Github messages for voidlinux
 help / color / mirror / Atom feed
* [PR PATCH] iproute2: move usr/bin/tc to -tc-ipt subpackage
@ 2021-07-14 14:41 jirutka
  2021-07-14 14:48 ` q66
                   ` (5 more replies)
  0 siblings, 6 replies; 7+ messages in thread
From: jirutka @ 2021-07-14 14:41 UTC (permalink / raw)
  To: ml

[-- Attachment #1: Type: text/plain, Size: 2225 bytes --]

There is a new pull request by jirutka against master on the void-packages repository

https://github.com/jirutka/void-packages iproute2-split-tc
https://github.com/void-linux/void-packages/pull/31961

iproute2: move usr/bin/tc to -tc-ipt subpackage
/usr/bin/tc is used to configure Traffic Control, it should be part of existing iproute2-tc-ipt subpackage.

The primary motivation to move /usr/bin/tc into subpackage is to remove dependency on iptables package in iproute2, and transitively from base-system. Users who use nftables instead of legacy iptables would not have to blacklist iptables package anymore.

**IMPORTANT**: base-system doesn’t directly depend on iptables, but it depends on iproute2, so iptables is installed by default. It’s described in the [Firewalls documentation](https://docs.voidlinux.org/config/network/firewalls.html):

> By default, the iptables package is installed on the base system. It provides iptables(8)/ip6tables(8). The related services use the /etc/iptables/iptables.rules and /etc/iptables/ip6tables.rules ruleset files, which must be created by the system administrator.

I think that pulling iptables with the base-system by default is wrong. nftables is clearly superior and should be preferred on new installations. I don’t mean that it should be forced, just that iptables should not be the default. Since base-system is supposed to contain really just a base system (there’s not even a cron or syslog included), I think that it should not directly depend on iptables nor nftables.

However, many users probably rely on iptables being installed as transitive dependency of base-system, so effectively removing it from the dependency graph would cause troubles.

What can we do?

a) Inform users about the change, e.g. in post-upgrade message?
a.1) Can we automatically mark iptables as explicit dependency via hook when upgrading iproute2?
b) Add dependency on iptables to the base-system package (lowest effort).
c) Maybe create a virtual _firewall_ and make base-system depend on it? However, I don’t know yet how this works in xbps.
d) …?

/cc @q66 

A patch file from https://github.com/void-linux/void-packages/pull/31961.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-iproute2-split-tc-31961.patch --]
[-- Type: text/x-diff, Size: 1283 bytes --]

From 3d8487cc28dd3411a8aa684e759868266f4cbf12 Mon Sep 17 00:00:00 2001
From: Jakub Jirutka <jakub@jirutka.cz>
Date: Wed, 14 Jul 2021 16:16:50 +0200
Subject: [PATCH] iproute2: move usr/bin/tc to -tc-ipt subpackage

/usr/bin/tc is used to configure Traffic Control, it should be part of
existing iproute2-tc-ipt subpackage.

The primary motivation to move /usr/bin/tc into subpackage is to remove
dependency on iptables package in iproute2, and transitively from
base-system. Users who use nftables instead of legacy iptables would not
have to blacklist iptables package anymore.
---
 srcpkgs/iproute2/template | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/srcpkgs/iproute2/template b/srcpkgs/iproute2/template
index 8f517150839a..96225d65990c 100644
--- a/srcpkgs/iproute2/template
+++ b/srcpkgs/iproute2/template
@@ -1,7 +1,7 @@
 # Template file for 'iproute2'
 pkgname=iproute2
 version=5.12.0
-revision=1
+revision=2
 build_style=configure
 make_install_args="SBINDIR=/usr/bin"
 hostmakedepends="pkg-config perl flex"
@@ -35,6 +35,7 @@ post_install() {
 iproute2-tc-ipt_package() {
 	short_desc+=" - tc(8) IPtables support"
 	pkg_install() {
+		vmove usr/bin/tc
 		# m_ipt.so is symlinked to m_xt.so
 		vmove usr/lib/tc/m_ipt.so
 		vmove usr/lib/tc/m_xt.so

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: iproute2: move usr/bin/tc to -tc-ipt subpackage
  2021-07-14 14:41 [PR PATCH] iproute2: move usr/bin/tc to -tc-ipt subpackage jirutka
@ 2021-07-14 14:48 ` q66
  2021-11-24 16:28 ` leahneukirchen
                   ` (4 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: q66 @ 2021-07-14 14:48 UTC (permalink / raw)
  To: ml

[-- Attachment #1: Type: text/plain, Size: 287 bytes --]

New comment by q66 on void-packages repository

https://github.com/void-linux/void-packages/pull/31961#issuecomment-879957588

Comment:
this is something for @void-linux/pkg-committers 

personally I'm fine with just dropping it, otoh it's easy to miss when removing orphans, so dunno

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: iproute2: move usr/bin/tc to -tc-ipt subpackage
  2021-07-14 14:41 [PR PATCH] iproute2: move usr/bin/tc to -tc-ipt subpackage jirutka
  2021-07-14 14:48 ` q66
@ 2021-11-24 16:28 ` leahneukirchen
  2021-11-24 16:34 ` leahneukirchen
                   ` (3 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: leahneukirchen @ 2021-11-24 16:28 UTC (permalink / raw)
  To: ml

[-- Attachment #1: Type: text/plain, Size: 240 bytes --]

New comment by leahneukirchen on void-packages repository

https://github.com/void-linux/void-packages/pull/31961#issuecomment-978035350

Comment:
Then let's do this properly and also move:

```
/usr/share/man/man8/tc*
/usr/lib/tc
```

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: iproute2: move usr/bin/tc to -tc-ipt subpackage
  2021-07-14 14:41 [PR PATCH] iproute2: move usr/bin/tc to -tc-ipt subpackage jirutka
  2021-07-14 14:48 ` q66
  2021-11-24 16:28 ` leahneukirchen
@ 2021-11-24 16:34 ` leahneukirchen
  2022-05-26  2:13 ` github-actions
                   ` (2 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: leahneukirchen @ 2021-11-24 16:34 UTC (permalink / raw)
  To: ml

[-- Attachment #1: Type: text/plain, Size: 204 bytes --]

New comment by leahneukirchen on void-packages repository

https://github.com/void-linux/void-packages/pull/31961#issuecomment-978040694

Comment:
I wonder what would really break with TC_CONFIG_NO_XT...

