Bug#708584: versioning system/package name allows for binary incompatible libraries

[Anton Gladky]

Hi,

I have done this upload, sorry if I broke something or offended somebody.

2013/5/16 Scott Howard <showard at debian.org>

> Package: alglib
> Version: 3.7.0-1~exp1
> Severity: serious
>
> the version of alglib is 3.7.0. Debian now is assigning a SONAME version
> of 3.
> This is incorrect as it implies all 3.x.x libraries are binary compatible,
> which they are not. Upstream changelog explicitly states that not binary
> 3.7.0
> and 3.6.0 are not binary compatible, for example.
>
> When assigning a SONAME version that differs from upstream, use the
> "debian"
> word in the SONAME. For example, 3debian0 would be an appropriate SONAME,
> but
> you would have to keep track of backwards incompatible changes to symbols
> and
> bump the next version when it comes out (e.g. 3debian1). If you don't do
> this,
> you risk making libraries that are incompatible with other distributions
> and
> upstream. That's why the old build system used the "-release @VERSION@"
> flag
> instead of "-version", so ensure that the soname remained blank. You can
> assign
> a SONAME to the library, but please append "debianX" or keep the old
> system so
> we can follow policy 8.2 "The run-time shared library must be placed in a
> package whose name changes whenever the SONAME of the shared library
> changes."
> I preferred the old system since I didn't like assigning a SONAME that
> upstream
> was not using.
>

Ok, if you want, I will create libalglib3.7.0. But I do not know, whether
it is necessary for
the package, having just qtiplot in build-rdeps and with popcon 33. But you
are the
main maintainer, you should decide.


> Other issues, not directly related to this bug, but somewhat at an RC
> level so
> we can take care of it before it migrates to testing:
> 1) Why was alglib bumped at all?


Why, actually, the version 2.6.0 has  been uploaded into Debian on "06 Mar
2011",
if it was half a year obsolete and unsupported by upstream? The version
3.3.0 was
already available [1].


> Does another package need it?


Yes, not (yet) uploaded into Debian.


> Why was the new
> version uploaded, breaking the only depending package in Debian without
> first
> checking with that package?
>

It was my fault, sorry. And I wrote you an email about that and fixed an
issue already.


> 2) Why did a team upload switch from autotools to cmake?
>

3-versions are completely different from 2-vesions. It was rewritten from
scratch.
And yes, personal preferences. Why did you ask about that after uploading
the
package?


> 3) Why did 1 and 2 happen without consulting with the current uploaders of
> alglib or the depending package?
>
> That is not true and I am surprised, that you decided to discuss it here:
  1) I sent you and your co-maintainer an email with patches on alglib on
April 26th.
  2) May 5th the package has been uploaded into experimental.
  3) May 15th, the package has been uploaded into unstable.

The first communication with you was on May 16th.

So I think, the second part of the bug is not RC.
Again, sorry, if I broke something. I will try to be careful next time and
ready for co-maintaining.


Cheers,

Anton

[1] http://www.alglib.net/arcnews.php#date_06_03_2011
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/debian-science-maintainers/attachments/20130517/62a33491/attachment.html>