Re: tag2upload, reproducible .orig and dfsg repacks

2024-06-27 Thread Matthias Urlichs
On 27.06.24 07:48, Andreas Tille wrote: I'd prefer if we would not invent a file that might duplicate the content of the d/copyright Files-Excluded field - but this seems to be some implementation detail. You have a point there. We could use "git filter-repo --invert-paths --paths-from-file <(

General Resolution to deploy tag2upload

2024-06-27 Thread Sean Whitton
Hello everyone, I seek seconds for the General Resolution at the end of this e-mail. The preceding sections are an introductory explanation and rationale. We have reviewed the discussion we've already had and prepared an FAQ, linked below. Thank you for all the input on my previous posting, whic

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Didier 'OdyX' Raboud
Le jeudi, 27 juin 2024, 09.15:42 h CEST Sean Whitton a écrit : > = > BEGIN FORMAL RESOLUTION TEXT > > tag2upload allows DDs and DMs to upload simply by using the > git-debpush(1) script to push a signed git tag. > > 1. tag2upload, in the form designed and implemented by Sean Whitton and >

Re: [RFC] General Resolution to deploy tag2upload

2024-06-27 Thread Ansgar 🙀
Hi, On Mon, 2024-06-24 at 16:12 +0800, Sean Whitton wrote: > Ansgar, Joerg, > > Discussion has died down without a resolution of our impasse, but Ian > sent a very long message, so perhaps you are working through it. > > Could you let me know if you are still working on further responses, > and

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Marc Haber
On Thu, Jun 27, 2024 at 03:15:42PM +0800, Sean Whitton wrote: > I seek seconds for the General Resolution at the end of this e-mail. > The preceding sections are an introductory explanation and rationale. *NOT* Seconded. The discussion following the pre-GR has clearly shown that we need to have f

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Joerg Jaspert
On 17273 March 1977, Sean Whitton wrote: I seek seconds for the General Resolution at the end of this e-mail. The preceding sections are an introductory explanation and rationale. So, we are even still discussing things in that other monster thread. And the second one beside it. FTPMaster has

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Jonathan McDowell
On Thu, Jun 27, 2024 at 03:15:42PM +0800, Sean Whitton wrote: > = > BEGIN FORMAL RESOLUTION TEXT > > tag2upload allows DDs and DMs to upload simply by using the > git-debpush(1) script to push a signed git tag. > > 1. tag2upload, in the form designed and implemented by Sean Whitton and >

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Joerg Jaspert
On 17273 March 1977, Sean Whitton wrote: = NEED FOR A GR So, why am I proposing a GR? Because you aren't appearently interested in actual cooperation, but want to force something down the throat of others, ignoring their wishes. The ftpmaster team have refused to trust uploads coming

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Ian Jackson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Sean Whitton writes ("General Resolution to deploy tag2upload"): > BEGIN FORMAL RESOLUTION TEXT > > tag2upload allows DDs and DMs to upload simply by using the > git-debpush(1) script to push a signed git tag. > > 1. tag2upload, in the form designe

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Aigars Mahinovs
Refusing to make a decision is a decision. Ansgar has explicitly set a requirement for including the checksums of the end result Debian source package in the tag. This requirement was not withdrawn or overridden by other FTP masters in the public list communications. And all (detailed) explanations

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Scott Kitterman
On Thursday, June 27, 2024 6:07:33 AM EDT Aigars Mahinovs wrote: > Refusing to make a decision is a decision. Ansgar has explicitly set a > requirement for including the checksums of the end result Debian source > package in the tag. This requirement was not withdrawn or overridden by > other FTP m

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Aníbal Monsalve Salazar
On Thu, 2024-06-27 15:15:42 +0800, Sean Whitton wrote: > = > BEGIN FORMAL RESOLUTION TEXT > > tag2upload allows DDs and DMs to upload simply by using the > git-debpush(1) script to push a signed git tag. > > 1. tag2upload, in the form designed and implemented by Sean Whitton and >Ian Jack

Re: [RFC] General Resolution to deploy tag2upload

2024-06-27 Thread Matthias Urlichs
On 27.06.24 09:50, Ansgar 🙀 wrote: leading to having no idea why a checksum as suggested isn't possible (it would work trivially for the counterexamples given...). I  assume that "checksum" refers to something likehttps://pkg.go.dev/golang.org/x/mod/sumdb/dirhash#Hash1 which you referred to i

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Joerg Jaspert
On 17273 March 1977, Aigars Mahinovs wrote: Refusing to make a decision is a decision. We haven't refused to make one. We haven't been asked for one, even. If this was the same kind of discussion that happened five years ago, I can see why it was not continued. There is no point in service b

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Sam Hartman
> "Sean" == Sean Whitton writes: Sean> Hello everyone, I seek seconds for the General Resolution at Sean> the end of this e-mail. The preceding sections are an Sean> introductory explanation and rationale. Sean> We have reviewed the discussion we've already had and prepared

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Matthias Urlichs
On 27.06.24 16:21, Joerg Jaspert wrote: We haven't refused to make one. We haven't been asked for one, even. Given that Ansgar still more-or-less insists on his checksum approach, which AFAICT cannot work for many dgit workflows, there's really no point in asking in the first place IMHO. A

