Thursday 1 August 2024

[Technical Board] Feedback requested: draft policy on third party software sources included by Ubuntu

When a user installs Ubuntu LTS, they expect that the platform and
default apps, together with apps they install from the default
repositories, will follow some principles of quality and stability. For
example, they generally expect that behaviour won't change in surprising
ways for its 12-year life, that there will be some form of support for
it in that stable state for that long, and that Ubuntu Developers are
able to maintain it according to these expectations. We have also always
maintained our non-LTS ("interim") releases to the same stability
standards.

Now that we have snaps installed by default and a growing series of
"snap installer" debs being added to the deb archive, what does this
mean for these expectations? Snaps are applicable much more widely than
just the software that Ubuntu ships itself. Specific snaps and snap
tracks may match our standards for "LTS"-ness, or they may not. In
general, proprietary snaps would presumably be unacceptable for us to
ship by default, but we should have that defined somewhere. Their
licences may change on a new version. And so on.

There are exceptions. Probably the most notable one is Firefox, where we
do accept changes in behaviour in the latest version into our stable
releases. Users can also "opt in" to the upgrade treadmill for anything
else by installing the snap for it. In that case, changes in behaviour
wouldn't be surprising because they opted in.

There are also properties that existed in the traditional model but do
not necessarily exist in the snap world that we would like to keep. For
example, a foundational property of our ecosystem is that users have the
ability to download sources, modify and patch their own systems, as well
as help other users receive the benefit of these abilities, even if the
software publishers choose to go in a different direction. We'd like to
maintain that ability for anything that appears in Ubuntu by default.

This isn't just a snap-specific question. The same sort of questions
have previously been raised for Flatpaks.

When this was raised to the Technical Board, we formed a view that we
should have some written policy that defines what users can expect from
snaps that are installed in this way, together with a process for
granting exceptions. Since we are working on this retrospectively, it
will be the case that some existing packaging does not comply with our
principles. In time, for each outlier we intend to figure out if we
should make exceptions, bring those packages into line, or something in
the middle. We are starting by defining where we want to be, then we can
apply that standard to new cases, and then we can work towards.

I have posted our current draft to Discourse:

https://discourse.ubuntu.com/t/technical-board-feedback-requested-draft-policy-on-third-party-software-sources-included-by-ubuntu/46849

Feedback is appreciated. I suggest replying there to avoid splitting the
conversation into two.

Thanks,

Robie