[Pkg-samba-maint] Target for squeeze: 3.4 or 3.5?

[Steve Langasek]

Hi Christian,

On Mon, Feb 01, 2010 at 06:24:27PM +0100, Christian PERRIER wrote:
> Samba 3.5.0 should be released by Feb 16th. That raises the question
> of what we want to have for Squeeze.

> Either we can stick with the now quite rock solid 3.4 versions or we
> can follow upstream and go with 3.5.

> The risk we're taking by going for 3.5 is freezing with a quite early
> minor release (say 3.5.0 or 3.5.1 or something) and then be stuck with
> it while upstream consolides 3.5.

> The risk we're taking by going for 3.4 is an early EOL in upstream
> release cycle.

> It seems to me that we'd better go for 3.5, with the main argument
> that Windows 7 support is likely to be a good driving force and it is
> likely that upstream improves it more in 3.5 than 3.4....

> Also, given the quite conservative approach taken by upstream, I think
> we could quite easily spot the patches we can backport in the squeeze
> version after the release of squeeze. Also, with my experience of the
> Debian freeze schedules and the current status of the project, I feel
> like we're not likely to release before Summer 2010.

> So, at first glance, I would prefer going with 3.5. Steve, would that
> fit with Ubuntu release schedule, particularly for 10.04 (I never
> remember what funky name you guys decided to give to that one)?

Sorry, I've been meaning to answer this more explicitly.

I haven't seen an upstream statement regarding the intended EOL of 3.4, but
extrapolating from past behavior - such as a security release for Samba 3.0
in October 2009, over 6 years after 3.0 was first released and a year and a
half after Samba 3.2 was released - I don't think there's much risk of the
squeeze release cycle (now + 3? 4? years) being affected by an upstream EOL
of 3.4 support.  Even if this were the case, all would not be lost for
security support for 3.4, since at least one other distribution - Ubuntu -
will definitely be shipping 3.4 in their upcoming release, so 3.4 will be
covered by downstream security support for 5 years.

Quite apart from that, I disagree with uploading upstream versions to
unstable that we don't believe are currently stable enough for release on
the *expectation* that the release team will miss their freeze goal by 4
months and leave us time for the upstream branch to stabilize.  That's a
self-fulfilling prophecy - of course if everyone maintains their packages in
the belief that Debian isn't freezing any time soon, it ensures that Debian
won't be ready to freeze any time soon.  If 3.5 has some time to mature and
the Debian freeze continues to lag, then we could still switch to 3.5 for
squeeze later without painting ourselves into a corner now.

BTW, not too long ago you responded on one of the upstream mailing lists to
a poster who complained that the Debian Samba packages never worked for him
while the Ubuntu ones did.  While it's true that the packaging is the same
between Debian and Ubuntu for Samba, we've actually never had an Ubuntu and
Debian release shipping the same upstream version of Samba.  So while I
think it's just bad luck that the one particular user hit a bug in the
Debian Samba package that was fixed in the version Ubuntu shipped, and that
there are surely users for whom the reverse is true, I think it's worth
considering whether there are other fringe benefits to sticking with the
same Samba branch as Ubuntu for release.

Cheers,
-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
slangasek at ubuntu.com                                     vorlon at debian.org