Debian Bug report logs - #32263
[PENDING AMENDMENT 20/01/2000] Splitting cgi-bin

version graph

Package: debian-policy; Maintainer for debian-policy is Debian Policy Editors <debian-policy@lists.debian.org>; Source for debian-policy is src:debian-policy (PTS, buildd, popcon).

Reported by: Brian White <bcwhite@pobox.com>

Date: Fri, 22 Jan 1999 04:03:00 UTC

Severity: normal

Fixed in version debian-policy/3.7.0.0

Done: Manoj Srivastava <srivasta@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Johnie Ingram <johnie@debian.org>:
Bug#32263; Package apache. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
New bug report received and forwarded. Copy sent to Johnie Ingram <johnie@debian.org>. (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Debian Bugs <submit@bugs.debian.org>
Subject: Unexpected use of /cgi-bin/
Date: Thu, 21 Jan 1999 23:00:33 -0500
Package: apache
Version: 1.3.3-4

As there were really no objections to the personal mail I sent about this,
I'm filing it as a bug...

Most people setting up a web site expect /cgi-bin/ to be available for
scripts on their site.  Unfortunately, Debian uses this for those scripts
packages that get installed.  These two need to be independant.

As such, Debian's system needs to be altered a bit.  I recommend using
instead the name "/cgi-lib/" for scripts under /usr/lib/cgi-bin/.  This
will keep both features independant and not affect the general use of
the system.

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
      You can never be too good looking or too well equipped.  -- Dilbert


Bug reassigned from package `apache' to `debian-policy'. Request was from Johnie Ingram <johnie@netgod.net> to control@bugs.debian.org. (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Martin Schulze <joey@infodrom.north.de>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #12 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@finlandia.Infodrom.North.DE>
To: Brian White <bcwhite@pobox.com>, 32263@bugs.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 10:34:40 +0100
Brian White wrote:
> Package: apache
> Version: 1.3.3-4

> Most people setting up a web site expect /cgi-bin/ to be available for
> scripts on their site.  Unfortunately, Debian uses this for those scripts
> packages that get installed.  These two need to be independant.

I don't seem to understand your intention.  Why to you want to separate
the /cgi-bin/ directory Debian uses for scripts from the une the webmaster
uses?  They fit together just fine.

> As such, Debian's system needs to be altered a bit.  I recommend using
> instead the name "/cgi-lib/" for scripts under /usr/lib/cgi-bin/.  This
> will keep both features independant and not affect the general use of
> the system.

If you file this as bug agains Apache you need to file it against all other
httpd's that support cgi-bin as well.  Thus I assume that you need to modify
policy first.

Regards,

	Joey

-- 
*** Fatal Error: Found [MS-Windows], repartitioning Disk for Linux ...

Please always Cc to me when replying to me on the lists.


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Jules Bean <jmlb2@hermes.cam.ac.uk>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #17 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Jules Bean <jmlb2@hermes.cam.ac.uk>
To: Martin Schulze <joey@infodrom.north.de>, 32263@bugs.debian.org
Cc: Brian White <bcwhite@pobox.com>, Martin Schulze <joey@finlandia.Infodrom.North.DE>
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 12:34:42 +0000 (GMT)
On Fri, 22 Jan 1999, Martin Schulze wrote:

> Brian White wrote:
> > Package: apache
> > Version: 1.3.3-4
> 
> > Most people setting up a web site expect /cgi-bin/ to be available for
> > scripts on their site.  Unfortunately, Debian uses this for those scripts
> > packages that get installed.  These two need to be independant.
> 
> I don't seem to understand your intention.  Why to you want to separate
> the /cgi-bin/ directory Debian uses for scripts from the une the webmaster
> uses?  They fit together just fine.

Presumably for the same reason we separate /usr/bin from /usr/local/bin.

> 
> > As such, Debian's system needs to be altered a bit.  I recommend using
> > instead the name "/cgi-lib/" for scripts under /usr/lib/cgi-bin/.  This
> > will keep both features independant and not affect the general use of
> > the system.
> 
> If you file this as bug agains Apache you need to file it against all other
> httpd's that support cgi-bin as well.  Thus I assume that you need to modify
> policy first.

It has been reassigned to policy now, in fact.

Jules

/----------------+-------------------------------+---------------------\
|  Jelibean aka  | jules@jellybean.co.uk         |  6 Evelyn Rd	       |
|  Jules aka     | jules@debian.org              |  Richmond, Surrey   |
|  Julian Bean   | jmlb2@hermes.cam.ac.uk        |  TW9 2TF *UK*       |
+----------------+-------------------------------+---------------------+
|  War doesn't demonstrate who's right... just who's left.             |
|  When privacy is outlawed... only the outlaws have privacy.          |
\----------------------------------------------------------------------/



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Ben Collins <bmc@visi.net>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #22 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Ben Collins <bmc@visi.net>
To: Martin Schulze <joey@infodrom.north.de>, 32263@bugs.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 07:33:58 -0500
On Fri, Jan 22, 1999 at 10:34:40AM +0100, Martin Schulze wrote:
> Brian White wrote:
> > Package: apache
> > Version: 1.3.3-4
>
> > Most people setting up a web site expect /cgi-bin/ to be available for
> > scripts on their site.  Unfortunately, Debian uses this for those scripts
> > packages that get installed.  These two need to be independant.
>
> I don't seem to understand your intention.  Why to you want to separate
> the /cgi-bin/ directory Debian uses for scripts from the une the webmaster
> uses?  They fit together just fine.

I use /usr/lib/cgi-bin just fine with the rest of my scripts, I would
object to it being changed to cgi-lib since it requires me to maintain
two cgi directories and makes the system more fragmented.

--
-----    -- - -------- --------- ----  -------  -----  - - ---   --------
Ben Collins <b.m.collins@larc.nasa.gov>                  Debian GNU/Linux
UnixGroup Admin - Jordan Systems Inc.                 bcollins@debian.org
------ -- ----- - - -------   ------- -- The Choice of the GNU Generation


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #27 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Martin Schulze <joey@infodrom.north.de>
Cc: 32263@bugs.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 09:36:01 -0500
> > Most people setting up a web site expect /cgi-bin/ to be available for
> > scripts on their site.  Unfortunately, Debian uses this for those scripts
> > packages that get installed.  These two need to be independant.
> 
> I don't seem to understand your intention.  Why to you want to separate
> the /cgi-bin/ directory Debian uses for scripts from the une the webmaster
> uses?  They fit together just fine.

I don't want a separate directory for Debian to use.  I would like the
standard directory available for the webmaster to use.  Think of
/cgi-lib/ as an equivalent to /usr/lib/ or /usr/bin/, and /cgi-bin/ as
an equivalent to /usr/local/bin/.


> > As such, Debian's system needs to be altered a bit.  I recommend using
> > instead the name "/cgi-lib/" for scripts under /usr/lib/cgi-bin/.  This
> > will keep both features independant and not affect the general use of
> > the system.
> 
> If you file this as bug agains Apache you need to file it against all other
> httpd's that support cgi-bin as well.  Thus I assume that you need to modify
> policy first.

I figured I'd start with the big one and then work my way around.  However,
somebody has reassign the bug to debian-policy since it is official Debian
policy to do it the way it is.  I wish somebody had told me that when I
originally sent mail around asking for opinions about this idea.

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
      Management should work for the engineers, not the other way around.


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Martin Schulze <joey@infodrom.north.de>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #32 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Martin Schulze <joey@tapiola.Infodrom.North.DE>
To: Brian White <bcwhite@pobox.com>
Cc: 32263@bugs.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 15:59:48 +0100
Brian White wrote:
> > If you file this as bug agains Apache you need to file it against all other
> > httpd's that support cgi-bin as well.  Thus I assume that you need to modify
> > policy first.
> 
> I figured I'd start with the big one and then work my way around.  However,
> somebody has reassign the bug to debian-policy since it is official Debian
> policy to do it the way it is.  I wish somebody had told me that when I
> originally sent mail around asking for opinions about this idea.

I'm sorry but I didn't see it - and I still don't see its benefits.  Now it's
up to the policy group anyway.

Regards,

	Joey

-- 
*** Fatal Error: Found [MS-Windows], repartitioning Disk for Linux ...

Please always Cc to me when replying to me on the lists.


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Jules Bean <jmlb2@hermes.cam.ac.uk>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #37 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Jules Bean <jmlb2@hermes.cam.ac.uk>
To: Martin Schulze <joey@infodrom.north.de>, 32263@bugs.debian.org
Cc: Brian White <bcwhite@pobox.com>
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 16:02:43 +0000 (GMT)
On Fri, 22 Jan 1999, Martin Schulze wrote:

> Brian White wrote:
> > > If you file this as bug agains Apache you need to file it against all other
> > > httpd's that support cgi-bin as well.  Thus I assume that you need to modify
> > > policy first.
> > 
> > I figured I'd start with the big one and then work my way around.  However,
> > somebody has reassign the bug to debian-policy since it is official Debian
> > policy to do it the way it is.  I wish somebody had told me that when I
> > originally sent mail around asking for opinions about this idea.
> 
> I'm sorry but I didn't see it - and I still don't see its benefits.  Now it's
> up to the policy group anyway.

Do you see the benefits of having the package system control /usr/bin, and
the local admin putting his programs into /usr/local/bin?

The benefits are analogous.

Jules

/----------------+-------------------------------+---------------------\
|  Jelibean aka  | jules@jellybean.co.uk         |  6 Evelyn Rd	       |
|  Jules aka     | jules@debian.org              |  Richmond, Surrey   |
|  Julian Bean   | jmlb2@hermes.cam.ac.uk        |  TW9 2TF *UK*       |
+----------------+-------------------------------+---------------------+
|  War doesn't demonstrate who's right... just who's left.             |
|  When privacy is outlawed... only the outlaws have privacy.          |
\----------------------------------------------------------------------/



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to miquels@cistron.nl (Miquel van Smoorenburg):
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #42 received at submit@bugs.debian.org (full text, mbox, reply):

From: miquels@cistron.nl (Miquel van Smoorenburg)
To: submit@bugs.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: 22 Jan 1999 18:17:22 +0100
In article <cistron.36A88CD1.9A9ADF47@pobox.com>,
Brian White  <bcwhite@pobox.com> wrote:
>I don't want a separate directory for Debian to use.  I would like the
>standard directory available for the webmaster to use.  Think of
>/cgi-lib/ as an equivalent to /usr/lib/ or /usr/bin/, and /cgi-bin/ as
>an equivalent to /usr/local/bin/.

I agree completely.

I'd prefer the following:

/debian-cgi-bin   instead of /cgi-bin
/debian-doc       instead of /doc

The general "Alias /doc/ /usr/doc/" in srm.conf also causes a lot
of trouble if you (or one of the vhost customers) has an existing
/doc directory ...

Mike.
-- 
Indifference will certainly be the downfall of mankind, but who cares?


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #45 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Ben Collins <bmc@it.larc.nasa.gov>, 32263-quiet@bugs.debian.org
Cc: Jules Bean <jmlb2@hermes.cam.ac.uk>, Martin Schulze <joey@infodrom.north.de>, debian-policy@lists.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 19:35:55 -0500
> I don't see this pertaining to cgi's. With the /usr/local convention it
> doesn't require any extra effort to use the programs (just add
> /usr/local/bin to PATH) but with a cgi-bin/cgi-lib seperation you will
> have to make two distinct calls to different URL's in order to call Debian
> cgi's and locally installed cgi's.

There are still problems.  If we assume that the local admin is not
putting his personal cgi scripts in /usr/lib/cgi-bin, then in order
to his scripts to work, he must either

 1) go against popular convention and create some new /cgi-local/ ScriptAlias
 2) move /cgi-bin/ to point to /home/www/cgi-bin/ and make symlinks
 3) add a "local" symlink under /usr/lib/cgi-bin to point to /home/www/cgi-bin

Both of these choices are bad.

 1) people like things in standard places -- web standard is /cgi-bin/
 2) package installs or removals don't update these links
 3) administrators have to hack to get what should come naturally


If apache and other web servers were to ScriptAlias /cgi-lib/ and
/cgi-bin/ seperately, the they could be enabled/disabled independantly
and without having to worry about installations, removals, config
updates, and other automated processes.


> On top of that, switching our cgi programs will break _a lot_ of ppl's
> systems. Can you imagine the unwary admin who upgrades to this system on a
> production webserver only to have php3-cgi move on him and severely break
> the system?

I really doubt that it will break "a lot" of systems...

What will break most is packages that use /usr/lib/cgi-bin, and they can
be fixed before the next release of Debian so as to make the entire
transition appear seamless.

Serious web hosts have probably already changed /cgi-bin/ to point to the
correct place, thus abandoning the Debian scripts.  These people will not
be affected since we're only changing our system to match what they've
already done.

People who added another ScriptAlias are unlikely to have chosen /cgi-lib/.
These people will not be affected as we won't be changing their configuration,
though we may add a second ScriptAlias to /home/www/cgi-bin -- no harm done.

People that have kludged their system by adding a "local" symlink to
/usr/lib/cgi-bin -> /home/www/cgi-bin (thus accessing local scripts
as /cgi-bin/local/) will be affected, but it was a hack when it was
installed and so is unlikely to be hard-coded in many places.

I'd say only a small percentage of webmasters fall under this last case and
thus would be affected in any negative way.

