[syslinux] Improving TAILS, WAS: Module Versioning

[intrigeri]

Pete Batard via Syslinux:
> On 2016.03.08 04:59, Shao Miller via Syslinux wrote:
>> 3. If you remove all binaries and leave only configuration-files, then
>>     install your favourite version of Syslinux (which you keep packaged
>>     with Rufus) to the USB, then fit the config-files into place, what
>>     are the disadvantages?

> 1. I'd need to embed every possible .c32 module in Rufus, which will make it explode
> in size.

> 2. I'd also need to cater for custom/modified modules, which I see A LOT more likely
> than any custom/modified isolinux.bin + ldlinux.c32.

And I'll add mine, which may not matter for every live system Rufus &
al. support, but it does matter for Tails:

3. The resulting USB stick contains a hybrid system that mixes what
   the vendor (e.g. Tails) ships with other, third-party bits.
   This has several important drawbacks:

   * We cannot guarantee that the resulting USB stick provides the
     properties Tails is designed to provide. The only way to
     guarantee this reliably is to use exactly the config + com32
     modules we ship, and to use the syslinux binary + mbr.bin we
     include in our ISO. Anything that replaces our bootloader or
     mangles its config requires additional auditing work that we are
     sadly not in a position to do for N installers.

   * It's a real pain for user support: runtime behavior depends on
     the exact third-party installer that was used, and on the exact
     version it was. Most of the time such info is too hard for users
     to find accurately and share with our help desk, and we're left
     in the dark unable to support them. That's one of the reasons why
     we currently support exactly one installer on Windows, and
     exactly one on GNU/Linux: given our current resources we can
     ensure these 2 installers create USB sticks that match users'
     expectations, but we can't do that work for every USB
     installer around :/

> and because some people like tails do recompile their own

Point taken. Currently we simply use whatever is in Debian, but
I acknowledge it's not always been the case, and other OS'es probably
do the same when needed (e.g. because the bugfix they need is not part
of any syslinux stable release yet).

Cheers,
-- 
intrigeri