73
Void Linux maintainer orphans 100+ packages over AI policy dispute (www.phoronix.com)
submitted 2 weeks ago* (last edited 2 weeks ago) by to c/linux@lemmy.ml
24 comments fedilink hide all child comments
 

Cited from the article:

[...] the Void Linux project does have a contributing policy over AI usage that reads:

"In this section, "AI" refers to generative artificial intelligence tools, including Large Language Models and similar technologies.

All contributions are expected to be made by humans. AI tools may be used for research and learning, but all content in contributions must originate from and be understood by the contributor. This includes code, documentation, issues, security reports, pull request descriptions, and comments in all Void Linux community spaces.

ALL usage of AI tools MUST be disclosed.

Do not bring AI review tools into pull requests.

Usage of AI-powered human-language translation tools is acceptable to facilitate contributions across language barriers."

(Link to full text of the policy.)

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 15 points 2 weeks ago* (last edited 2 weeks ago) (3 children)

AI or not, I refuse to believe anyone is capable of being the sole maintainer of 100+ anything while preserving any kind of quality. Most of these packages were probably functionally abandoned already, if not technically.

He/She was maintainer of the Void Linux packages, that is the package build scripts, updates, etc., not the projects and source code which these packages are based on.

For example, Guix has now over 32000 packages, including an Emacs package. But of course, they did not re-create Emacs to make that package - they just made a build definition which uses the Emacs git repo, in order to build the Guix package. Or in the case of Ubuntu, it is based on the package definitions in Debian testing, so the Ubuntu maintainers do not have to write all the build scripts or package definitions - but they still have to do significant work in order to adapt them that everything fits together.

Or with Arch Linux, the packages are taken relatively vanilla from upstream, they package stuff more "as is" as compared to Debian. Which means less work, and often more clarity for experienced users.

Coming back to Void Linux, this means for these 100+ Void Linux packages which are currently orphaned, it is feasible that other people with good Linux experience adopt these, with a reasonable effort - some are important.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 6 points 2 weeks ago (2 children)

    Distro package maintainers are different than software dev maintainers.

    They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that)

    Cause like I can write a ton of guix configs that'll probably run until the next ice age, but that does nothing about the dev who's software I packaged, that now decided they're personally god and need to spread christ as fast as possible.

    (Also off topic but that's the power and curse of nixos-like distros, its too easy to package so odds are the shit ain't updated, and suddenly there's 1000 Firefox packages in nixpkgs)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 3 points 2 weeks ago* (1 child)

    They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that)

    Some people do an astounding amount of work.

    And then there are many, many, which help a little.

    Also, if, say, somebody finds that in Debian testing is a malicious package, people which maintain Arch will learn that. Open information sharing between many thousands of people willing to coordinate is a superpower.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 weeks ago

    Oh god yeah, its just filtering through the slop that actually matters.

    But like the XZ trojan that was only affecting Debian installs, each distro needs to individually have competent maintainers to ensure their store is safe.

    If for exapmle I set a couple 'bugfixes' in the guix package file for emacs, I could reasonably infect a number of systems if a lazy maintainer just approved the request. (Or other attacks without even involving guix if I notied a bug in a package spelling and typo squatted it, or stole signing keys and pushed updates to the repo myself).

    None of these would change anything to other distros maintainers, but because this distros AI maintainer could risk a large number of users devices.

  • permalink
  • fedilink
  • source
  • parent