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
      Management should work for the engineers, not the other way around.


Acknowledgement sent to Ben Collins <bmc@visi.net>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #48 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Ben Collins <bmc@visi.net>
To: Brian White <bcwhite@pobox.com>
Cc: Ben Collins <bmc@it.larc.nasa.gov>, 32263-quiet@bugs.debian.org, Jules Bean <jmlb2@hermes.cam.ac.uk>, Martin Schulze <joey@infodrom.north.de>, debian-policy@lists.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 19:54:43 -0500
On Fri, Jan 22, 1999 at 07:35:55PM -0500, Brian White wrote:
> I really doubt that it will break "a lot" of systems...
>
> What will break most is packages that use /usr/lib/cgi-bin, and they can
> be fixed before the next release of Debian so as to make the entire
> transition appear seamless.

Sure, the scripts will move and they will still work in and of
themselves, but what about all the hard links from webpages on their
site to scripts in /cgi-bin that are debian cgi scripts installed by
packages. If we suddenly change it to /cgi-lib then links to all the
debian installed cgi's are now broke.

Yes, I have linked /home/www/cgi-bin to /usr/lib/cgi-bin for mere
convenience, but I keep all of my scripts, debian and custom, in
/usr/lib/cgi-bin. Any web master would want to keep _all_ of his/her
cgi's in one place for the sake of simplicity. Most sites don't have
more than 10 scripts, and the ones that do probably have completely
bypassed the entire setup from debian and configured their own custom
layout any way, so our 'fix' is of little use to them.

--
-----    -- - -------- --------- ----  -------  -----  - - ---   --------
Ben Collins <b.m.collins@larc.nasa.gov>                  Debian GNU/Linux
UnixGroup Admin - Jordan Systems Inc.                 bcollins@debian.org
------ -- ----- - - -------   ------- -- The Choice of the GNU Generation


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #51 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Ben Collins <bmc@visi.net>
Cc: Ben Collins <bmc@it.larc.nasa.gov>, 32263-quiet@bugs.debian.org, Jules Bean <jmlb2@hermes.cam.ac.uk>, Martin Schulze <joey@infodrom.north.de>, debian-policy@lists.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 21:17:17 -0500
> > What will break most is packages that use /usr/lib/cgi-bin, and they can
> > be fixed before the next release of Debian so as to make the entire
> > transition appear seamless.
> 
> Sure, the scripts will move and they will still work in and of
> themselves, but what about all the hard links from webpages on their
> site to scripts in /cgi-bin that are debian cgi scripts installed by
> packages. If we suddenly change it to /cgi-lib then links to all the
> debian installed cgi's are now broke.

If it has been coded as this, fixing it is trivial...  Place symlinks
in the new /cgi-bin/ (assuming that isn't how it has already been done)
to the scripts in /usr/lib/cgi-bin.  You could even ask to do this
during the upgrade procedure of apache.


> Yes, I have linked /home/www/cgi-bin to /usr/lib/cgi-bin for mere
> convenience, but I keep all of my scripts, debian and custom, in
> /usr/lib/cgi-bin. Any web master would want to keep _all_ of his/her
> cgi's in one place for the sake of simplicity. Most sites don't have
> more than 10 scripts, and the ones that do probably have completely
> bypassed the entire setup from debian and configured their own custom
> layout any way, so our 'fix' is of little use to them.

But that's part of it...  Cgi scripts added by packages are _not_ part
of "all of his/her cgi's".  They were installed by the system.

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
 Don't marry someone you can live with.  Marry someone you can't live without.


Acknowledgement sent to Ben Collins <bmc@visi.net>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #54 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Ben Collins <bmc@visi.net>
To: Brian White <bcwhite@pobox.com>
Cc: Ben Collins <bmc@it.larc.nasa.gov>, 32263-quiet@bugs.debian.org, Jules Bean <jmlb2@hermes.cam.ac.uk>, Martin Schulze <joey@infodrom.north.de>, debian-policy@lists.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 22:47:39 -0500
On Fri, Jan 22, 1999 at 09:17:17PM -0500, Brian White wrote:
> > > What will break most is packages that use /usr/lib/cgi-bin, and they can
> > > be fixed before the next release of Debian so as to make the entire
> > > transition appear seamless.
> >
> > Sure, the scripts will move and they will still work in and of
> > themselves, but what about all the hard links from webpages on their
> > site to scripts in /cgi-bin that are debian cgi scripts installed by
> > packages. If we suddenly change it to /cgi-lib then links to all the
> > debian installed cgi's are now broke.
>
> If it has been coded as this, fixing it is trivial...  Place symlinks
> in the new /cgi-bin/ (assuming that isn't how it has already been done)
> to the scripts in /usr/lib/cgi-bin.  You could even ask to do this
> during the upgrade procedure of apache.

Polluting their 'new' local /cgi-bin with links to /cgi-lib kind of
defeats the whole purpose doesn't it?

--
-----    -- - -------- --------- ----  -------  -----  - - ---   --------
Ben Collins <b.m.collins@larc.nasa.gov>                  Debian GNU/Linux
UnixGroup Admin - Jordan Systems Inc.                 bcollins@debian.org
------ -- ----- - - -------   ------- -- The Choice of the GNU Generation


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #57 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Ben Collins <bmc@visi.net>
Cc: Ben Collins <bmc@it.larc.nasa.gov>, 32263-quiet@bugs.debian.org, Jules Bean <jmlb2@hermes.cam.ac.uk>, Martin Schulze <joey@infodrom.north.de>, debian-policy@lists.debian.org
Subject: Re: Bug#32263: Unexpected use of /cgi-bin/
Date: Fri, 22 Jan 1999 23:00:36 -0500
> > > Sure, the scripts will move and they will still work in and of
> > > themselves, but what about all the hard links from webpages on their
> > > site to scripts in /cgi-bin that are debian cgi scripts installed by
> > > packages. If we suddenly change it to /cgi-lib then links to all the
> > > debian installed cgi's are now broke.
> >
> > If it has been coded as this, fixing it is trivial...  Place symlinks
> > in the new /cgi-bin/ (assuming that isn't how it has already been done)
> > to the scripts in /usr/lib/cgi-bin.  You could even ask to do this
> > during the upgrade procedure of apache.
> 
> Polluting their 'new' local /cgi-bin with links to /cgi-lib kind of
> defeats the whole purpose doesn't it?

Yes.  That's why I suggested the upgrade could offer to do such.  An
intelligent upgrade script could even offer only if it detects a need.

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
   If you love something, set it free.  If it comes back, it was, and always
     will be yours.  If it never returns, it was never yours to begin with.


Changed bug title. Request was from Julian Gilbey <J.D.Gilbey@qmw.ac.uk> to control@bugs.debian.org. (full text, mbox, link).


Severity set to `wishlist'. Request was from Julian Gilbey <J.D.Gilbey@qmw.ac.uk> to control@bugs.debian.org. (full text, mbox, link).


Changed bug title. Request was from Manoj Srivastava <srivasta@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Severity set to `fixed'. Request was from Manoj Srivastava <srivasta@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #70 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: 32263@bugs.debian.org
Subject: Re: Bug#32263: Split /cgi-bin/ into system and local parts
Date: Thu, 09 Sep 1999 08:17:46 -0400
Hi!

This was a change I proposed quite some time ago (not Johnie Ingram as
reported in the debian-policy logs).  It's status has been changed to
fixed (rejected), but I have been able to find no discussion of it either
on the bug report or in the debian-policy mailing list archives.  Would
somebody fill me in as to why it was rejected?  Thank you!

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
        We seldom regret doing things.  We often regret not doing them.


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Antti-Juhani Kaijanaho <gaia@iki.fi>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #75 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Antti-Juhani Kaijanaho <gaia@iki.fi>
To: Brian White <bcwhite@pobox.com>, 32263@bugs.debian.org
Subject: Re: Bug#32263: Split /cgi-bin/ into system and local parts
Date: Thu, 9 Sep 1999 16:46:23 +0300
On Thu, Sep 09, 1999 at 08:17:46AM -0400, Brian White wrote:
> on the bug report or in the debian-policy mailing list archives.  Would
> somebody fill me in as to why it was rejected?  Thank you!

Because nobody cared about this proposal enough to second it, I'd wager.

-- 
%%% Antti-Juhani Kaijanaho % gaia@iki.fi % http://www.iki.fi/gaia/ %%%

                                  ""
                             (John Cage)


Changed Bug title. Request was from Brian White <bcwhite@pobox.com> to control@bugs.debian.org. (full text, mbox, link).


Severity set to `wishlist'. Request was from Brian White <bcwhite@pobox.com> to control@bugs.debian.org. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #82 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: debian-policy@lists.debian.org
Cc: 32263-quiet@bugs.debian.org
Subject: Re: [PROPOSED] Split /cgi-bin/ into system and local parts
Date: Mon, 20 Sep 1999 10:33:55 -0400
I'd like to re-open discussion on a proposal I made some time ago.  The
current policy on the setting of "cgi-bin" tends to interfere with how most
webmasters set up their sites.  Most people setting up a web site expect /cgi-bin/ to be available for scripts on their site.  Unfortunately, Debian
uses this for those scripts packages that get installed.  These two need to
be independant.

As such, I think Debian's system should be altered a bit.  I recommend using
instead the name "/cgi-lib/" for scripts under /usr/lib/cgi-bin/.  This
will keep both features independant and not affect the general use of
the system.

More information about this as well as some potential problems and potential
solutions can be found in the history of this bug.

	http://www.debian.org/Bugs/db/32/32263.html

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
It's easier to go down the mountain than up, but the view is best from the top.


Acknowledgement sent to Raul Miller <raul@usatoday.com>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #85 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Raul Miller <raul@usatoday.com>
To: Brian White <bcwhite@pobox.com>
Cc: debian-policy@lists.debian.org, 32263-quiet@bugs.debian.org
Subject: Re: [PROPOSED] Split /cgi-bin/ into system and local parts
Date: Mon, 20 Sep 1999 13:39:38 -0400
On Mon, Sep 20, 1999 at 10:33:55AM -0400, Brian White wrote:
> As such, I think Debian's system should be altered a bit.  I recommend using
> instead the name "/cgi-lib/" for scripts under /usr/lib/cgi-bin/.  This
> will keep both features independant and not affect the general use of
> the system.
> 
> More information about this as well as some potential problems and potential
> solutions can be found in the history of this bug.
> 
> 	http://www.debian.org/Bugs/db/32/32263.html

I like this idea, but think that removing existing content from existing
cgi-bin directories is a bad idea.

I propose that we add cgi-lib (or perhaps it should be cgi-debian)
as a standard way to reference debian material, and that we also allow
existing systems to continue to use cgi-bin to refer to debian material.

For potato, I don't think it's ok to have anything not support the current
cgi-bin method -- but I could be convinced otherwise if someone came up
with an exhaustive list of affected packages and if the corresponding
package maintainers said that they could have this implemented and before
the feature freeze.

After potato, I think it's fine to drop cgi-bin as a way to reference
debian materials: but only on new systems or where the administrator
manually intervenes.

-- 
Raul


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #88 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Raul Miller <raul@usatoday.com>
Cc: debian-policy@lists.debian.org, 32263-quiet@bugs.debian.org
Subject: Re: [PROPOSED] Split /cgi-bin/ into system and local parts
Date: Mon, 20 Sep 1999 14:37:51 -0400
> > As such, I think Debian's system should be altered a bit.  I recommend using
> > instead the name "/cgi-lib/" for scripts under /usr/lib/cgi-bin/.  This
> > will keep both features independant and not affect the general use of
> > the system.
> >
> > More information about this as well as some potential problems and potential
> > solutions can be found in the history of this bug.
> >
> >       http://www.debian.org/Bugs/db/32/32263.html
> 
> I like this idea, but think that removing existing content from existing
> cgi-bin directories is a bad idea.

Unfortunately, I think you really have to.  Currently, cgi-bin is simply
mapped to /usr/lib/cgi-bin which means (since /usr is to be considered
read-only) than local admins can't add things under this standard location.
The best they can do is create their own directory and symlink everything
to that place.  This scheme will eventually fail as packages get added
and removed.

In the bug report, I proposed creating cgi-lib in /usr/lib/cgi-bin and
cgi-bin in ~www-data/cgi-bin.  Then, for compatibility with older packages,
symlink everything currently under cgi-lib to cgi-bin.  It's not perfect,
but would at least make the transition fairly smooth.


> After potato, I think it's fine to drop cgi-bin as a way to reference
> debian materials: but only on new systems or where the administrator
> manually intervenes.

I think it would be okay for a webserver installion script to detect the
old layout and prompt for "upgrade".

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
Seize the moment!  Live now.  Make "now" always the most important time. -- JLP


Message sent on to Brian White <bcwhite@pobox.com>:
Bug#32263. (full text, mbox, link).


