Building images on external infrastructure has a solution to trust the process: First build the builder OS environment in own infrastructure, and then migrate it to external infrastructure to do the desired jobs.
__________ I'm using this express-made address because personal addresses aren't masked enough at lists.debian.org archives. El 15/11/15 a les 18:50, Wouter Verhelst ha escrit: > On Thu, Nov 12, 2015 at 09:04:29PM +0100, Thomas Goirand wrote: >> On 11/12/2015 04:52 PM, kuLa wrote: >>> On 2015-11-12 15:58:03, Thomas Goirand wrote: >>>> As per the discussions during debconf, to be called "official", the >>>> images have to be built: >>>> - directly from an unmodified stable >>>> - with reproducibility on any Debian computer (ie: no need for any >>>> external infrastructure access) >>> >>> I don't think we reached any consensus in relation to the last point but I'm >>> not going to argue about it right now. >> >> There's IMO no consensus to have, unless we change the root of Debian >> (ie: the DFSG, and the fact that we do free software, and can build it >> in Debian). The need for an external infrastructure would make the >> images non-free. SaaS on a proprietary platform is as non-free as one >> can get. I don't anyone would say otherwise, would you? > > Personally, I disagree with the statement that "the need for external > infrastructure would make the images non-free". > > If a cloud platform does not make it possible to *import* images from an > external source, then that requires that the image be built on their > infrastructure, even if it would otherwise be possible to build the same > image outside of their infrastructure. I wouldn't call that non-free, in > very much the same way that building the image on a machine which > requires non-free firmware to boot (such as a BIOS) would result in a > non-free image. > > I believe a more sensible requirement would be that "it is theoretically > possible to build a filesystem image on a cloud provider's > infrastructure that is bit-for-bit the exact same thing as one built > outside that infrastructure". > >>> What I'd like to point out is that I don't think that right now it's >>> possible >>> to build images for all cloud providers outside their infrastructure. >> >> In such a case, then the said providers shouldn't be granted the rights >> to have images called "official Debian". Maybe "backed by Debian", but >> certainly not "official", as I don't think anyone within the project >> would approve non-free software to be called "official Debian". > > Sure. >
