What does it take to get Debian to update a package?
More than two years, about 50 mails, 10 people from 3 different Debian-related IRC channels, 4 bugs filed by upstream and 2 security-related issues reported to the Security team … Sound’s legit IMHO.
Well, no. That’s only to get the two security-related issues fixed. The package is still outdated after that. Getting the package online using latest upstream just took another few months.
But first things first. As you might already know from previous posts on getting updated GeSHi versions into Debian I really LOVE how they do things. As a citizen of the world’s leading export nation of bureaucracy I thought I knew bureaucracy well and looking up Debian on Wikipedia I couldn’t belief this was not a German project – they were just doing so well with everything taking ages to complete.
Back to topic. There have been two reports on the Debian bug tracker affecting highlighting in GeSHi. Those reports are two years old and had been fixed for quite some time. When they weren’t fixed for about half a year I decided to file another issue asking to do an update of the package to use the more recent version. That version was not the subsequent one but had already another 3 versions in between. Usually this shouldn’t happen, but it did and so the reminder should have notified people downstream to do their work. Nothing happened.
In the mean time I was at some conferences where I met with different Debian people at their stand notifying them of this package that really needed an update. As they couldn’t help immediately (Yeah, packaging things takes time and so I didn’t expect them to just turn around, open up their shell to do an emergency upload right away) I at least asked them to bring up the issue to attention to the responsible people.
On the first conference nothing happened. So I tried to write some mails to the maintainers directly as was suggested at the conference. Yet there was no response; nor was there an update.
So I brought the issue up at another conference this year and finally found someone who at least had the necessary skills to co-maintain the package. He immediately agreed after I showed him what I needed for the new update to be done on the downstream side. With only little delay after the conference he volunteered on the bugtracker and asked if people would like him to co-maintain. He quickly got a reply on his message but from than on nothing more happened.
And so, nearly yet another half a year later there was finally the release I planned to have been doing last November. As this release contained two bugs in files distributed together with GeSHi I got onto the Debian channel to get hold of some Debian developer directly.
My first try was #debian and after just stating a few things necessary to describe the issue I got forwarded to #debian-mentors. Arriving there I stated my issue again and promptly got the response „File a bug“. Okay, I’d been doing this about two years ago, let’s provide him a link to a ticket: Ten seconds later he had a link to a ticket opened two years ago. It’s quite rare you get random people apologize that fast 😉
With the basic situation being cleared up to everyone on the channel I then explained in more detail on what I needed the Debian folks to do; a NMU pulling in latest upstream would have been nice, but as Debian hadn’t updated for two and a half years it was quite unlikely they accepted a 10kLOC patch as a Non-Maintainer Upload by just anybody. Some more discussion was necessary.
Also with the situation with the maintainership being cleared up I got another forwarding to #debian-qa. Luckily I didn’t have to repeat my CV as the people from #debian-mentors were so kind to do this for me. I only had to start explaining once the whole bug ticketing and report queueing started. That’s when yet another petition for updating the package to something reasonably recent had to be filed.
Interestingly enough I than received some interesting mail by the developer who had volunteered to package the new version back at the last conference and officially posted so on the tracker a few months ago. The mail wasn’t much text but it contained some viable information: He never actually got access to the Debian repository which he would have needed to do anything. At least it explained the situation quite well. Unfortunately it didn’t resolve the issue at hand: Two security bugs to get into stable and 2.5 years worth of updates to be put into an as-recent-as-possible distibution as possible.
I’m really looking forward to when Debian is reasonably up-to-date with my software with a delay less then 3 months.