Message #91 received at 32263-submitter@bugs.debian.org (full text, mbox, reply):

From: Julian Gilbey <J.D.Gilbey@qmw.ac.uk>
To: 43529-submitter@bugs.debian.org, 26995-submitter@bugs.debian.org, 33076-submitter@bugs.debian.org, 34610-submitter@bugs.debian.org, 35510-submitter@bugs.debian.org, 37254-submitter@bugs.debian.org, 39831-submitter@bugs.debian.org, 41829-submitter@bugs.debian.org, 41902-submitter@bugs.debian.org, 42052-submitter@bugs.debian.org, 42358-submitter@bugs.debian.org, 42477-submitter@bugs.debian.org, 42907-submitter@bugs.debian.org, 43483-submitter@bugs.debian.org, 43651-submitter@bugs.debian.org, 43724-submitter@bugs.debian.org, 43757-submitter@bugs.debian.org, 43928-submitter@bugs.debian.org, 44922-submitter@bugs.debian.org, 45318-submitter@bugs.debian.org, 46516-submitter@bugs.debian.org, 46522-submitter@bugs.debian.org, 47438-submitter@bugs.debian.org, 48045-submitter@bugs.debian.org, 13353-submitter@bugs.debian.org, 32263-submitter@bugs.debian.org, 37999-submitter@bugs.debian.org, 38703-submitter@bugs.debian.org, 39299-submitter@bugs.debian.org, 39398-submitter@bugs.debian.org, 39830-submitter@bugs.debian.org, 40742-submitter@bugs.debian.org, 40766-submitter@bugs.debian.org, 40767-submitter@bugs.debian.org, 40934-submitter@bugs.debian.org, 41113-submitter@bugs.debian.org, 41121-submitter@bugs.debian.org, 41729-submitter@bugs.debian.org, 42554-submitter@bugs.debian.org, 42870-submitter@bugs.debian.org, 43077-submitter@bugs.debian.org, 45307-submitter@bugs.debian.org, 45406-submitter@bugs.debian.org, 45561-submitter@bugs.debian.org, 48247-submitter@bugs.debian.org
Subject: Your policy proposal
Date: Tue, 26 Oct 1999 01:33:10 +0100 (BST)
You have submitted a proposed modification to the Debian Policy.  I
would be most grateful if you could check on the status of your
proposal (at http://www.debian.org/Bugs/db/pa/ldebian-policy.html) and
change the title/severity/forwarded status to indicate its present
status, in anticipation of a forthcoming policy revision.

Instructions on the scheme used can be found in
/usr/doc/debian-policy/proposal.text.gz if you are using a new policy
package, and if not, then check out
http://www.debian.org/~srivasta/policy/.

To change the status of a report in the BTS, email
control@bugs.debian.org with one or more lines like the following:
retitle 12345 [ACCEPTED 10/10/99] Allow foobar in section 9.9.9
forwarded 12345 debian-policy@lists.debian.org
severity 12345 normal

You can finish the list of commands with the line:
thanks

Thanks for the help!

   Julian

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

  Julian Gilbey, Dept of Maths, QMW, Univ. of London. J.D.Gilbey@qmw.ac.uk
        Debian GNU/Linux Developer,  see http://www.debian.org/~jdg


Severity set to `fixed'. Request was from Manoj Srivastava <srivasta@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Changed Bug title. Request was from Manoj Srivastava <srivasta@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Reply sent to Julian Gilbey <J.D.Gilbey@qmw.ac.uk>:
You have taken responsibility. (full text, mbox, link).


Notification sent to Brian White <bcwhite@pobox.com>:
Bug acknowledged by developer. (full text, mbox, link).


Message #100 received at 32263-done@bugs.debian.org (full text, mbox, reply):

From: Julian Gilbey <J.D.Gilbey@qmw.ac.uk>
To: 32263-done@bugs.debian.org
Subject: Bug#32263: [OLD PROPOSAL] Split /cgi-bin/ into system and local parts
Date: Wed, 21 Jun 2000 18:37:52 +0100
This proposal seems to have gathered dust and was never clearly
decided either way.  So I am closing it.

   Julian

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

  Julian Gilbey, Dept of Maths, QMW, Univ. of London. J.D.Gilbey@qmw.ac.uk
        Debian GNU/Linux Developer,  see http://www.debian.org/~jdg
  Donate free food to the world's hungry: see http://www.thehungersite.com/



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #105 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: 32263@bugs.debian.org, control@bugs.debian.org
Subject: Splitting cgi-bin
Date: Thu, 22 Jun 2000 22:09:39 -0400
reopen 32263
-- 

How about waiting just a bit longer?  I was going to try to start this
again when (if?) the release happens.  Numerous people have thought it
was a good idea, but there have been more important things on the plate.

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
             The best way to predict the future... is to create it.



Bug reopened, originator not changed. Request was from Brian White <bcwhite@pobox.com> to control@bugs.debian.org. (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Julian Gilbey <J.D.Gilbey@qmw.ac.uk>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #112 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Julian Gilbey <J.D.Gilbey@qmw.ac.uk>
To: Brian White <bcwhite@pobox.com>, 32263@bugs.debian.org
Cc: control@bugs.debian.org
Subject: Re: Bug#32263: Splitting cgi-bin
Date: Fri, 23 Jun 2000 09:38:55 +0100
retitle 32263 [PROPOSAL] Splitting cgi-bin
thanks

On Thu, Jun 22, 2000 at 10:09:39PM -0400, Brian White wrote:
> reopen 32263
> -- 
> 
> How about waiting just a bit longer?  I was going to try to start this
> again when (if?) the release happens.  Numerous people have thought it
> was a good idea, but there have been more important things on the plate.

It's been nine months since anyone commented on the thread.
Let's say that we give it one month after potato's release to discuss,
otherwise we drop it for the time being.

   Julian

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

  Julian Gilbey, Dept of Maths, QMW, Univ. of London. J.D.Gilbey@qmw.ac.uk
        Debian GNU/Linux Developer,  see http://www.debian.org/~jdg
  Donate free food to the world's hungry: see http://www.thehungersite.com/



Changed Bug title. Request was from Julian Gilbey <J.D.Gilbey@qmw.ac.uk> to control@bugs.debian.org. (full text, mbox, link).


Severity set to `wishlist'. Request was from Julian Gilbey <J.D.Gilbey@qmw.ac.uk> to control@bugs.debian.org. (full text, mbox, link).


Severity set to `wishlist'. Request was from Julian Gilbey <J.D.Gilbey@qmw.ac.uk> to control@bugs.debian.org. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #121 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Anthony Towns <aj@azure.humbug.org.au>, 32263-quiet@bugs.debian.org
Cc: debian-policy@lists.debian.org
Subject: Re: Proposal: Splitting cgi-bin
Date: Fri, 03 Nov 2000 00:20:53 -0500
> On Thu, Nov 02, 2000 at 09:16:02AM -0500, Brian White wrote:
> > -----
> > Most people setting up a web site expect /cgi-bin/ to be available for
> > scripts on their site.  Unfortunately, Debian uses this for those scripts
> > packages that get installed.  These two need to be independant.
> >
> > As such, Debian's system needs to be altered a bit.  I recommend using
> > instead the name "/cgi-lib/" for scripts under /usr/lib/cgi-bin/.  This
> > will keep both features independant and not affect the general use of
> > the system.
> > -----
> 
> This seems sensible to me, could you give a patch to policy that
> can be actually included?

Sure.  Here's what I wrote up as a patch to "policy.sgml".

===============================================================================
--- policy.sgml.orig	Fri Nov  3 00:02:17 2000
+++ policy.sgml	Fri Nov  3 00:18:45 2000
@@ -2949,9 +2949,20 @@
 		</example>
 		and can be referred to as
 		<example>
-		  http://localhost/cgi-bin/&lt;cgi-bin-name&gt;
-		</example></p></item>
+		  http://localhost/cgi-lib/&lt;cgi-bin-name&gt;
+		</example></p>
 		
+	      <p>The purpose of using <tt>cgi-lib</tt> instead of
+	      <tt>cgi-bin</tt> is that most webmasters are used to having
+	      <tt>cgi-bin</tt> available for their own local use, much like
+	      <tt>/usr/local</tt>.  Having packages use <tt>cgi-lib</tt>
+	      means that no changes need to be made by the webmaster to both
+	      keep what they are used to and still have access to Debian
+	      packages.</p>
+
+	      <p>Web servers should include <tt>/cgi-lib/</tt> as a standard
+	      ScriptAlias of <tt>/usr/lib/cgi-bin/</tt>.</p></item>
+
 		
 	    <item><p>Access to html documents</p>
===============================================================================
	
                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
   A hundred years from now it will not matter what my bank account was, the
   sort of house I lived in, or the kind of can I drove...  But the world may
          be different because I was important in the life of a child.



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Anthony Towns <aj@azure.humbug.org.au>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #126 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Anthony Towns <aj@azure.humbug.org.au>
To: Brian White <bcwhite@pobox.com>
Cc: 32263@bugs.debian.org
Subject: Re: Proposal: Splitting cgi-bin
Date: Sat, 4 Nov 2000 08:52:32 +1000
[Message part 1 (text/plain, inline)]
On Fri, Nov 03, 2000 at 12:20:53AM -0500, Brian White wrote:
> --- policy.sgml.orig	Fri Nov  3 00:02:17 2000
> +++ policy.sgml	Fri Nov  3 00:18:45 2000
> @@ -2949,9 +2949,20 @@
>  		</example>
>  		and can be referred to as
>  		<example>
> -		  http://localhost/cgi-bin/&lt;cgi-bin-name&gt;
> -		</example></p></item>
> +		  http://localhost/cgi-lib/&lt;cgi-bin-name&gt;
> +		</example></p>
>  		
> +	      <p>The purpose of using <tt>cgi-lib</tt> instead of
> +	      <tt>cgi-bin</tt> is that most webmasters are used to having
> +	      <tt>cgi-bin</tt> available for their own local use, much like
> +	      <tt>/usr/local</tt>.  Having packages use <tt>cgi-lib</tt>
> +	      means that no changes need to be made by the webmaster to both
> +	      keep what they are used to and still have access to Debian
> +	      packages.</p>
> +
> +	      <p>Web servers should include <tt>/cgi-lib/</tt> as a standard
> +	      ScriptAlias of <tt>/usr/lib/cgi-bin/</tt>.</p></item>
> +
>  		
>  	    <item><p>Access to html documents</p>

Seconded, then.

Cheers,
aj

-- 
Anthony Towns <aj@humbug.org.au> <http://azure.humbug.org.au/~aj/>
I don't speak for anyone save myself. GPG signed mail preferred.

  ``We reject: kings, presidents, and voting.
                 We believe in: rough consensus and working code.''
                                      -- Dave Clark
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Josip Rodin <joy@cibalia.gkvk.hr>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #131 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Josip Rodin <joy@cibalia.gkvk.hr>
To: Brian White <bcwhite@pobox.com>
Cc: 32263@bugs.debian.org
Subject: Re: Proposal: Splitting cgi-bin
Date: Sat, 4 Nov 2000 00:52:11 +0100
On Fri, Nov 03, 2000 at 12:20:53AM -0500, Brian White wrote:
> Here's what I wrote up as a patch to "policy.sgml".
> 
> ===============================================================================
> --- policy.sgml.orig	Fri Nov  3 00:02:17 2000
> +++ policy.sgml	Fri Nov  3 00:18:45 2000
> @@ -2949,9 +2949,20 @@
>  		</example>
>  		and can be referred to as
>  		<example>
> -		  http://localhost/cgi-bin/&lt;cgi-bin-name&gt;
> -		</example></p></item>
> +		  http://localhost/cgi-lib/&lt;cgi-bin-name&gt;
> +		</example></p>
>  		
> +	      <p>The purpose of using <tt>cgi-lib</tt> instead of
> +	      <tt>cgi-bin</tt> is that most webmasters are used to having
> +	      <tt>cgi-bin</tt> available for their own local use, much like
> +	      <tt>/usr/local</tt>.  Having packages use <tt>cgi-lib</tt>
> +	      means that no changes need to be made by the webmaster to both
> +	      keep what they are used to and still have access to Debian
> +	      packages.</p>
> +
> +	      <p>Web servers should include <tt>/cgi-lib/</tt> as a standard
> +	      ScriptAlias of <tt>/usr/lib/cgi-bin/</tt>.</p></item>
> +
>  		
>  	    <item><p>Access to html documents</p>
> ===============================================================================

Although the name cgi-lib is a moot point, I agree with the idea - seconded.

-- 
Digital Electronic Being Intended for Assassination and Nullification



Changed Bug title. Request was from Brian White <bcwhite@pobox.com> to control@bugs.debian.org. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #136 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Debian Policy <debian-policy@lists.debian.org>
Cc: 32263-quiet@bugs.debian.org, control@bugs.debian.org
Subject: Re: Proposal: Splitting cgi-bin
Date: Sat, 20 Jan 2001 11:48:30 -0500
retitle 32263 [AMENDMENT 20/01/2000] Splitting cgi-bin
severity normal
--

This this has now passed the first step of a policy change, I'm changing
the bug title and severity.  Sorry for the delay...  I hadn't realized
what I had to do.


> -----
> Most people setting up a web site expect /cgi-bin/ to be available for
> scripts on their site.  Unfortunately, Debian uses this for those scripts
> packages that get installed.  These two need to be independant.
> 
> As such, Debian's system needs to be altered a bit.  I recommend using
> instead the name "/cgi-lib/" for scripts under /usr/lib/cgi-bin/.  This
> will keep both features independant and not affect the general use of
> the system.
> -----
> 
> You can read all about it here:
> 
>         http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=32263

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
     Successful people do the things unsuccessful people don't want to do.



