[Pkg-net-snmp-devel] Bug#557434: Bug#557434: libsnmp-base: Asks (with high priority) to download non-free bits on installation

[Jochen Friedrich]

Hi Josh,

> - As stated several times in the discussion leading to this change,
>   libsnmp-base doesn't necessarily need these MIBs to function; only the
>   command-line tools, and *possibly* other software using libsnmp-base
>   that wants names rather than numbers, do.  That would tend to lead to
>   a "Suggests" at most from libsnmp-base.  Prompting for installation
>   proves quite intrusive by comparison, for something most users don't
>   need.

The problem is I don't really know which package only needs libsnmp-base
or libsmi2-common and which package needs the MIBs.

I'm really into moving the MIB installation to a package in contrib. This
package should probably depend on libsmi2 as smistrip does a better job than
the script included in the net-snmp package.

> - It bypasses the packaging system by downloading and installing bits
>   that don't get managed by the package manager.  (This will prove even
>   more painful if the data needs updating at any point.)  Furthermore,
>   it installs these bits to /usr.

IMHO, the MIB base is intended to be dynamic. libsmi comes with a directory
/usr/share/mibs/site which should be used for extra MIBs, e.g. to enable
wireshark to dissect private OIDs (like Cisco ones) to its name.

> 1) If the licenses of the MIB files permit (which as far as I can tell
>    they do), package the MIB files in Debian non-free.  Have
>    libsnmp-base suggest this new package; packages in main may suggest
>    packages in contrib or non-free, they just can't depend on or
>    recommend packages in contrib or non-free.  Other packages, like smi,
>    can also suggest this package.  Any package which actually requires
>    the MIB files can depend on them (and move to contrib), if we can't
>    fix it to avoid that requirement; packages which work fine without
>    the MIB files but which could make use of them if present could
>    suggest the package containing the MIBs.

I don't think they do permit this. IIRC, the problem with RFCs and according
to IETF with the MIBs as well is that modification is not allowed. Unfortunately,
some older MIBs distributed as RFC have syntax errors preventing parsers to read
them correctly. Further more, the SMIv1 based MIB trees depend on RFC-1212 and
RFC-1215 which, in spite of their name, have *never* been distributed as RFC.
Although these files can be found in various places, i never saw any license for
these two files.

> 2) If the licenses of the MIB files do not permit redistribution,
>    create a package in contrib which unconditionally downloads and
>    installs them, and treat that package as described in 1 above
>    (Suggests from libsnmp-base, in particular).

That's the road we should go IHMO.

Thanks,
Jochen