On Sat, Jul 25, 2026 at 06:10:33PM +0200, Lucas Nussbaum wrote: >... > On 24/07/26 at 00:40 +0200, Pierre-Elliott Bécue wrote: > > - The submitter is solely responsible for the submitted work and: > [...] > > + any content uploaded that would end up in production on Debian > > infrastructure (main git branch, package upload) has been submitted > > by them explicitely. > > I'm a git concerned that this is ambiguous. It could be read as 'has > been written by them without the help of AI'. > > How about something more explicit, like: > The final submission step to production Debian infrastructure, or to > the Debian archive, must be manually performed by the contributor > (e.g., manually executing a git push or package upload). >...
Are we deploying unsigned to production Debian infrastructure anywhere? I would instead suggest that AI tools and agents must be isolated from keys (gpg, ssh) trusted by production Debian infrastructure. > Lucas cu Adrian