Severity set to `normal'. Request was from Brian White <bcwhite@pobox.com> to control@bugs.debian.org. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@debian.org>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #141 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: debian-policy@lists.debian.org
Cc: 32263-quiet@bugs.debian.org, Brian White <bcwhite@pobox.com>
Subject: Re: Proposal: Splitting cgi-bin
Date: 20 Jan 2001 20:52:39 -0600
>>"Brian" == Brian White <bcwhite@pobox.com> writes:

 Brian> This this has now passed the first step of a policy change,
 Brian> I'm changing the bug title and severity.  Sorry for the
 Brian> delay...  I hadn't realized what I had to do.

	The one problem I see with this proposal is that it does not
 put into place any transition strategy for either web servers, and
 packages that ptocide cgi-bin scripts. 

	In other words, if this policy change is accepted as stated,
 the following 50 packages would immediately become policy non
 conforming. 

	I suggest that the policy wording be changed to either make
 this a recommendation, for the moment, or the policy proposal be
 suspended until these packages have been given a chance to change.

	The best path may be to get the http server packages to add in
 the new script directory as an alias, and then put the change in
 policy as a recommendation, and, later, when most packages have had a
 chance to change, we can put into policy the current working.

	We need some one to take the lead on getting this conversion
 process underway; perhaps the sponsor of this proposal can do that?

	manoj

admin/nut-cgi
contrib/misc/webrt
contrib/web/wdg-html-validator
devel/cvsweb
devel/eperl
devel/gnatsweb
devel/jitterbug
devel/viewcvs
doc/dhelp
doc/dpkg-www
doc/dwww
doc/heise-register
doc/info2www
doc/man2html
doc/mh-book
interpreters/libdbix-cgi-perl
mail/listar-cgi
mail/mailman
net/cricket
net/gnudip
net/netsaint
net/spong-www
non-free/misc/frontbase
non-free/web/wwwcount
text/namazu,text/namazu2
utils/apcupsd
utils/uprecords-cgi
web/analog
web/bk2site
web/catalog
web/cern-httpd
web/cgic-capture
web/cgiemail
web/cgiwrap
web/doc-central
web/faqomatic
web/gnats2w
web/hitop
web/htdig
web/libhtml-ep-perl
web/lists-archives
web/mailto
web/php3-cgi
web/php4-cgi
web/python-pcgi
web/sporum
web/squid-cgi
web/wn
web/www-mysql
web/www-pgsql
web/wwwoffle
web/zope

-- 
 Opportunities are usually disguised as hard work, so most people
 don't recognize them.
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and filed, but not forwarded. (full text, mbox, link).


Message #144 received at 32263-quiet@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Manoj Srivastava <srivasta@debian.org>
Cc: debian-policy@lists.debian.org, 32263-quiet@bugs.debian.org
Subject: Re: Proposal: Splitting cgi-bin
Date: Sat, 20 Jan 2001 22:48:15 -0500
>  Brian> This this has now passed the first step of a policy change,
>  Brian> I'm changing the bug title and severity.  Sorry for the
>  Brian> delay...  I hadn't realized what I had to do.
> 
>         The one problem I see with this proposal is that it does not
>  put into place any transition strategy for either web servers, and
>  packages that ptocide cgi-bin scripts.

That's a good point.  I'm not how urgent it is, though, since packages
are generally not inter-dependant.

Until a package got fixed, it would still try to use the "cgi-bin"
directory, which would be correct because that is where it was storing
it's binaries.  When the package changed and started using "cgi-lib",
then it would be storing its scripts there, too.

The difficulty is if PackageA is referencing a URL ".../cgi-bin/progB.cgi"
that is provide by PackageB.  If either of these update without the
other, then they would break.

I guess the first question is: how many of the latter case is there?


>         The best path may be to get the http server packages to add in
>  the new script directory as an alias, and then put the change in
>  policy as a recommendation, and, later, when most packages have had a
>  chance to change, we can put into policy the current working.

Yes.  None of the "work" packages could make this change until the
web server packages were updated.


>         We need some one to take the lead on getting this conversion
>  process underway; perhaps the sponsor of this proposal can do that?

That would be me.  <smile>

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
Seize the moment!  Live now.  Make "now" always the most important time. -- JLP



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #149 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: 32263@bugs.debian.org
Subject: Re: Proposal: Splitting cgi-bin
Date: Sun, 13 May 2001 11:44:42 -0400
Now that we're getting ready for a new release, I'd like to implement
this new policy in the new development stream.  Here is the text I plan
to include in the necessary bug reports I'll submit.

I don't forsee any difficulties with the upgrade path.  Please let me
know if you think I missed something.

----- ----- -----

There is new Debian policy regarding the use of "cgi-bin" in web servers.
The basic issue is that many webmasters expect to have this directory
available for their own use and not have it taken over by the system to be
used by the various Debian packages.  This new policy should be in complete
effect by the release of Debian 2.4.

I've started the change by reporting bugs against the various web servers
and then later, after they've had a chance to address it, I'll report bugs
against those packages that still use the old location.

To address this, we are creating a new ScriptAlias "cgi-lib" that points to
/usr/lib/cgi-bin.  All Debian packages should eventually use that new
"/cgi-lib/" path in their URLs instead of the older "/cgi-bin/".  This
mechanism does allow for an easy upgrade path.

When updating a web server, the new "cgi-lib" needs to be added, but any
existing definition of "cgi-bin" should be left untouched.  (New installs
should set "cgi-bin" to point to <webroot>/cgi-bin.)  Systems with upgraded
web-servers will continue to work with the older packages (since both
"cgi-bin" and "cgi-lib" point to the same place), thus providing a
hopefully-transparent conversion.

For more information, please see the original bug report:

  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=32263&repeatmerged=yes

----- ----- -----

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
                  Don't drink and park.  Accidents cause kids.



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Peter Palfrader <weasel@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #154 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Peter Palfrader <weasel@debian.org>
To: 32263@bugs.debian.org
Subject: Re: Bug#32263: Proposal: Splitting cgi-bin
Date: Sun, 13 May 2001 17:54:04 +0200
Hi Brian!

On Sun, 13 May 2001, Brian White wrote:

> There is new Debian policy regarding the use of "cgi-bin" in web servers.
> The basic issue is that many webmasters expect to have this directory
> available for their own use and not have it taken over by the system to be
> used by the various Debian packages.  This new policy should be in complete
> effect by the release of Debian 2.4.

s/2.4/woody+1/

Besides this I think it is a good idea.

					yours,
					peter

-- 
 PGP signed and encrypted  |  .''`.  ** Debian GNU/Linux **
    messages preferred.    | : :' :    By professionals,
                           | `. `'      for professionals
 http://www.palfrader.org/ |   `-    http://www.debian.org/



Changed Bug title. Request was from Manoj Srivastava <srivasta@golden-gryphon.com> to control@bugs.debian.org. (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@precidia.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #161 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@precidia.com>
To: 32263@bugs.debian.org
Subject: Re: Bug#32263: Proposal: Splitting cgi-bin
Date: Tue, 20 Nov 2001 09:48:40 -0500
Any idea when the patch I provided will actually be applied to the policy
manual?  It would be nice to get this underway.  Thanks!

                                          Brian
                                 ( bcwhite@precidia.com )

-------------------------------------------------------------------------------
  Generated by Signify v1.07.  For this and more, visit http://www.debian.org/



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Wichert Akkerman <wichert@wiggy.net>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #166 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Wichert Akkerman <wichert@wiggy.net>
To: Brian White <bcwhite@precidia.com>, 32263@bugs.debian.org
Subject: Re: Bug#32263: Proposal: Splitting cgi-bin
Date: Tue, 20 Nov 2001 16:29:43 +0100
Previously Brian White wrote:
> Any idea when the patch I provided will actually be applied to the policy
> manual?  It would be nice to get this underway.  Thanks!

Policy is frozen.

Wichert.

-- 
  _________________________________________________________________
 /wichert@wiggy.net         This space intentionally left occupied \
| wichert@deephackmode.org            http://www.liacs.nl/~wichert/ |
| 1024D/2FA3BC2D 576E 100B 518D 2F16 36B0  2805 3CB8 9250 2FA3 BC2D |



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@precidia.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #171 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@precidia.com>
To: Wichert Akkerman <wichert@wiggy.net>
Cc: 32263@bugs.debian.org
Subject: Re: Bug#32263: Proposal: Splitting cgi-bin
Date: Tue, 20 Nov 2001 14:32:53 -0500
> > Any idea when the patch I provided will actually be applied to the policy
> > manual?  It would be nice to get this underway.  Thanks!
> 
> Policy is frozen.

I realize that.  Any idea when the patch I provide will actually be applied
to the policy manual?  It would be nice to get this underway.

                                          Brian
                                 ( bcwhite@precidia.com )

-------------------------------------------------------------------------------
  Generated by Signify v1.07.  For this and more, visit http://www.debian.org/



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Wichert Akkerman <wichert@wiggy.net>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>. (full text, mbox, link).


Message #176 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Wichert Akkerman <wichert@wiggy.net>
To: Brian White <bcwhite@precidia.com>
Cc: 32263@bugs.debian.org
Subject: Re: Bug#32263: Proposal: Splitting cgi-bin
Date: Tue, 20 Nov 2001 20:34:42 +0100
Previously Brian White wrote:
> I realize that.  Any idea when the patch I provide will actually be applied
> to the policy manual?  It would be nice to get this underway.

After the woody release I suspect.

Wichert.

-- 
  _________________________________________________________________
 /wichert@wiggy.net         This space intentionally left occupied \
| wichert@deephackmode.org            http://www.liacs.nl/~wichert/ |
| 1024D/2FA3BC2D 576E 100B 518D 2F16 36B0  2805 3CB8 9250 2FA3 BC2D |



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@acm.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #181 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@acm.org>
To: Brian White <bcwhite@pobox.com>, 32263@bugs.debian.org
Subject: Status of cgi-lib?
Date: Fri, 30 Aug 2002 20:35:22 -0500
Hi,

	Have web-servers been changed add cgi-lib as a standard
 script-alias? If so, then we may move ahead with this proposal, and
 include the patch in policy.  We can't include the recommendation for
 packages to move in policy if doing so would cause them to break,
 which shall be the case until the web servers are changed.

	manoj
-- 
 People who make no mistakes do not usually make anything.
Manoj Srivastava     <srivasta@acm.org>    <http://www.golden-gryphon.com/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Severity set to `wishlist'. Request was from Manoj Srivastava <srivasta@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@precidia.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #188 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@precidia.com>
To: Manoj Srivastava <srivasta@acm.org>, 32263@bugs.debian.org
Subject: Splitting CGI-BIN
Date: Tue, 17 Sep 2002 10:44:34 -0400
(First I get one address wrong, then the other.  <sigh>  3rd time...)

What is the next step in moving this in to being official policy?  I was
told I couldn't request any changes to the various webservers until it
was accepted as such.

===============================================================================
--- policy.sgml.orig    Fri Nov  3 00:02:17 2000
+++ policy.sgml Fri Nov  3 00:18:45 2000
@@ -2949,9 +2949,20 @@
                </example>
                and can be referred to as
                <example>
-                 http://localhost/cgi-bin/&lt;cgi-bin-name&gt;
-               </example></p></item>
+                 http://localhost/cgi-lib/&lt;cgi-bin-name&gt;
+               </example></p>
                
+             <p>The purpose of using <tt>cgi-lib</tt> instead of
+             <tt>cgi-bin</tt> is that most webmasters are used to having
+             <tt>cgi-bin</tt> available for their own local use, much like
+             <tt>/usr/local</tt>.  Having packages use <tt>cgi-lib</tt>
+             means that no changes need to be made by the webmaster to both
+             keep what they are used to and still have access to Debian
+             packages.</p>
+
+             <p>Web servers should include <tt>/cgi-lib/</tt> as a standard
+             ScriptAlias of <tt>/usr/lib/cgi-bin/</tt>.</p></item>
+
                
            <item><p>Access to html documents</p>
===============================================================================


Here was the draft mail I was going to use in reported bugs...

===============================================================================
There is new Debian policy regarding the use of "cgi-bin" in web servers.
The basic issue is that many webmasters expect to have this directory
available for their own use and not have it taken over by the system to be
used by the various Debian packages.  This new policy should be in complete
effect by the next release of Debian.

I've started the change by reporting bugs against the various web servers
and then later, after they've had a chance to address it, I'll report bugs
against those packages that still use the old location.

To address this, we are creating a new ScriptAlias "cgi-lib" that points to
/usr/lib/cgi-bin.  All Debian packages should eventually use that new
"/cgi-lib/" path in their URLs instead of the older "/cgi-bin/".  This
mechanism does allow for an easy upgrade path.

When updating a web server, the new "cgi-lib" needs to be added, but any
existing definition of "cgi-bin" should be left untouched.  (New installs
should set "cgi-bin" to point to <webroot>/cgi-bin.)  Systems with upgraded
web-servers will continue to work with the older packages (since both
"cgi-bin" and "cgi-lib" point to the same place), thus providing a
hopefully-transparent conversion.

