[Koha-devel] Adopting CPAN and Carton

[Victor Grousset/tuxayo]

Hi o/

On 20-06-05 02:18, dcook at prosentient.com.au wrote:
> What are people’s thoughts on CPAN and Carton (the Perl version of
> Bundler, Composer, NPM, etc)?

I hope that something like that would be on our reach. And that it will
make the majority of the work done to support other Linux distributions,
which would be amazing!

> I like the idea as a way of more easily managing Perl dependencies
> regardless of Linux distribution and version; in other words, we could
> provide the same dependencies regardless of being on Debian
> Jessie/Debian Stretch/Debian Buster or Ubuntu or Fedora or RHEL or OpenSUSE.
> 
>  
> 
> I suppose the difficulty is how we do a community-friendly deployment? I
> see two main options:
> 
>  1. Have the Debian package run “carton install” automatically during
>     install/upgrade
>      1. This could be error prone and difficult to support…
>  2. Have the Koha Debian Package Manager run “carton install” when
>     building the package, and embed the Perl modules in the Koha package
>      1. It’s unknown how much this would increase the size of the Koha
>         package

Interesting, I hope such an unified way will be possible.
If not, is the following a valid option?
The current way of managing the perl dependencies for Debian doesn't change.
And a carton way of managing the perl dependencies will coexist. (does
it mean just maintaining the cpanfile? I guess I'm very very wrong here)
And packages for the other distros will use carton.

It would depend of which is more work:
Integrating and maintaining the use of carton in the Debian packages
Or
Maintaining the "full" Debian packages in parallel.

And also how much is valued the fact that for Debian, the perl deps
comes from the repo? (we could keep the versions in sync with Debian,
see [1])
Subparts of this:
- value of Debian patches
- anything else???


> I think retaining Debian packages is important, because we have a number
> of non-Perl dependencies, and the Debian packages provide a lot of very
> useful automation.

Thank for addressing the question of "If we can use Carton, why have
packages at all?"
I trust you and the others for that ^^" I have no idea of whether or not
packages are the best option compared to others. Does anyone have
feedback about the handling of applications with a lot of deps in other
languages than Perl? (that have something similar to Carton)



> Personally, I’m moving away from packaging Perl dependencies as Debian
> packages for non-Koha projects, because it makes porting the projects to
> a newer version of the same OS much more difficult.

> I know using Debian’s Perl packages have a lot of advantages, as they’re
> tested, reviewed, and patched, but I think it might be time to consider
> a change.

[1]The cpanfile could still evolve in sync with the Debian package
versions of the perl libs.
That doesn't address the point "patched" => are there a lot of patched
perl packages in Debian?
i.e. enough so that even getting the same versions (as the one in Debian
stable or oldstable) from CPAN will lead to issues compared to getting
them from the Debian packages?



Unrelated idea: if we end up not using the Debian perl packages and not
syncing the versions pulled from CPAN with those in Debian, here is how
we could manage perl deps.
We could have a script that would edit the cpanfile to bump the major
version of one package. Or set it to the latest version.
And run the tests. And if the tests are alright, keep the new package
version and try updating the next package.
This way (hopefully) most of the update work of perl deps would be done.
Edge cases will be dealt with manually.

Even if we don't directly need it, it could be a nice tool to detect
regressions in our upstream deps way before they fall on us!

Cheers,

-- 
Victor Grousset/tuxayo