One of my packages, the Linux kernel's userland support tools for the Network Block Device was chosen by Ubuntu developers to be part of their 'main'. For those not very comfortable with Ubuntu: the "main" part is their idea of "this is what we support". Everything in main is free software and supported; things that are still free software but are not supported yet, are moved to their "universe" instead. Most Debian packages live in Ubuntu's "universe"; only the desktop environments that they support and their dependencies are part of Ubuntu's "main" section. Occasionally, I was told that the nbd source packages were moved to main because ltsp declares a Depends: relationship on them, and it was decided that the ltsp packages should be part of main.
Personally, I don't use Ubuntu (though I've installed it a few times in the past, being the curious software geek that I am). As such, I don't really follow their development very closely, being more focused on Debian unstable instead. This would normally not be a problem, except that I do care that my packages are in a good state when they are released by someone, whether that someone is Debian, Ubuntu, or anyone else.
What triggers this post is the fact that Ubuntu has shipped Dapper with nbd 1:2.8.3-1, with a context of this changelog entry:
nbd (1:2.8.3-2) unstable; urgency=low * Steal patch from CVS for nbd-server.c to make children exit when they finish serving, rather than having them loop over "Help, I can't accept() anymore!". Closes: #350357. -- Wouter Verhelst <email@example.com> Tue, 31 Jan 2006 11:17:25 +0100
#350357 is a bug of severity important, and rightly so. From the bug report:
Jan 28 14:42:58 caradoc last message repeated 1190456 times Jan 28 14:43:59 caradoc last message repeated 2478818 times
An infinite loop producing an error message, a bug which triggers when a client disconnects. Have two clients connect, then disconnect, and you have a syslog being filled up with spurious error messages, filling your entire disk in a few hours or days.
It may be too late to update dapper now; however, had I been asked after #350357 was filed whether it would be a good idea to ship with this specific version of nbd, I would have said "no", and this horribly buggy version of nbd wouldn't be in a released version of Ubuntu. And since #350357 was filed a few days before the above log entry, in January, I cannot believe that it would've been too late.
Of course, if anyone from Ubuntu is reading this and can tell me that yes, it is still possible to update nbd in Dapper, then by all means, please do so. Oh, and don't forget to update edgy while you're at it :-)
That being said, I'm hoping something can be done to avoid this kind of SNAFUs from occurring again. Ubuntu could talk to me for those packages they care about, which (according to their policy and the status of nbd in their distribution) includes nbd. As it is, Ubuntu is just a large institution that happens to redistribute parts of Debian. I'm getting more feedback from the guy doin the 'nbd-server' port in FreeBSD than I'm getting from Ubuntu—and that FreeBSD guy only once or twice sent me an email...