For more information, please see the original bug report:

  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=32263&repeatmerged=yes
===============================================================================

                                          Brian
                                 ( bcwhite@precidia.com )

-------------------------------------------------------------------------------
                  Do, or do not.  There is no "try".  -- Yoda



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #193 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: Brian White <bcwhite@precidia.com>
Cc: 32263@bugs.debian.org
Subject: Re: Splitting CGI-BIN
Date: Wed, 18 Sep 2002 10:53:35 -0500
Hi,
>>"Brian" == Brian White <bcwhite@precidia.com> writes:

 Brian> What is the next step in moving this in to being official
 Brian> policy?  I was told I couldn't request any changes to the
 Brian> various webservers until it was accepted as such.

	Quite the contrary. Policy documents current, working
 solutions. We should not make policy experimental solutions that may
 need to be backed out, or radically changed; policy needs to be
 fairly conservative, I think. The first step is to make sure that the
 web servers implement the script dir alias; while maintaining
 compatibility, and _then_ we make the _recommendation_ that packages
 switch over. We can't make the recommendation in advance of it
 actually working. And, then, at some point in the future, we cna make
 the new way of doing things mandatory.

	I would also suggest that <webroot>/cgi-bin and
 <webroot>/cgi-lib not point to the same place on the file system,
 since there is no reduction of name space polluction until the flag
 day when they shall point to different dirs; and that would not be
 possible to effect a gradual transition (day F: all packages refer to
 <webroot>/cgi-lib, but place files in the location of
 <webroot>/cgi-bin; when the web servers update the script aliases to
 point to new dir; every one of those packages break. This plan also
 needs the users to all have started using cgi-lib for _some_ cgi
 scripts (debian provided) but not others (locally provided) -- seems
 quite confusing, unless care is taken to handle this.

	Instead, if a new <webroot>/cgi-lib alias is added, but points
 to a different location, packages may transition over gradually --
 but then, the users would be very upset about not knowing where to
 find the cgi scripts, and the urls all over have to be changed.

	I suggest that before things are writ into policy we actually
 have a working transition plan, and have at least a few packages
 already transitioned.

	On the other hand, if you want a flag day abrupt transition,
 set up staging areas, and user reeducation plans ;-). One that is
 done, policy shall be changed to document practice.

	manoj
-- 
 Oh, life is a glorious cycle of song, A medley of extemporanea; And
 love is thing that can never go wrong; And I am Marie of
 Roumania. Dorothy Parker, "Comment"
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@precidia.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #198 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@precidia.com>
To: Manoj Srivastava <srivasta@debian.org>
Cc: 32263@bugs.debian.org
Subject: Re: Splitting CGI-BIN
Date: Wed, 18 Sep 2002 13:34:08 -0400
>  Brian> What is the next step in moving this in to being official
>  Brian> policy?  I was told I couldn't request any changes to the
>  Brian> various webservers until it was accepted as such.
> 
>         Quite the contrary. Policy documents current, working
>  solutions. We should not make policy experimental solutions that may
>  need to be backed out, or radically changed; policy needs to be
>  fairly conservative, I think. The first step is to make sure that the
>  web servers implement the script dir alias; while maintaining
>  compatibility, and _then_ we make the _recommendation_ that packages
>  switch over. We can't make the recommendation in advance of it
>  actually working. And, then, at some point in the future, we cna make
>  the new way of doing things mandatory.

When I first started this some 3 years ago (<sigh>), the web-server
maintainers refused to change their packages without a previous change
to the official policy.

Once it becomes official policy, then I can get them to make the
necessary changes.  And once the webservers begin to change over,
then I can get the packages to change.


>         I would also suggest that <webroot>/cgi-bin and
>  <webroot>/cgi-lib not point to the same place on the file system,
>  since there is no reduction of name space polluction until the flag
>  day when they shall point to different dirs; and that would not be
>  possible to effect a gradual transition (day F: all packages refer to
>  <webroot>/cgi-lib, but place files in the location of
>  <webroot>/cgi-bin; when the web servers update the script aliases to
>  point to new dir; every one of those packages break. This plan also
>  needs the users to all have started using cgi-lib for _some_ cgi
>  scripts (debian provided) but not others (locally provided) -- seems
>  quite confusing, unless care is taken to handle this.

<webroot>/cgi-bin should default to "~www-data/cgi-bin".  However,
existing implementations should not be automatically changed so as not
to break anything.  Once all packages follow the new policy, then they
can do semi-automatic changes to the /cgi-bin setting.

The reason no webserver must do a behind-the-scenes changes is that the
webmasters of some existing implementations will have started inserting
CGIs in the existing place and we should be careful not to break that.

Done carefully, there will be no breaking.  Packages currently place files
under "/usr/lib/cgi-bin/*" and references them as "/cgi-bin/*".  This works
because webservers map "/cgi-bin/" to "/usr/lib/cgi-bin/".

Webservers need to create a standard alias for "/cgi-lib" to "/usr/lib/cgi-bin".

Once done, installed scripts will be available via both "/cgi-bin/script"
and "/cgi-lib/script".  The packages then change all of their webspace
references to be "/cgi-lib/script".  However, both before they make that
change and after it is done, there is no interruption of service.

Once all the packages have changed over, then webmasters can start using
the "/cgi-bin/" alias for what it was intended: local CGI programs.

If you can see a problem with this, please let me know.  It's been presented
before and everybody seemed happy with it.

                                          Brian
                                 ( bcwhite@precidia.com )

-------------------------------------------------------------------------------
                  Do, or do not.  There is no "try".  -- Yoda



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #203 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: Brian White <bcwhite@precidia.com>
Cc: 32263@bugs.debian.org
Subject: Re: Splitting CGI-BIN
Date: Wed, 18 Sep 2002 19:24:25 -0500
>>"Brian" == Brian White <bcwhite@precidia.com> writes:


 Brian> Once it becomes official policy, then I can get them to make the
 Brian> necessary changes.  And once the webservers begin to change over,
 Brian> then I can get the packages to change.

	Perhaps things have changed in the last 3 years, and they
 shall understand that post the /usr/doc issue policy has become more
 conservative? 

 Brian> <webroot>/cgi-bin should default to "~www-data/cgi-bin".
 Brian> However, existing implementations should not be automatically
 Brian> changed so as not to break anything.  Once all packages follow
 Brian> the new policy, then they can do semi-automatic changes to the
 Brian> /cgi-bin setting.

	I suppose you mean <webroot>/cgi-lib should default to
 "~www-data/cgi-bin". I am with you so far. The only thing that has
 changed so far is that the public interface may be changed to
 <webroot>/cgi-lib, but nothing changes behind the scenes, and there
 is no reduction in name space pollution.

 Brian> The reason no webserver must do a behind-the-scenes changes is
 Brian> that the webmasters of some existing implementations will have
 Brian> started inserting CGIs in the existing place and we should be
 Brian> careful not to break that.

	Quite so. Local cgi-scripts should _always_ be accessible
 under <webroot>/cgi-lib.


 Brian> Once done, installed scripts will be available via both
 Brian> "/cgi-bin/script" and "/cgi-lib/script".  The packages then
 Brian> change all of their webspace references to be
 Brian> "/cgi-lib/script".  However, both before they make that change
 Brian> and after it is done, there is no interruption of service.

	Yes. But the scripts still live in ~www-data/cgi-bin, right?
 If not, I missed when you are going to have packages move the scripts
 out.

 Brian> Once all the packages have changed over, then webmasters can
 Brian> start using the "/cgi-bin/" alias for what it was intended:
 Brian> local CGI programs.

	I see two problems. The name space pollution has not been
 reduced -- since all scripts live in the same dir on disk; my
 cgi-file could be overwritten by a debian package. All we have done
 is created two names for the same underlying directory; but not given
 the sysadmin a private place to keep his files that is safe. 

 	Hmm. I forgot what the pther problem I thought I had with this.

 Brian> If you can see a problem with this, please let me know.  It's
 Brian> been presented before and everybody seemed happy with it.

	Perhaps I am being dense, in which case, please point out my
 fallacy to me.

	manoj
-- 
 Date: 28 Feb 90 02:03:37 GMT From: merlyn@iwarp.intel.com (Randal
 Schwartz) $_ = <<END; s/../pack('C',hex($&))/ge; print;
 4a75737420616e6f74686572205065726c206861636b65722c END
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@precidia.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #208 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@precidia.com>
To: Manoj Srivastava <srivasta@debian.org>
Cc: 32263@bugs.debian.org
Subject: Re: Splitting CGI-BIN
Date: Thu, 19 Sep 2002 10:12:29 -0400
>  Brian> Once it becomes official policy, then I can get them to make the
>  Brian> necessary changes.  And once the webservers begin to change over,
>  Brian> then I can get the packages to change.
> 
>         Perhaps things have changed in the last 3 years, and they
>  shall understand that post the /usr/doc issue policy has become more
>  conservative?

I'm afraid I don't understand what you mean here.


>  Brian> <webroot>/cgi-bin should default to "~www-data/cgi-bin".
>  Brian> However, existing implementations should not be automatically
>  Brian> changed so as not to break anything.  Once all packages follow
>  Brian> the new policy, then they can do semi-automatic changes to the
>  Brian> /cgi-bin setting.
> 
>         I suppose you mean <webroot>/cgi-lib should default to
>  "~www-data/cgi-bin". I am with you so far. The only thing that has
>  changed so far is that the public interface may be changed to
>  <webroot>/cgi-lib, but nothing changes behind the scenes, and there
>  is no reduction in name space pollution.

No, I mean that <webroot>/cgi-lib should point to /usr/lib/cgi-bin
and <webroot>/cgi-bin should point to ~www-data/cgi-bin.  The latter is
what webmaster expect or, at the very least, they expect to be able to
control <webroot>/cgi-bin.


>  Brian> The reason no webserver must do a behind-the-scenes changes is
>  Brian> that the webmasters of some existing implementations will have
>  Brian> started inserting CGIs in the existing place and we should be
>  Brian> careful not to break that.
> 
>         Quite so. Local cgi-scripts should _always_ be accessible
>  under <webroot>/cgi-lib.

I believe that <webroot>/cgi-bin should access local cgi-scripts since that
is the traditional method and the way most webmasters layout their site.
I'd like to use <webroot>/cgi-lib for access to the system cgi-scripts.


>  Brian> Once done, installed scripts will be available via both
>  Brian> "/cgi-bin/script" and "/cgi-lib/script".  The packages then
>  Brian> change all of their webspace references to be
>  Brian> "/cgi-lib/script".  However, both before they make that change
>  Brian> and after it is done, there is no interruption of service.
> 
>         Yes. But the scripts still live in ~www-data/cgi-bin, right?
>  If not, I missed when you are going to have packages move the scripts
>  out.

All system scripts would live under /usr/lib/cgi-bin and be accessed via
<webroot>/cgi-lib.  To make for a smooth transition, any existing alias
of <webroot>/cgi-bin would remain untouched thus allowing uninterrupted
access until all of the packages that need to change can be changed.  This
shouldn't be a hardship for anybody since they're already forced to use
<webroot>/cgi-bin in that capacity right now.


>  Brian> Once all the packages have changed over, then webmasters can
>  Brian> start using the "/cgi-bin/" alias for what it was intended:
>  Brian> local CGI programs.
> 
>         I see two problems. The name space pollution has not been
>  reduced -- since all scripts live in the same dir on disk; my
>  cgi-file could be overwritten by a debian package. All we have done
>  is created two names for the same underlying directory; but not given
>  the sysadmin a private place to keep his files that is safe.

Your personal cgi-script should _not_ be in /usr/lib/cgi-bin.  That's the
problem I'm trying to correct.  Packages should place scripts under that
directory but webmasters should use ~www-data/cgi-bin.  Right now, those
two are the same thing but this split will remove that dependency.

                                          Brian
                                 ( bcwhite@precidia.com )

-------------------------------------------------------------------------------
   If you love something, set it free.  If it comes back, it was, and always
     will be yours.  If it never returns, it was never yours to begin with.



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Anthony Towns <aj@azure.humbug.org.au>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #213 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Anthony Towns <aj@azure.humbug.org.au>
To: Brian White <bcwhite@precidia.com>, 32263@bugs.debian.org
Cc: Manoj Srivastava <srivasta@debian.org>
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Fri, 20 Sep 2002 01:13:09 +1000
[Message part 1 (text/plain, inline)]
On Thu, Sep 19, 2002 at 10:12:29AM -0400, Brian White wrote:
> >         Perhaps things have changed in the last 3 years, and they
> >  shall understand that post the /usr/doc issue policy has become more
> >  conservative?
> I'm afraid I don't understand what you mean here.

He means the best way to get something in policy is for it to be
implemented.  Of course, the best way to get many things implemented is
for them to be in policy, first, but hey, when have paradoxes stopped
us before?

> No, I mean that <webroot>/cgi-lib should point to /usr/lib/cgi-bin
> and <webroot>/cgi-bin should point to ~www-data/cgi-bin. The latter is
> what webmaster expect or, at the very least, they expect to be able to
> control <webroot>/cgi-bin.

Well, they can do that now -- all they have to do is change the cgi-bin
override in apache.conf.

The above would also seem like it would break people's websites and
bookmarks, a bit, which would seem undesirable.

What would y'all think about having cgi-bin managed more like, umm:

	/usr/lib/cgi-bin/
		<packages dump CGI scripts in here willy-nilly>
	~wwwdata/cgi-bin/
		<packages make symlinks to /usr/lib/cgi-bin/blah in postinst,
		 based on some setting in /etc/ somewhere>

So that admins can just rm symlinks to scripts they don't need, or,
if they want to be absolutely sure they don't get any cgi-bin scripts
they don't want, change the config file.

