Current - Status:
- There are ~110 packages.
- The Whonix main repository / build script references packages as git sub modules. I.e. The main repository points to the exact git commit hash of every package.
- This has the advantage, when git taging a release (such as Whonix 9.6) it points to the exact commit hashes that have been used to create that release (such as 9.6).
- There is no need to manually maintain a list such as "of package X, version Y" should go into Whonix 10.
Current - Git Submodule Disadvantages:
- consensus by many developers Patrick spoke to, that those are a pain to work with and should be avoided
- those are a pain to merge
- git branching the main repository is effectively useless as soon as changes to the packages are made 2
- when switching to older tags, branches or commits, package folders from newer versions are leftovers shown as non-commited folders) (a known issue)
Alternative - Requirements:
- Individual Whonix Debian Packages (list) (such as for example, rads) should stay in their own separate git repository. 1
- Allow everyone to audit each and every commit. But do not require them to review the same commits twice because of code duplication.
Alternative - Maybe Goals:
- Avoiding code duplication. Having all the packages code in the packages repositories as well as in the main repository seems wrong.
- Similarly, avoiding duplication of git history.
Alternatives to be considered:
- git subfolders
1 A long time ago, all the files that Whonix ships were inside one single git repository. Later, all of Whonix's Debian Packages were inside one single git repository. Both methods made Whonix more difficult to grasp and harder to contribute. Splitting Whonix into multiple packages was a very good decision. Much more people are now working on specific functionality of Whonix in separate packages.
2 When merging, it branches and merges commit hashes rather than files.
- Think this more throughly through (requirements, goals).
- After having a good overview, discussion it with various developers to find suggestions on how alternatives could look like.