary, see Package, Section 5.6.7) must consist only of lower case letters (a-z), digits (0-9), plus (+) and minus (-) signs, and periods (.). They must be at least two characters long and must start with an alphanumeric character.

Using tufx for testing purposed as package name is accepted. However, tuf looks like a fine, policy conform package name to me. There is an even smaller package in Debian called pv. Unless you have any other ideas, this looks like a bug in lintian? Should I report a bug?

W: tuf: package-contains-vcs-control-file usr/lib/tuf/_vendor/ed25519/.gitignore

W: tuf: extra-license-file usr/lib/tuf/_vendor/ed25519/LICENSE
W: tuf: extra-license-file usr/lib/tuf/_vendor/iso8601/LICENSE

These will be gone as soon as the third party source code is removed from tuf's source code. If you want to keep it, we could also add something to make-helper[-overrides].bsh so it skips copying those.

W: tuf: executable-not-elf-or-script usr/lib/tuf/__init__.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/conf.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/client/updater.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/keydb.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/unittest_toolbox.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/util.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/log.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/_vendor/__init__.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/mirrors.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/download.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/client/__init__.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/sig.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/hash.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/ed25519_keys.py
W: tuf: executable-not-elf-or-script usr/lib/tuf/roledb.py

Would it be appropriate for you to run chmod +x ./tuf/* in tuf's source code folder?

[vladimir-v-diaz]

I haven't looked into the package name issue, but I suspect that python- must be prepended to tuf (Debian Python module name policy).

Okay, I will (1) set the execute bit for the modules that need them and (2) exclude the third-party source code included in TUF.

[adrelanos]

Correct. Naming issue and more fixed with last commit.

Minor: I keep adding commits here. In the end, you can either merge them as is or I can provide a fresh pull request with cleaned history or however you prefer.

[vladimir-v-diaz]

You may continue adding commits here; I actually prefer that subsequent commits to issues raised in comments occur in the same pull request.

[coveralls]

Coverage remained the same at 95.27% when pulling 4daa111 on adrelanos:deb into dbd7e27 on theupdateframework:develop.

[adrelanos]

Added an important fix:
adrelanos@6a3e1bd

The user can now not only execute scripts from /usr/share/pyshared/tuf/*, but also use import tuf.client.updater from python scripts. Here is a very minimal /home/user/tuftest script that I used for testing.

#!/usr/bin/python

import tuf.client.updater
import logging

tuf.log.set_log_level(logging.INFO)

print "works"

./tuftest

works

If you replace the import tuf.client.updater with import qqqtuf.client.updater or so, it will fail as expected. So this means, import tuf.client.updater apparently works.

Needless to say, that it is advisable to test if all the imports are functional.

[coveralls]

Coverage remained the same at 95.27% when pulling 6a3e1bd on adrelanos:deb into dbd7e27 on theupdateframework:develop.

[adrelanos]

Ping?

[lukpueh]

Superseded by a2532a1. Thanks for the initiative, @adrelanos! Closing here.