The transition could probably be something like having the web server
check the config file currently points cgi-bin at /usr/lib/cgi-bin, then
prompt, and both change the config file and make symlinks to everything
currently in /usr/lib/cgi-bin, which seems possible, reliable, and fairly
seemless, at first glance.

> I believe that <webroot>/cgi-bin should access local cgi-scripts since that
> is the traditional method and the way most webmasters layout their site.
> I'd like to use <webroot>/cgi-lib for access to the system cgi-scripts.

Hrm. Does it really make sense to have to change all your "cgi-bin/blah"
references to "cgi-lib/blah", just because you choose to use a packaged
version of the cgi script, or vice-versa?

(I'm somewhat interested in fixing the "unwanted services becoming
available, and possibly posing a remote security risk just 'cause I
installed some package to look at some files" problem, which I think
the above suggestion might do)

I'm assuming, of course, that webservers can cope with symlinks to CGI
scripts in their default cgi-bin directory...

Cheers,
aj

-- 
Anthony Towns <aj@humbug.org.au> <http://azure.humbug.org.au/~aj/>
I don't speak for anyone save myself. GPG signed mail preferred.

 ``If you don't do it now, you'll be one year older when you do.''
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@precidia.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #218 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@precidia.com>
To: Anthony Towns <aj@azure.humbug.org.au>
Cc: 32263@bugs.debian.org, Manoj Srivastava <srivasta@debian.org>
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Thu, 19 Sep 2002 11:26:54 -0400
> > >         Perhaps things have changed in the last 3 years, and they
> > >  shall understand that post the /usr/doc issue policy has become more
> > >  conservative?
> > I'm afraid I don't understand what you mean here.
> 
> He means the best way to get something in policy is for it to be
> implemented.  Of course, the best way to get many things implemented is
> for them to be in policy, first, but hey, when have paradoxes stopped
> us before?

True, but since I'm not the one implementing it, the best I can do is
take the route of changing policy first.  I think this is the best method
is this case, though, since the change will affect numerous webserver
packages.


> > No, I mean that <webroot>/cgi-lib should point to /usr/lib/cgi-bin
> > and <webroot>/cgi-bin should point to ~www-data/cgi-bin. The latter is
> > what webmaster expect or, at the very least, they expect to be able to
> > control <webroot>/cgi-bin.
> 
> Well, they can do that now -- all they have to do is change the cgi-bin
> override in apache.conf.

They can.  I've done this myself.  But then none of the Debian packages
that rely upon <webroot>/cgi-bin will work.  The purpose of the change
isn't to alter the webserver packages, but rather the packages that make
use of them so they will not conflict with what the webmasters want to do.


> The above would also seem like it would break people's websites and
> bookmarks, a bit, which would seem undesirable.
> 
> What would y'all think about having cgi-bin managed more like, umm:
> 
>         /usr/lib/cgi-bin/
>                 <packages dump CGI scripts in here willy-nilly>
>         ~wwwdata/cgi-bin/
>                 <packages make symlinks to /usr/lib/cgi-bin/blah in postinst,
>                  based on some setting in /etc/ somewhere>

This has how I've done my site, but it's a pain.  Also, many webmasters
run virtual websites and thus such symlinks would have to be done (or not
done) for each webspace and that's not something can be easily automated.


> > I believe that <webroot>/cgi-bin should access local cgi-scripts since that
> > is the traditional method and the way most webmasters layout their site.
> > I'd like to use <webroot>/cgi-lib for access to the system cgi-scripts.
> 
> Hrm. Does it really make sense to have to change all your "cgi-bin/blah"
> references to "cgi-lib/blah", just because you choose to use a packaged
> version of the cgi script, or vice-versa?

That's up to the webmaster.  If they are using Debian packages from within
their own pages, they can create a symlink exactly as you describe above.
However, not creating the symlink won't affect those pages completely
controled by other packages, like dwww.  By splitting thing, the webmasters
have the choice.


> (I'm somewhat interested in fixing the "unwanted services becoming
> available, and possibly posing a remote security risk just 'cause I
> installed some package to look at some files" problem, which I think
> the above suggestion might do)

That's an excellent point.  A webmaster could change <webroot>/cgi-lib
to point to ~www-data/cgi-lib and then only create symlinks for those
scripts he wants enabled for that (virtual?) host.  For the most part,
though, people that install a web-based package want it to be available
so I think that is a good default.


> I'm assuming, of course, that webservers can cope with symlinks to CGI
> scripts in their default cgi-bin directory...

They can.  Apache needs a "FollowSymlinks" option enabled.

                                          Brian
                                 ( bcwhite@precidia.com )

-------------------------------------------------------------------------------
   If you love something, set it free.  If it comes back, it was, and always
     will be yours.  If it never returns, it was never yours to begin with.



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Anthony Towns <aj@azure.humbug.org.au>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #223 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Anthony Towns <aj@azure.humbug.org.au>
To: Brian White <bcwhite@precidia.com>
Cc: 32263@bugs.debian.org, Manoj Srivastava <srivasta@debian.org>
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Fri, 20 Sep 2002 01:46:28 +1000
[Message part 1 (text/plain, inline)]
On Thu, Sep 19, 2002 at 11:26:54AM -0400, Brian White wrote:
> > What would y'all think about having cgi-bin managed more like, umm:
> >         /usr/lib/cgi-bin/
> >                 <packages dump CGI scripts in here willy-nilly>
> >         ~wwwdata/cgi-bin/
> >                 <packages make symlinks to /usr/lib/cgi-bin/blah in postinst,
> >                  based on some setting in /etc/ somewhere>
> This has how I've done my site, but it's a pain.  

It's only a pain because at the moment you have to make the symlinks
yourself, though, isn't it?

> Also, many webmasters
> run virtual websites and thus such symlinks would have to be done (or not
> done) for each webspace and that's not something can be easily automated.

Hrm. If they want the same CGI scripts on all their web sites, it's easy,
just point the cgi-bin alias for each vhost to the one directory.

If they want fine-grained control over their CGI scripts ("This client
only gets access to any given CGI script when it's approved by the
techies, and they pay $5"), then it's not an issue, since they'll be
making the symlinks by hand anyway.

It's only when they want fine-grained control of local CGI scripts,
but all the pre-packaged CGI scripts on each vhost, that we could do any
better. Of course, if they _really_ want that, they could just setup the
cgi-lib alias themselves. But I would've _thought_ the other two cases
would be the common ones, though?

Actually, fixing that'd be trivial too. Make your config file look like:

] $ cat /etc/cgi-scripts
] cgi-symlink-dirs="/var/www/cgi-bin /srv/foo.com/cgi-bin /srv/bar.com/cgi-bin"

and have an update-cgi script of some sort that does the parsing for you.

You could be a little bit more fine-grained too, if that was worthwhile.

Being able to easily disable a couple of prepackaged CGI scripts seems
like a common enough behaviour to optimise for.

Or maybe not, of course.

Cheers,
aj

-- 
Anthony Towns <aj@humbug.org.au> <http://azure.humbug.org.au/~aj/>
I don't speak for anyone save myself. GPG signed mail preferred.

 ``If you don't do it now, you'll be one year older when you do.''
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@precidia.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #228 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@precidia.com>
To: Anthony Towns <aj@azure.humbug.org.au>
Cc: 32263@bugs.debian.org, Manoj Srivastava <srivasta@debian.org>
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Thu, 19 Sep 2002 14:20:46 -0400
> > > What would y'all think about having cgi-bin managed more like, umm:
> > >         /usr/lib/cgi-bin/
> > >                 <packages dump CGI scripts in here willy-nilly>
> > >         ~wwwdata/cgi-bin/
> > >                 <packages make symlinks to /usr/lib/cgi-bin/blah in postinst,
> > >                  based on some setting in /etc/ somewhere>
> > This has how I've done my site, but it's a pain.
> 
> It's only a pain because at the moment you have to make the symlinks
> yourself, though, isn't it?

That's part of it.  Since packages don't announce what they are putting
something in to /usr/lib/bin, I usually don't see it.  It's also a pain when
I'm not paying attention during an upgrade an Apache changes the /cgi-bin/
ScriptAlias, but since that's my own fault, I can't really complain
too much. :-)


> > Also, many webmasters
> > run virtual websites and thus such symlinks would have to be done (or not
> > done) for each webspace and that's not something can be easily automated.
> 
> Hrm. If they want the same CGI scripts on all their web sites, it's easy,
> just point the cgi-bin alias for each vhost to the one directory.

That would also assume that all CGI scripts were the same for all virtual
sites, which is not necessarily true just because they want each to have
access to a script installed from a Debian package.


> If they want fine-grained control over their CGI scripts ("This client
> only gets access to any given CGI script when it's approved by the
> techies, and they pay $5"), then it's not an issue, since they'll be
> making the symlinks by hand anyway.
> 
> It's only when they want fine-grained control of local CGI scripts,
> but all the pre-packaged CGI scripts on each vhost, that we could do any
> better. Of course, if they _really_ want that, they could just setup the
> cgi-lib alias themselves. But I would've _thought_ the other two cases
> would be the common ones, though?

Setting up the cgi-lib alias isn't the problem, though.  The problem is
all the package pages that reference their scripts via <webroot>/cgi-bin.
Changing those is the point of the exercise, but it's necessary to get
some support (i.e. the alternative "<webroot>/cgi-lib") from the webservers
first.

                                          Brian
                                 ( bcwhite@precidia.com )

-------------------------------------------------------------------------------
   If you love something, set it free.  If it comes back, it was, and always
     will be yours.  If it never returns, it was never yours to begin with.



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #233 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: Brian White <bcwhite@precidia.com>
Cc: 32263@bugs.debian.org
Subject: Re: Splitting CGI-BIN
Date: Fri, 20 Sep 2002 00:05:19 -0500
>>"Brian" == Brian White <bcwhite@precidia.com> writes:

 Brian> No, I mean that <webroot>/cgi-lib should point to
 Brian> /usr/lib/cgi-bin and <webroot>/cgi-bin should point to
 Brian> ~www-data/cgi-bin.  The latter is what webmaster expect or, at
 Brian> the very least, they expect to be able to control
 Brian> <webroot>/cgi-bin.

	Cool. With you so far.

 Brian> I believe that <webroot>/cgi-bin should access local
 Brian> cgi-scripts since that is the traditional method and the way
 Brian> most webmasters layout their site.  I'd like to use
 Brian> <webroot>/cgi-lib for access to the system cgi-scripts.


	Still here. 
 >> 
 >> Yes. But the scripts still live in ~www-data/cgi-bin, right?
 >> If not, I missed when you are going to have packages move the scripts
 >> out.

 Brian> All system scripts would live under /usr/lib/cgi-bin and be
 Brian> accessed via <webroot>/cgi-lib.  To make for a smooth
 Brian> transition, any existing alias of <webroot>/cgi-bin would
 Brian> remain untouched thus allowing uninterrupted access until all
 Brian> of the packages that need to change can be changed.  This
 Brian> shouldn't be a hardship for anybody since they're already
 Brian> forced to use <webroot>/cgi-bin in that capacity right now.

	So, as an early adopter, I start using /usr/lib/cgi-bin, it
 won't work until the web servers have done so. Hmm. perhaps we should
 recommend web servers provide the script alias, but warn packagers
 not to use it until web servers have transitioned.

	Unless, of course, the web server maintainers agree to add the
 alias on their own, in advance of policy, since you convinced them of
 the wisdom of doing so (well, I can dream)

 >> 
 >> I see two problems. The name space pollution has not been
 >> reduced -- since all scripts live in the same dir on disk; my
 >> cgi-file could be overwritten by a debian package. All we have done
 >> is created two names for the same underlying directory; but not given
 >> the sysadmin a private place to keep his files that is safe.

 Brian> Your personal cgi-script should _not_ be in /usr/lib/cgi-bin.

	I meant my packages cgi-bin script. I get kinda propreitary
 about _my_ code.

	Any how, when the web servers have mostly implemented the
 alias, we can then make general policy for packages to follow.
 Hmm. no way to avoid having all users change their book marks, then?

	manoj
-- 
 Wit is the rarest quality to be met with among people of
 education. William Hazlitt
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #238 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: Brian White <bcwhite@precidia.com>
Cc: 32263@bugs.debian.org
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Fri, 20 Sep 2002 00:13:25 -0500
>>"Anthony" == Anthony Towns <aj@azure.humbug.org.au> writes:

 Anthony> The above would also seem like it would break people's websites and
 Anthony> bookmarks, a bit, which would seem undesirable.

 Anthony> What would y'all think about having cgi-bin managed more like, umm:

 Anthony> 	/usr/lib/cgi-bin/
 >> packages dump CGI scripts in here willy-nilly>
 Anthony> 	~wwwdata/cgi-bin/
 >> packages make symlinks to /usr/lib/cgi-bin/blah in postinst,
 Anthony> 		 based on some setting in /etc/ somewhere>

	Well, this means that there is no separation of name spaces --
 though you have improved the situation by giving the user a
 _choice_, which is always good.

