[darc/maestro++] dependency flow: how to deprecating a package ID? about arcade-services HOT 10 OPEN

There was some talk of cleanup before, but I don't remember where it was left off. @mmitche

from arcade-services.

In prodcon v1 we were very much concerned about this because the source did not describe what packages were actually inputs to the build. In other words, if the package stopped appearing in the 'channel' (upstream build), then you could effectively downgrade the package without knowing. Prodcon v2 doesn't suffer from this as much.

It's entirely valid that packages would stop being produced in a channel, like if we service package X in 3.0.5 but not in 3.0.6. so how do we differentiate these cases? I do like the idea of deprecation/removal though. Basically saying that "components should not take a dependency on this package any longer". That would cover both your scenarios above.

In my mind, this gets implemented as:

• Deprecate X on channel Y. So System.Strawberry is no longer part of .NET Core 3 Dev from here on out. When Maestro runs the update for a subscription, it cross checks the existing data in the repo at the HEAD hash that it's about to update against the deprecation table for the channel, and issues an error.

This means that other channels (e.g. a servicing channel) work just fine still, as maybe System.Strawberry is still there and being produced.

from arcade-services.

Ok, here is a concrete example. I'm not seeing updates to System.Threading.Tasks.Extensions on the '.NET Core 3 Dev' channel to aspnet/Extensions. I've just noticed this. What should I do? Email the corefx team to see if they dropped this package? Investigate darc to see if this is a Maestro bug? Remove the dependency and pin to an LKG version?

from arcade-services.

I would probably email the corefx team in this case. It's not being produced.

from arcade-services.

I believe it's part of Microsoft.NETCore.App

from arcade-services.

Thanks. How did you figure out that it's not being produced anymore? My main point was that nothing in the system makes it easy to figure this out.

from arcade-services.

I used the swagger API (https://maestro-prod.westus2.cloudapp.azure.com/swagger/ui/index.html#/Builds/Builds_GetLatest) to look up the latest corefx build.

from arcade-services.

Though, I will say that nothing in corefx is really easy to figure out. It's one reason why we have so many issues shipping bits incorrectly from there.

from arcade-services.

For this specific case, I've opened https://github.com/dotnet/corefx/issues/34473

from arcade-services.

I have some thoughts about this that would involve maintaining a baseline per repo and then getting a delta of what is included in the latest pushes. When somethings is detected to be missing we notify the repo owners and once deprecation/rename is confirmed then we update the baseline. Let's talk more about this in person when we have a chance

from arcade-services.