Who should be software packaging is a tough problem, I can see the value in #linux distros pushing for better changes downstream, encouraging upstream to change (double click in #KDE) but then I see cases like KeepassXC where the Debian package is now by default broken, actively damaging the reputation of upstream but then I remember #XZ where upstream was left unchecked and hid bad code in plain sight and I go back around in a circle.
Yes, I find reporting to downstream packagers (a.k.a. distributors) extremely relevant! When your favorite #SoftwareCenter or #PackageManager is all for linking to upstream, but not to those who directly affect your package in a supply chain, as a result, tops like in #KeePassXC get all the pinecones: there is no enthusiasm in an average user to link back those issues to downstream, not with the p(l)ain text and how derivatives are communicated anyway... :blobcat_flop_woozy:
What if we had an #ActivityPub federated app to take care of the social aspects of serving packages from self-hosted registries? And used a mechanism like #WebTorrent which #Peertube also uses, to distribute the packages?
FreedomBox 23.12 released! Since Debian 12 (bookworm) is now released, that means the FreedomBox package will resume its normal migration route (unstable -> testing -> stable-backports).
Changes:
packages: Purge packages on uninstall
gitweb: Fix issue with service startup when gitweb is not enabled
mediawiki: Increment version to run update.php automatically