	Would it not be a desirable goal to ultimately have the users
 using the /cgi-lib for system scripts, and /cgi-bin for local
 scripts, and have distinct name spaces?

	manoj
 3 hours sleep in 43 hours and counting
-- 
 History is on our side (as long as we can control the historians).
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Anthony Towns <aj@azure.humbug.org.au>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #243 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Anthony Towns <aj@azure.humbug.org.au>
To: Manoj Srivastava <srivasta@debian.org>, 32263@bugs.debian.org
Cc: Brian White <bcwhite@precidia.com>
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Fri, 20 Sep 2002 18:10:57 +1000
On Fri, Sep 20, 2002 at 12:13:25AM -0500, Manoj Srivastava wrote:
> 	Would it not be a desirable goal to ultimately have the users
>  using the /cgi-lib for system scripts, and /cgi-bin for local
>  scripts, and have distinct name spaces?

I don't see why?

There are two reasons for name spaces: you need one so that packages
can dump their files on the filesystem without having to worry about
overwriting users' CGI scripts. You also need a namespace so you can
decide which scripts are available for the webserver -- this might be a
full hierarchy, effectively, if you're serving different web sites and
want different CGI scripts available on each.

I don't see any value to letting the guy browsing your website be able
to tell the difference between local CGI scripts and remote ones though.
It seems beneficial not to, even, so you can have replace your homebrew
build of http://example.com/cgi-bin/analog with the prepackaged version,
without having to do any work or put any thought into it. 

Maybe I don't understand the cases where you want to have a link to
a CGI script in a package, though? Perhaps the real problem comes when
dealing with subsystems that happen to be operated through CGI scripts --
linuxconf or similar things do that, don't they? I'm not really seeing any
cases where that's a nuisance to deal with, but I don't use such things,
so maybe that's where I'm missing something?

Cheers, 
aj

-- 
Anthony Towns <aj@humbug.org.au> <http://azure.humbug.org.au/~aj/>
I don't speak for anyone save myself. GPG signed mail preferred.

 ``If you don't do it now, you'll be one year older when you do.''



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@precidia.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #248 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@precidia.com>
To: Manoj Srivastava <srivasta@debian.org>
Cc: 32263@bugs.debian.org
Subject: Re: Splitting CGI-BIN
Date: Fri, 20 Sep 2002 10:21:01 -0400
>  >> Yes. But the scripts still live in ~www-data/cgi-bin, right?
>  >> If not, I missed when you are going to have packages move the scripts
>  >> out.
> 
>  Brian> All system scripts would live under /usr/lib/cgi-bin and be
>  Brian> accessed via <webroot>/cgi-lib.  To make for a smooth
>  Brian> transition, any existing alias of <webroot>/cgi-bin would
>  Brian> remain untouched thus allowing uninterrupted access until all
>  Brian> of the packages that need to change can be changed.  This
>  Brian> shouldn't be a hardship for anybody since they're already
>  Brian> forced to use <webroot>/cgi-bin in that capacity right now.
> 
>         So, as an early adopter, I start using /usr/lib/cgi-bin, it
>  won't work until the web servers have done so. Hmm. perhaps we should
>  recommend web servers provide the script alias, but warn packagers
>  not to use it until web servers have transitioned.

By "I start using", you mean as a package maintainer?  If so, then you
are correct.  It's important that the webserver packages get updated first,
then we can get to the real goal converting packages to use cgi-lib so
that webmasters can set <webroot>/cgi-bin to be ~www-data/cgi-bin (or
whatever they prefer).  Whew!


>         Unless, of course, the web server maintainers agree to add the
>  alias on their own, in advance of policy, since you convinced them of
>  the wisdom of doing so (well, I can dream)

<laugh>


>  >> I see two problems. The name space pollution has not been
>  >> reduced -- since all scripts live in the same dir on disk; my
>  >> cgi-file could be overwritten by a debian package. All we have done
>  >> is created two names for the same underlying directory; but not given
>  >> the sysadmin a private place to keep his files that is safe.
> 
>  Brian> Your personal cgi-script should _not_ be in /usr/lib/cgi-bin.
> 
>         I meant my packages cgi-bin script. I get kinda propreitary
>  about _my_ code.
> 
>         Any how, when the web servers have mostly implemented the
>  alias, we can then make general policy for packages to follow.
>  Hmm. no way to avoid having all users change their book marks, then?

Yup.  Good point, though; I hadn't thought of bookmarks.  For the most part,
it won't make any difference. Most existing sites will not change the current
<webroot>/cgi-bin setting and thus both cgi-bin and cgi-lib will point to the
same place.  Old bookmarks will still work.  New installations will get the new
setting of <webroot>/cgi-bin but there won't be too many bookmarks to those
sites.

                                          Brian
                                 ( bcwhite@precidia.com )

-------------------------------------------------------------------------------
           BUFFERS=20 FILES=15 2nd down, 4th quarter, 5 yards to go!



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@precidia.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #253 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@precidia.com>
To: Anthony Towns <aj@azure.humbug.org.au>
Cc: Manoj Srivastava <srivasta@debian.org>, 32263@bugs.debian.org
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Fri, 20 Sep 2002 10:30:42 -0400
> I don't see any value to letting the guy browsing your website be able
> to tell the difference between local CGI scripts and remote ones though.
> It seems beneficial not to, even, so you can have replace your homebrew
> build of http://example.com/cgi-bin/analog with the prepackaged version,
> without having to do any work or put any thought into it.

User's generally don't care what the URL path is; they seldom even read it.
<webroot>/cgi-bin/analog will be your version while <webroot>/cgi-lib/analog
will be the packaged version.  If you wish to override your personal one with
the packaged one, either change the URL to cgi-lib or create a symlink from
the cgi-bin directory.  A package, however, should never override what a
user has done manually.  That's bad karma.


> Maybe I don't understand the cases where you want to have a link to
> a CGI script in a package, though? Perhaps the real problem comes when
> dealing with subsystems that happen to be operated through CGI scripts --
> linuxconf or similar things do that, don't they? I'm not really seeing any
> cases where that's a nuisance to deal with, but I don't use such things,
> so maybe that's where I'm missing something?

As I see it, the problem breaks down as follows:

 - webmasters want to use <webroot>/cgi-bin for scripts
 - <webroot>/cgi-bin holds scripts from packages in /usr/lib/cgi-bin
 - normal users (including the webmaster) can't write to /usr/lib/cgi-bin
 - so, root is force to:
	- give write access to /usr/lib/cgi-bin (undesireable), or
	- change <webroot>/cgi-bin to ~www-data/cgi-bin, which means
		- apache will always complain about non-standard cgi-bin alias
		- webmaster must symlink scripts from /usr/lib/cgi-bin

I personally find these last two consequences undesireable and difficult to
explain to webmasters.  So, by making all packages use <webroot>/cgi-lib we
can provide a different namespace to package developers and avoid all
conflicts with how webmasters like to do things.

                                          Brian
                                 ( bcwhite@precidia.com )

-------------------------------------------------------------------------------
           BUFFERS=20 FILES=15 2nd down, 4th quarter, 5 yards to go!



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #258 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: Brian White <bcwhite@precidia.com>
Cc: Anthony Towns <aj@azure.humbug.org.au>, 32263@bugs.debian.org
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Mon, 23 Sep 2002 17:34:44 -0500
Hi,

        Fine. Y'all have convinced me that the proposed solution is
  correct, and we do not need to provide distinct name spaces for
  system vs user scripts.

	Have we decided on whether aj's proposed changes (below) are
 what we reached a consensus on?
======================================================================
         /usr/lib/cgi-bin/
                 <packages dump CGI scripts in here willy-nilly>
         ~wwwdata/cgi-bin/
                 <packages make symlinks to /usr/lib/cgi-bin/blah in postinst,
                  based on some setting in /etc/ somewhere>
 So that admins can just rm symlinks to scripts they don't need, or,
 if they want to be absolutely sure they don't get any cgi-bin scripts
 they don't want, change the config file.
======================================================================
	Hmm. What happens if I remove a symlink, and then the package
 is upgraded?

 Manoj>         So, as an early adopter, I start using /usr/lib/cgi-bin, it
 Manoj>  won't work until the web servers have done so. Hmm. perhaps
 Manoj>  we should recommend web servers provide the script alias, but
 Manoj>  warn packagers not to use it until web servers have
 Manoj>  transitioned.

 Brian> By "I start using", you mean as a package maintainer?  If so,
 Brian> then you are correct.  It's important that the webserver
 Brian> packages get updated first, then we can get to the real goal
 Brian> converting packages to use cgi-lib so that webmasters can set
 Brian> <webroot>/cgi-bin to be ~www-data/cgi-bin (or whatever they
 Brian> prefer).  Whew!

	Umm. Again, if the packages set symlinks, we do not need to
 wait for the webservers first, do we? I mean, the symlink shall br
 created in postinst, and thus the cgi-program shall continue to exist
 in <webroot>/cgi-bin/blah, irrespective of whether the web server has
 transitioned. 

	manoj
--
 If A = B and B = C, then A = C, except where void or prohibited by
 law. Roy Santoro
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Anthony Towns <aj@azure.humbug.org.au>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #263 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Anthony Towns <aj@azure.humbug.org.au>
To: Manoj Srivastava <srivasta@debian.org>
Cc: Brian White <bcwhite@precidia.com>, 32263@bugs.debian.org
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Tue, 24 Sep 2002 13:06:55 +1000
On Mon, Sep 23, 2002 at 05:34:44PM -0500, Manoj Srivastava wrote:
> 	Have we decided on whether aj's proposed changes (below) are
>  what we reached a consensus on?
> ======================================================================
>          /usr/lib/cgi-bin/
>                  <packages dump CGI scripts in here willy-nilly>
>          ~wwwdata/cgi-bin/
>                  <packages make symlinks to /usr/lib/cgi-bin/blah in postinst,
>                   based on some setting in /etc/ somewhere>
>  So that admins can just rm symlinks to scripts they don't need, or,
>  if they want to be absolutely sure they don't get any cgi-bin scripts
>  they don't want, change the config file.
> ======================================================================
> 	Hmm. What happens if I remove a symlink, and then the package
>  is upgraded?

I'd assume what we'd want is for the symlink to stay removed. Something like:

	if [ "$1" = "configure" ]; then
	  if [ "$2" = "" ] || dpkg --compare-versions "$2" -lt 1.0.3-5; do
	    # first install, or first install since support for update-cgi 
	    # added
	    update-cgi --add /usr/lib/cgi-bin/foo
	  fi
	fi

should handle that, I think.

Probably with:

	update-cgi --disable /usr/lib/cgi-bin/foo
		(which notes whether or not there was a symlink for foo
		 somewhere and removes the symlink, for dpkg --remove)

	update-cgi --enable /usr/lib/cgi-bin/foo
		(which looks at the note, and recreates the symlink if 
		 appropriate)

	update-cgi --remove /usr/lib/cgi-bin/foo
		(which just removes the symlink)

at appropriate places in the *rm scripts.

Cheers,
aj

-- 
Anthony Towns <aj@humbug.org.au> <http://azure.humbug.org.au/~aj/>
I don't speak for anyone save myself. GPG signed mail preferred.

 ``If you don't do it now, you'll be one year older when you do.''



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #268 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Anthony Towns <aj@azure.humbug.org.au>, 32263@bugs.debian.org
Cc: Manoj Srivastava <srivasta@debian.org>, Brian White <bcwhite@precidia.com>
Subject: Re: Bug#32263: Splitting CGI-BIN
Date: Tue, 24 Sep 2002 00:43:37 -0400
> >       Have we decided on whether aj's proposed changes (below) are
> >  what we reached a consensus on?
> > ======================================================================
> >          /usr/lib/cgi-bin/
> >                  <packages dump CGI scripts in here willy-nilly>
> >          ~wwwdata/cgi-bin/
> >                  <packages make symlinks to /usr/lib/cgi-bin/blah in postinst,
> >                   based on some setting in /etc/ somewhere>
> >  So that admins can just rm symlinks to scripts they don't need, or,
> >  if they want to be absolutely sure they don't get any cgi-bin scripts
> >  they don't want, change the config file.
> > ======================================================================
> >       Hmm. What happens if I remove a symlink, and then the package
> >  is upgraded?

I don't believe this to be necessary.  As long as webservers don't
change existing <webroot>/cgi-bin aliases (use the new default only
for new installations), then there won't be any difficulties.  An
advanced webmaster will either not install said packages or will
alias <webroot>/cgi-lib as he/she sees fit.

I think making symlinks will be a pain for package maintainers, prone
to error (especially for configs with multiple virtual hosts), and give
no real benefit.

I would really like to keep this simple.

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
          Until we are first independent, we cannot be interdependent.



Severity set to `normal'. Request was from Brian White <bcwhite@pobox.com> to control@bugs.debian.org. (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #275 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: 32263@bugs.debian.org
Subject: Splitting cgi-bin: Make it policy?
Date: Mon, 28 Oct 2002 19:14:36 -0500
Okay...  This has been approved and passed all the stages.  Would somebody
please make the change to the official policy manual so we can move ahead?

Thanks!

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
               He who has infinite patience sees instant results.



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #280 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: Brian White <bcwhite@pobox.com>
Cc: 32263@bugs.debian.org
Subject: Re: Bug#32263: Splitting cgi-bin: Make it policy?
Date: Sun, 03 Nov 2002 19:20:03 -0600
Hi,
>>"Brian" == Brian White <bcwhite@pobox.com> writes:

 Brian> Okay...  This has been approved and passed all the stages.
 Brian> Would somebody please make the change to the official policy
 Brian> manual so we can move ahead?

