Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-02-01 Thread Charles Plessy
Le Fri, Jan 20, 2012 at 09:12:16AM +, Lars Wirzenius a écrit :
 
 You're not the DEP5 driver

Hi Lars and everybody,

I am driving this DEP and re-listed myself at a driver to mark that fact.

To summarise:

 - The original idea, from Sam Hocevar, was posted on this list on August 4,
   2007.

 - A draft was written collaboratively on the wiki until March 2009, in
   which I had my share of contributions.

 - I do not remember who was the first to suggest to make a DEP out of it, but
   please note revision 294: I am the one to propose it in the wiki page.

 - The DEP was started in private, motivated in part by Ubuntu's agenda.  It
   was a terrible mistake for me to accept this, as it resulting in purging
   and demotivating most of the original contributors.  Nevertheless, I did
   a large—or perhaps the largest—share of that work in that phase.

 - The DEP continued in public, and the only moment where I gave up driving
   this project was when you stepped in.  It made tremendous progresses under
   your direction; unfortunately you stepped down in the last mile.  I dare 
saying
   that I contributed a lot.  Among other things did the conversion to DocBook
   which has let the DEP enter in the debian-policy package, and made sure that
   the DEP's license short names are compatible with SPDX.

 - In a further phase, I organised the work through the BTS.  Consensus
   was reached and the DEP was updated accordingly.  I also coordinated
   the publication of the DEP on www.debian.org.  At the next upload
   of the debian-policy package, the DEP will be on line at its canonical
   URL:  http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/

 - In this final phase, I am making sure that there is no objection anymore to
   the release.  And I will not let the momentum slip for one more year.

More importantly than the procedural details: I have followed the work
from its beginning, made sure that no contribution was ignored, and that
most questions were answered.  To the best of my free time, I made sure
that past discussions were not forgotten and taken into account when
the same questions were asked over and over the years.

This is what I expect from a driver: being the memory of the project, keeping
momentum, and making consensus on the final document.  I am driving this DEP.
One can argue forever on this, but please let me suggest that the best way
to close the debate is to finish that work.

Cheers,

-- 
Charles Plessy
Tsurumi, Kanagawa, Japan


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120201151243.ga20...@merveille.plessy.net



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-20 Thread Lars Wirzenius
On Fri, Jan 20, 2012 at 09:58:11AM +0900, Charles Plessy wrote:
 judging by the current status list DEPs, the problem is more stalling than
 accepting them too early.  I admit that as DEP admins, we have not done a good
 job at pinging DEP drivers.  Because of the current confusion of roles on DEP
 5, that I push as a driver, I am waiting for its completion before pinging
 other DEPs as admin.

You're not the DEP5 driver, Steve is; I don't think there's any confusion about
that. I've effectively stepped down from drivership a year ago, and I'm
happy to make it official if the process is going to drag on a lot longer.

None of that should have any effect on you asking drivers of stalled DEPs
what the status and future of their DEPs is. Or anyone else for that matter.

-- 
Freedom-based blog/wiki/web hosting: http://www.branchable.com/


signature.asc
Description: Digital signature


Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-19 Thread Josselin Mouette
Le mercredi 18 janvier 2012 à 19:13 +0100, Stefano Zacchiroli a écrit : 
 I'm not sure I see the point. DEP was never meant to be a device that
 gives more power to anyone. It was just a device to keep track of a
 discussion that was already happening, document it in some durable form,
 and monitor its status. It's not like that the person with the power of
 marking a DEP as ACCEPTED has the power of creating the corresponding
 consensus.

“Dictator” is probably a bad term. See this as a chairman. Someone who
can judge when consensus has been reached, and mark a DEP as accepted.
This would avoid the countless and boring nitpicks by people who still
want to discuss after the consensus has been reached.

 Consensus should exist by itself, ditto for an implementation, and then
 the corresponding DEP could be marked ACCEPTED. 

I don’t buy this. There will always be a large minority, if not a
majority, who will refrain from using a DEP until it is marked as
accepted.