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: iproute2: move usr/bin/tc to -tc-ipt subpackage
  2021-07-14 14:41 [PR PATCH] iproute2: move usr/bin/tc to -tc-ipt subpackage jirutka
                   ` (2 preceding siblings ...)
  2021-11-24 16:34 ` leahneukirchen
@ 2022-05-26  2:13 ` github-actions
  2022-06-10  2:13 ` [PR PATCH] [Closed]: " github-actions
  2023-05-31 16:23 ` charwhee
  5 siblings, 0 replies; 7+ messages in thread
From: github-actions @ 2022-05-26  2:13 UTC (permalink / raw)
  To: ml

[-- Attachment #1: Type: text/plain, Size: 305 bytes --]

New comment by github-actions[bot] on void-packages repository

https://github.com/void-linux/void-packages/pull/31961#issuecomment-1138069572

Comment:
Pull Requests become stale 90 days after last activity and are closed 14 days after that.  If this pull request is still relevant bump it or assign it.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PR PATCH] [Closed]: iproute2: move usr/bin/tc to -tc-ipt subpackage
  2021-07-14 14:41 [PR PATCH] iproute2: move usr/bin/tc to -tc-ipt subpackage jirutka
                   ` (3 preceding siblings ...)
  2022-05-26  2:13 ` github-actions
@ 2022-06-10  2:13 ` github-actions
  2023-05-31 16:23 ` charwhee
  5 siblings, 0 replies; 7+ messages in thread
From: github-actions @ 2022-06-10  2:13 UTC (permalink / raw)
  To: ml

[-- Attachment #1: Type: text/plain, Size: 2062 bytes --]

There's a closed pull request on the void-packages repository

iproute2: move usr/bin/tc to -tc-ipt subpackage
https://github.com/void-linux/void-packages/pull/31961

Description:
/usr/bin/tc is used to configure Traffic Control, it should be part of existing iproute2-tc-ipt subpackage.

The primary motivation to move /usr/bin/tc into subpackage is to remove dependency on iptables package in iproute2, and transitively from base-system. Users who use nftables instead of legacy iptables would not have to blacklist iptables package anymore.

**IMPORTANT**: base-system doesn’t directly depend on iptables, but it depends on iproute2, so iptables is installed by default. It’s described in the [Firewalls documentation](https://docs.voidlinux.org/config/network/firewalls.html):

> By default, the iptables package is installed on the base system. It provides iptables(8)/ip6tables(8). The related services use the /etc/iptables/iptables.rules and /etc/iptables/ip6tables.rules ruleset files, which must be created by the system administrator.

I think that pulling iptables with the base-system by default is wrong. nftables is clearly superior and should be preferred on new installations. I don’t mean that it should be forced, just that iptables should not be the default. Since base-system is supposed to contain really just a base system (there’s not even a cron or syslog included), I think that it should not directly depend on iptables nor nftables.

However, many users probably rely on iptables being installed as transitive dependency of base-system, so effectively removing it from the dependency graph may cause troubles.

What can we do?

a) Inform users about the change, e.g. in post-upgrade message?
a.1) Can we automatically mark iptables as explicit dependency via hook when upgrading iproute2?
b) Add dependency on iptables to the base-system package (lowest effort).
c) Maybe create a virtual _firewall_ and make base-system depend on it? However, I don’t know yet how this works in xbps.
d) …?

/cc @q66 

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: iproute2: move usr/bin/tc to -tc-ipt subpackage
  2021-07-14 14:41 [PR PATCH] iproute2: move usr/bin/tc to -tc-ipt subpackage jirutka
                   ` (4 preceding siblings ...)
  2022-06-10  2:13 ` [PR PATCH] [Closed]: " github-actions
@ 2023-05-31 16:23 ` charwhee
  5 siblings, 0 replies; 7+ messages in thread
From: charwhee @ 2023-05-31 16:23 UTC (permalink / raw)
  To: ml

[-- Attachment #1: Type: text/plain, Size: 488 bytes --]

New comment by charwhee on void-packages repository

https://github.com/void-linux/void-packages/pull/31961#issuecomment-1570541626

Comment:
I cannot comment on the suggestion to move tc, however I agree with @jirutka's original suggestion that iptables should not be installed as a dependency for iproute2 and further that nftables be made the default.
The easiest solution is to install iptables-nft when adding nftables so that any iptables routing rules will continue to function. 

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2023-05-31 16:23 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-14 14:41 [PR PATCH] iproute2: move usr/bin/tc to -tc-ipt subpackage jirutka
2021-07-14 14:48 ` q66
2021-11-24 16:28 ` leahneukirchen
2021-11-24 16:34 ` leahneukirchen
2022-05-26  2:13 ` github-actions
2022-06-10  2:13 ` [PR PATCH] [Closed]: " github-actions
2023-05-31 16:23 ` charwhee

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).