	Passed all stages? Does that mean that the web servers have
 all been patched to support the new ScriptAlias "cgi-lib"?

	Hmm. 

_> egrep ScriptAlias /etc/apache/httpd.conf
# ScriptAlias: This controls which directories contain server scripts.
# ScriptAliases are essentially the same as Aliases, except that
# The same rules about trailing "/" apply to ScriptAlias directives as to
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
# "/usr/lib/cgi-bin" could be changed to whatever your ScriptAliased
    # ScriptAliased directories, uncomment the following lines.


	And this is running the latest apache from Sid.

	manoj
-- 
 The horror... the horror!
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #285 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Manoj Srivastava <srivasta@debian.org>, 32263@bugs.debian.org
Subject: Re: Bug#32263: Splitting cgi-bin: Make it policy?
Date: Sun, 03 Nov 2002 20:55:38 -0500
> >>"Brian" == Brian White <bcwhite@pobox.com> writes:
> 
>  Brian> Okay...  This has been approved and passed all the stages.
>  Brian> Would somebody please make the change to the official policy
>  Brian> manual so we can move ahead?
> 
>         Passed all stages? Does that mean that the web servers have
>  all been patched to support the new ScriptAlias "cgi-lib"?

The original conversation I had waaaaaaay back with the webserver guys
is that they wouldn't go ahead with these changes until it _was_ official
policy.  If you require it to be done before it becomes official policy
then we have a chicken & egg problem.  In my opinion, they're right
and it should be policy before the change gets made.

However, since it's now an accepted ammendment, I filed bugs against
the webserver packages yesterday and directed them towards this bug
number if they want to read the background material.

Still, I'd like to proceed on making the policy change to the official
policy statement at the same time.  Since it's been approved, we might
as well proceed on both fronts at the same time.

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
      Relationships go through seasons.  Winter often comes before Spring.



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #290 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: Brian White <bcwhite@pobox.com>
Cc: 32263@bugs.debian.org
Subject: Re: Bug#32263: Splitting cgi-bin: Make it policy?
Date: Wed, 05 Feb 2003 16:07:46 -0600
>>"Brian" == Brian White <bcwhite@pobox.com> writes:

 >> >>"Brian" == Brian White <bcwhite@pobox.com> writes:
 > The original conversation I had waaaaaaay back with the webserver guys
 > is that they wouldn't go ahead with these changes until it _was_ official
 > policy.  If you require it to be done before it becomes official policy
 > then we have a chicken & egg problem.  In my opinion, they're right
 > and it should be policy before the change gets made.

 > However, since it's now an accepted ammendment, I filed bugs against
 > the webserver packages yesterday and directed them towards this bug
 > number if they want to read the background material.


	I think the way policy is handled has changed since the early
 days; and perhaps polling the web server folks would yeild different
 results? 



 > Still, I'd like to proceed on making the policy change to the official
 > policy statement at the same time.  Since it's been approved, we might
 > as well proceed on both fronts at the same time.

	Well, since the /usr/doc fiasco, policy has tended not to move
 and lead the changes, and have policy being used to beat developers over
 the head with. (urggh, my grammar, she is missing).

	Any progress?

	manoj
-- 
If computers take over (which seems to be their natural tendency), it
will serve us right. Alistair Cooke
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Brian White <bcwhite@pobox.com>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #295 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Brian White <bcwhite@pobox.com>
To: Manoj Srivastava <srivasta@debian.org>
Cc: 32263@bugs.debian.org
Subject: Re: Bug#32263: Splitting cgi-bin: Make it policy?
Date: Thu, 06 Feb 2003 21:26:22 -0500
>  >> >>"Brian" == Brian White <bcwhite@pobox.com> writes:
>  > The original conversation I had waaaaaaay back with the webserver guys
>  > is that they wouldn't go ahead with these changes until it _was_ official
>  > policy.  If you require it to be done before it becomes official policy
>  > then we have a chicken & egg problem.  In my opinion, they're right
>  > and it should be policy before the change gets made.
> 
>  > However, since it's now an accepted ammendment, I filed bugs against
>  > the webserver packages yesterday and directed them towards this bug
>  > number if they want to read the background material.
> 
>         I think the way policy is handled has changed since the early
>  days; and perhaps polling the web server folks would yeild different
>  results?

I dunno.  It seems that policy changes are almost too difficult to even
try.  However, most if not all of the webserver packages I filed the bugs
against have done this and closed them.


>  > Still, I'd like to proceed on making the policy change to the official
>  > policy statement at the same time.  Since it's been approved, we might
>  > as well proceed on both fronts at the same time.
> 
>         Well, since the /usr/doc fiasco, policy has tended not to move
>  and lead the changes, and have policy being used to beat developers over
>  the head with. (urggh, my grammar, she is missing).

Sorry, but I'm a bit out of the loop.  :-)  What fiasco is that?


>         Any progress?

Yes, actually.  I was surprised how smoothly it went.  Not one person
objected and most made the changes right away.

                                          Brian
                                  ( bcwhite@pobox.com )

-------------------------------------------------------------------------------
             Bad command.  Bad, bad command!  Sit!  Stay!  Staaay.



Information forwarded to debian-bugs-dist@lists.debian.org, Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org:
Bug#32263; Package debian-policy. (full text, mbox, link).


Acknowledgement sent to Manoj Srivastava <srivasta@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Policy List <debian-policy@lists.debian.org>, debian-policy@packages.qa.debian.org. (full text, mbox, link).


Message #300 received at 32263@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: Brian White <bcwhite@pobox.com>
Cc: 32263@bugs.debian.org
Subject: Re: Bug#32263: Splitting cgi-bin: Make it policy?
Date: Sun, 09 Feb 2003 16:35:56 -0600
>>"Brian" == Brian White <bcwhite@pobox.com> writes:

 > I dunno.  It seems that policy changes are almost too difficult to even
 > try.  However, most if not all of the webserver packages I filed the bugs
 > against have done this and closed them.

	Getting absolutely new, untested, policy changes into policy,
 in advance of a working implementation, has gotten harder -- and, in
 my opinion, this is a good thing. 

 > Sorry, but I'm a bit out of the loop.  :-)  What fiasco is that?

	Heh. Read -ctte archives.

	manoj
-- 
On a normal ascii line, the only safe condition to detect is a 'BREAK'
everything else having been assigned functions by Gnu EMACS. Tarl Neustaedter
Manoj Srivastava   <srivasta@debian.org>  <http://www.debian.org/%7Esrivasta/>
1024R/C7261095 print CB D9 F4 12 68 07 E4 05  CC 2D 27 12 1D F5 E8 6E
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C



Bug reopened, originator not changed. Request was from Julian Gilbey <jdg@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Bug reopened, originator not changed. Request was from Steve Langasek <vorlon@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Bug reopened, originator not changed. Request was from Steve Langasek <vorlon@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Bug reopened, originator not changed. Request was from Steve Langasek <vorlon@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Bug reopened, originator not changed. Request was from Steve Langasek <vorlon@debian.org> to control@bugs.debian.org. (full text, mbox, link).


Reply sent to Manoj Srivastava <srivasta@debian.org>:
You have taken responsibility. (full text, mbox, link).


Notification sent to Brian White <bcwhite@pobox.com>:
Bug acknowledged by developer. (full text, mbox, link).


Message #315 received at 32263-close@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>
To: 32263-close@bugs.debian.org
Subject: Bug#32263: fixed in debian-policy 3.7.0.0
Date: Tue, 25 Apr 2006 22:47:06 -0700
Source: debian-policy
Source-Version: 3.7.0.0

We believe that the bug you reported is fixed in the latest version of
debian-policy, which is due to be installed in the Debian FTP archive:

debian-policy_3.7.0.0.dsc
  to pool/main/d/debian-policy/debian-policy_3.7.0.0.dsc
debian-policy_3.7.0.0.tar.gz
  to pool/main/d/debian-policy/debian-policy_3.7.0.0.tar.gz
debian-policy_3.7.0.0_all.deb
  to pool/main/d/debian-policy/debian-policy_3.7.0.0_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 32263@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Manoj Srivastava <srivasta@debian.org> (supplier of updated debian-policy package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue, 25 Apr 2006 23:56:16 -0500
Source: debian-policy
Binary: debian-policy
Architecture: source all
Version: 3.7.0.0
Distribution: unstable
Urgency: low
Maintainer: Debian Policy List <debian-policy@lists.debian.org>
Changed-By: Manoj Srivastava <srivasta@debian.org>
Description: 
 debian-policy - Debian Policy Manual and related documents
Closes: 32263 117916 148194 190753 199849 212434 230217 341232 342611 344158 346598 349010 349775 355263 357613 359817 361137 362247 362975
Changes: 
 debian-policy (3.7.0.0) unstable; urgency=low
 .
   * Bug fix: "[PENDING AMENDMENT 20/01/2000] Splitting cgi-bin", thanks to
     Brian White.                                             (Closes: #32263).
   * Bug fix: "debian-policy: [PROPOSAL] Should update to Filesystem
     Hierarchy Standard FHS 2.3", thanks to Tobias Burnus
                                           (Closes: #230217, #212434, #344158).
   * Bug fix: "[AMENDMENT 11/04/2006] Permit multi-line fields in
     debian/control", thanks to John R. Daily. Mention that all fields,
     except the Uploaders, are supposed to be a single logical line, which
     may be spread over multiple physical lines (newline followed by space
     is elided). Also mention that anything parsing the control file must
     allow for a multi-line uploaders field.                (Closes: #148194).
   * Bug fix: "[AMENDMENT 12/04/2004] frown on programs in PATH with
     language extentions", thanks to Joey Hess.             (Closes: #190753).
   * Bug fix: "init script stop example should use --oknodo", thanks to
     Matt Kraai. Removed the example entirely.              (Closes: #346598).
   * Bug fix: "policy 12.5: Please recommend a sane practice WRT different
     gpl versions (was: Re: RFC/RFS: beef - a flexible BrainFuck
     interpreter)", thanks to Justin Pryzby. The subject leaves something
     to be desired, but polic should not attempt to enumerate all common
     licenses.                                               (Closes: #355263).
   * Bug fix: "debian-policy: Conflicting Architecture definitions", thanks
     to Hans Ulrich Niedermann. Punt to dpkg-architecture to providing
     legal architecture strings, since that's what is used by everyone
     anyway.  The version in policy was wrong, but that s=does not seem to
     have hindered anyone, which indicates that this policy directive was
     uneeded. Now the dpkg-architecture list is deemed authoritative, which
     it is, but the format for the string is defined by policy, and the
     current list of architecture strings is in an informative foot note.
                                                            (Closes: #357613).
   * Bug fix: "[AMENDMENT 06/04/2006] Make use of invoke-rc.d, if
     available, mandatory", thanks to Lars Wirzenius.        (Closes: #361137).
   * Bug fix: "no longer current regarding X font paths", thanks to Joey
     Hess                                                    (Closes: #362247).
   * Bug fix: "debian-policy: please prohibit circular dependencies, or
     mention that dependencies won't be respected during prerm remove",
     thanks to Justin Pryzby. Well, we did not prohibit circular
     dependencies. But we do now have a warning that In case of circular
     dependencies, since installation or removal order honoring the
     dependency order can't be established, dependency loops are broken at
     some random point, and some packages may not be able to rely on their
     dependencies being present when being installed or removed, depending
     on which side of the break of the circular dependcy loop they happen
     to be on.                                                (Closes: #362975).
   * Bug fix: "8.6.4. Providing a `shlibs' file: s/should create/must
     provide/", thanks to Christoph Berg. Clarified the wording.
                                                              (Closes: #341232).
   * Bug fix: "debian-policy: Chapter 6 - Package maintainer scripts:
     redundant info about exit status", thanks to Daniel Bonniot
                                                              (Closes: #349010).
   * Bug fix: "debian-policy: Refers to upgrading-checklist.txt instead of
     upgrading-checklist.txt.gz", thanks to Matt Kraai         (Closes: #349775).
   * Bug fix: "debian-policy: dpkg-gencontrol now uses -isp by default",
     thanks to Guillem Jover                                   (Closes: #359817).
   * Bug fix: "[PROPOSAL] unclear recommendation for debconf w/
     dpkg-statoverride", thanks to Eduard Bloch                (Closes: #199849).
   * debian-policy: please support Watch file as recommendation, thanks to
      Bluefuture                                               (Closes: #342611).
   * Bug fix: "[PROPOSED] Mandate http servers to provide httpd-cgi as
     relevenat", thanks to Uwe Hermann. This is already supported by the
     http servers out there.                                   (Closes: #117916).
Files: 
 a99c53850f2296afd22844be148c71c9 820 doc optional debian-policy_3.7.0.0.dsc
 e43f135a8c5ad3f7090435137bf14bb1 771599 doc optional debian-policy_3.7.0.0.tar.gz
 eede58ceff0218bca767236ca6f214b2 1510902 doc optional debian-policy_3.7.0.0_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFETwUjIbrau78kQkwRAhJoAJ4hJn1LsLLZz+QlEseg/kYOGKutiwCcDOGE
hDMF+HerbJZffUcCsHwBME4=
=+ydU
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 26 Jun 2007 04:27:18 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Tue Apr 30 23:59:15 2024; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.