Re: Bug#1068197: debian-installer: accesses the internet during build

[Bastian Blank]

On Mon, Apr 01, 2024 at 07:39:18PM +0200, Jonathan Carter wrote:
> As far as I know, this doesn't happen until after d-i asked the question "Do
> you want to use a network mirror?" and the user answered "Yes", in which
> case I think that would count as informed consent.

During build, not during usage.

And I don't see how it can work any different, as d-i build works by
fetching packages somehow.

Bastian

-- 
Killing is stupid; useless!
-- McCoy, "A Private Little War", stardate 4211.8

Re: Bug#1068197: debian-installer: accesses the internet during build

[Sven Joachim]

On 2024-04-01 19:39 +0200, Jonathan Carter wrote:

> On 2024/04/01 18:55, Aurelien Jarno wrote:
>> debian-installer attemps network access during build, although only to
>> the mirrors listed in /etc/apt/sources.list and in a secure way. This is
>> forbidden by Policy 4.9:
>>For packages in the main archive, required targets must not
>> attempt
>>network access, except, via the loopback interface, to services on the
>>build host that have been started by the build.
>> In addition this brings constraints to the build daemons
>> infrastructure.
>
> As far as I know, this doesn't happen until after d-i asked the
> question "Do you want to use a network mirror?" and the user answered
> "Yes", in which case I think that would count as informed consent.

There seems to be a misunderstanding,  Aurelien was talking about the
debian-installer source package, not about installation media.  Building
.debs from source packages does not ask for consent ;-).

Cheers,
   Sven

Re: Bug#1068197: debian-installer: accesses the internet during build

[Jonathan Carter]

On 2024/04/01 18:55, Aurelien Jarno wrote:

debian-installer attemps network access during build, although only to
the mirrors listed in /etc/apt/sources.list and in a secure way. This is
forbidden by Policy 4.9:

   For packages in the main archive, required targets must not attempt
   network access, except, via the loopback interface, to services on the
   build host that have been started by the build.

In addition this brings constraints to the build daemons infrastructure.


As far as I know, this doesn't happen until after d-i asked the question 
"Do you want to use a network mirror?" and the user answered "Yes", in 
which case I think that would count as informed consent.


-Jonathan