Re: Bug#1068197: debian-installer: accesses the internet during build

[Bastian Blank]

On Mon, Apr 01, 2024 at 07:39:18PM +0200, Jonathan Carter wrote:
> As far as I know, this doesn't happen until after d-i asked the question "Do
> you want to use a network mirror?" and the user answered "Yes", in which
> case I think that would count as informed consent.

During build, not during usage.

And I don't see how it can work any different, as d-i build works by
fetching packages somehow.

Bastian

-- 
Killing is stupid; useless!
-- McCoy, "A Private Little War", stardate 4211.8

Bug#1068197: debian-installer: accesses the internet during build

[Cyril Brulebois]

[ Switching from ML to bug. ]

Hi Jonathan,

Jonathan Carter  (2024-04-01):
> On 2024/04/01 18:55, Aurelien Jarno wrote:
> > debian-installer attemps network access during build, although only to
> > the mirrors listed in /etc/apt/sources.list and in a secure way. This is
> > forbidden by Policy 4.9:
> > 
> >For packages in the main archive, required targets must not attempt
> >network access, except, via the loopback interface, to services on the
> >build host that have been started by the build.
> > 
> > In addition this brings constraints to the build daemons infrastructure.
> 
> As far as I know, this doesn't happen until after d-i asked the question "Do
> you want to use a network mirror?" and the user answered "Yes", in which
> case I think that would count as informed consent.

This isn't about d-i runtime, this is about src:debian-installer's
*build* requiring network access, which is a very well known problem
(even though there are no obvious solutions, at least that I'm aware
of), and that's now getting in the way of changes being considered 
regarding the buildd network.


Cheers,
-- 
Cyril Brulebois (k...@debian.org)
D-I release manager -- Release team member -- Freelance Consultant


signature.asc
Description: PGP signature

Re: Bug#1068197: debian-installer: accesses the internet during build

[Sven Joachim]

On 2024-04-01 19:39 +0200, Jonathan Carter wrote:

> On 2024/04/01 18:55, Aurelien Jarno wrote:
>> debian-installer attemps network access during build, although only to
>> the mirrors listed in /etc/apt/sources.list and in a secure way. This is
>> forbidden by Policy 4.9:
>>For packages in the main archive, required targets must not
>> attempt
>>network access, except, via the loopback interface, to services on the
>>build host that have been started by the build.
>> In addition this brings constraints to the build daemons
>> infrastructure.
>
> As far as I know, this doesn't happen until after d-i asked the
> question "Do you want to use a network mirror?" and the user answered
> "Yes", in which case I think that would count as informed consent.

There seems to be a misunderstanding,  Aurelien was talking about the
debian-installer source package, not about installation media.  Building
.debs from source packages does not ask for consent ;-).

Cheers,
   Sven

Re: Bug#1068197: debian-installer: accesses the internet during build

[Jonathan Carter]

On 2024/04/01 18:55, Aurelien Jarno wrote:

debian-installer attemps network access during build, although only to
the mirrors listed in /etc/apt/sources.list and in a secure way. This is
forbidden by Policy 4.9:

   For packages in the main archive, required targets must not attempt
   network access, except, via the loopback interface, to services on the
   build host that have been started by the build.

In addition this brings constraints to the build daemons infrastructure.


As far as I know, this doesn't happen until after d-i asked the question 
"Do you want to use a network mirror?" and the user answered "Yes", in 
which case I think that would count as informed consent.


-Jonathan

Bug#1068197: debian-installer: accesses the internet during build

[Aurelien Jarno]

Source: debian-installer
Severity: serious
Justification: Policy 4.9
X-Debbugs-Cc: d...@debian.org, wb-t...@buildd.debian.org
Control: affects -1 buildd.debian.org

Hi,

debian-installer attemps network access during build, although only to
the mirrors listed in /etc/apt/sources.list and in a secure way. This is
forbidden by Policy 4.9:

  For packages in the main archive, required targets must not attempt
  network access, except, via the loopback interface, to services on the
  build host that have been started by the build.

In addition this brings constraints to the build daemons infrastructure.

Regards,
Aurelien