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Russ Allbery
Joerg Jaspert writes: > On 17273 March 1977, Aigars Mahinovs wrote: >> Refusing to make a decision is a decision. > We haven't refused to make one. > We haven't been asked for one, even. Don't you think this is getting kind of absurd? I flatly don't believe that you actually believe that. The

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Ansgar 🙀
Hi Russ, On Thu, 2024-06-27 at 09:15 -0700, Russ Allbery wrote: > *As soon as* you indicated that there was some willingness to move your > position, people reinvested substantial effort into trying to have that > discussion Yes, I remember. For example getting examples from Russ Allbery about wh

Re: [RFC] General Resolution to deploy tag2upload

2024-06-27 Thread Ansgar 🙀
Hi Matthias, On Thu, 2024-06-27 at 13:56 +0200, Matthias Urlichs wrote: > On 27.06.24 09:50, Ansgar 🙀 wrote: > > leading to having no idea > > why a checksum as suggested isn't possible (it would work trivially for > > the counterexamples given...). > > I  assume that "checksum" refers to somethi

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Russ Allbery
Ansgar 🙀 writes: > On Thu, 2024-06-27 at 09:15 -0700, Russ Allbery wrote: >> *As soon as* you indicated that there was some willingness to move your >> position, people reinvested substantial effort into trying to have that >> discussion > Yes, I remember. For example getting examples from Russ

Re: [RFC] General Resolution to deploy tag2upload

2024-06-27 Thread Matthias Urlichs
On 27.06.24 19:50, Ansgar 🙀 wrote: You missed a very simple part: it wouldn't sign (a hash of) the output of dgit. So the problem does not exist in the form you imagine. OK. Sorry if I misunderstood that email then, it's been a busy week, but … so what *do* you want t2u to checksum? -- -- re

Seconding the General Resolution to Deploy Tag2upload: supporting the idea that a GR is an appropriate process in this instance

2024-06-27 Thread Sam Hartman
> "Sean" == Sean Whitton writes: Sean> = BEGIN FORMAL RESOLUTION TEXT Sean> tag2upload allows DDs and DMs to upload simply by using the Sean> git-debpush(1) script to push a signed git tag. Sean> 1. tag2upload, in the form designed and implemented by Sean Sean> Whitt

Re: Any reference of ftpmaster does not want to accept tag2upload (Was: [RFC] General Resolution to deploy tag2upload)

2024-06-27 Thread Sam Hartman
> "Andreas" == Andreas Tille writes: Andreas> I would really love to see some mails / logs of discussion Andreas> between tag2upload developers and ftpmaster team. Is there Andreas> any chance that we could bring the involved parties in one Andreas> (virtual) room and discuss

Re: General Resolution to deploy tag2upload

2024-06-27 Thread gregor herrmann
On Thu, 27 Jun 2024 16:21:47 +0200, Joerg Jaspert wrote: > On 17273 March 1977, Aigars Mahinovs wrote: > > Refusing to make a decision is a decision. > We haven't refused to make one. > We haven't been asked for one, even. > > There is no point in service building a > > Debian source package wher

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Pierre-Elliott Bécue
I'd like to submit a ballot option. Not really happy with the current text though. The idea is simple : I have been convinced, reading the previous discussion, that no formal opinion from ftpmaster has been provided. I'm not sure that it was asked explicitly, and I think that before having a GR t

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Russ Allbery
Sean Whitton writes: > = > BEGIN FORMAL RESOLUTION TEXT > tag2upload allows DDs and DMs to upload simply by using the > git-debpush(1) script to push a signed git tag. > 1. tag2upload, in the form designed and implemented by Sean Whitton and >Ian Jackson, and design reviewed by Jonathan

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Tiago Bortoletto Vaz
Hi, > Two comments, one more emotional and one more analytical: > > * Part of my gut feeling is that the call for a GR might be a bit > premature, as I have the feeling that especially Gannef is not > opposed to t2u in general but is trying to work out how it might > work; and I really appr

Re: Summary of the current state of the tag2upload discussion

2024-06-27 Thread Soren Stoutner
Russ, I just wanted to say that I have appreciated all of the time and effort you have put into this discussion, and particularly appreciate your explanation of why some security efforts fail and which aspects of security humans are good at compared to which aspects machines are good at. On Tu

Re: [RFC] General Resolution to deploy tag2upload

2024-06-27 Thread Sean Whitton
Hello, On Thu 27 Jun 2024 at 09:50am +02, Ansgar 🙀 wrote: > On Mon, 2024-06-24 at 16:12 +0800, Sean Whitton wrote: >> Ansgar, Joerg, >> >> Discussion has died down without a resolution of our impasse, but Ian >> sent a very long message, so perhaps you are working through it. >> >> Could you let

Re: General Resolution to deploy tag2upload

2024-06-27 Thread Sean Whitton
Hello, I called for seconds when I did because I was hoping to minimise how much this GR would interact with debcamp and debconf. A number of people have said that in doing so, I misjudged the extent to which discussion is still ongoing. I am only one participant in this discussion, so I appreci

Re: [RFC] General Resolution to deploy tag2upload

2024-06-27 Thread Ansgar 🙀
Hi Sean, On Fri, 2024-06-28 at 14:06 +0800, Sean Whitton wrote: > On Thu 27 Jun 2024 at 09:50am +02, Ansgar 🙀 wrote: > > In particular I haven't had time to find anything after the discussion > > with Russ, leading to having no idea why a checksum as suggested isn't > > possible (it would work tri