-- 
 .''`.  Josselin Mouette
: :' :
`. `'
  `-


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/1326990960.3223.860.camel@pi0307572



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-19 Thread Lars Wirzenius
On Thu, Jan 19, 2012 at 05:36:00PM +0100, Josselin Mouette wrote:
 “Dictator” is probably a bad term. See this as a chairman. Someone who
 can judge when consensus has been reached, and mark a DEP as accepted.
 This would avoid the countless and boring nitpicks by people who still
 want to discuss after the consensus has been reached.

DEP0 calls these people drivers. Their job is to determine when a rough
consensus has been reached. 

-- 
Freedom-based blog/wiki/web hosting: http://www.branchable.com/


signature.asc
Description: Digital signature


Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-19 Thread Russ Allbery
Lars Wirzenius l...@liw.fi writes:
 On Thu, Jan 19, 2012 at 05:36:00PM +0100, Josselin Mouette wrote:

 “Dictator” is probably a bad term. See this as a chairman. Someone who
 can judge when consensus has been reached, and mark a DEP as accepted.
 This would avoid the countless and boring nitpicks by people who still
 want to discuss after the consensus has been reached.

 DEP0 calls these people drivers. Their job is to determine when a rough
 consensus has been reached.

I think the concern that people have here (and I'm not sure yet whether it
is enough of a concern to warrant creating more administration) is that
the DEP driver is almost certainly going to have a vested interest in the
DEP reaching consensus (otherwise they wouldn't have volunteered to drive
it in the first place), and therefore isn't a great choice for an
impartial judge of consensus if there's some dispute.

-- 
Russ Allbery (r...@debian.org)   http://www.eyrie.org/~eagle/


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/87d3affv8q@windlord.stanford.edu



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-19 Thread Lars Wirzenius
On Thu, Jan 19, 2012 at 09:38:29AM -0800, Russ Allbery wrote:
 Lars Wirzenius l...@liw.fi writes:
  On Thu, Jan 19, 2012 at 05:36:00PM +0100, Josselin Mouette wrote:
 
  “Dictator” is probably a bad term. See this as a chairman. Someone who
  can judge when consensus has been reached, and mark a DEP as accepted.
  This would avoid the countless and boring nitpicks by people who still
  want to discuss after the consensus has been reached.
 
  DEP0 calls these people drivers. Their job is to determine when a rough
  consensus has been reached.
 
 I think the concern that people have here (and I'm not sure yet whether it
 is enough of a concern to warrant creating more administration) is that
 the DEP driver is almost certainly going to have a vested interest in the
 DEP reaching consensus (otherwise they wouldn't have volunteered to drive
 it in the first place), and therefore isn't a great choice for an
 impartial judge of consensus if there's some dispute.

Other people can also be impartial. We don't need an appointed
impartial judge: if the driver declares a consensus, I'm sure
those who disagree will say so. Furthermore: YAGNI. Let's not
solve problems in the DEP process until and unless we have them,
particularly not by making it more bureaucratic and heavy.

-- 
Freedom-based blog/wiki/web hosting: http://www.branchable.com/


signature.asc
Description: Digital signature


Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-19 Thread Charles Plessy
Le Thu, Jan 19, 2012 at 09:38:29AM -0800, Russ Allbery a écrit :
 
 I think the concern that people have here (and I'm not sure yet whether it
 is enough of a concern to warrant creating more administration) is that
 the DEP driver is almost certainly going to have a vested interest in the
 DEP reaching consensus (otherwise they wouldn't have volunteered to drive
 it in the first place), and therefore isn't a great choice for an
 impartial judge of consensus if there's some dispute.

Hi Russ,

judging by the current status list DEPs, the problem is more stalling than
accepting them too early.  I admit that as DEP admins, we have not done a good
job at pinging DEP drivers.  Because of the current confusion of roles on DEP
5, that I push as a driver, I am waiting for its completion before pinging
other DEPs as admin.

Cheers,

-- 
Charles Plessy
Tsurumi, Kanagawa, Japan


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120120005811.ga28...@merveille.plessy.net



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-18 Thread Dominique Dumont
Le Monday 16 January 2012 19:15:07, Jakub Wilk a écrit :
 Does a DEP-3 parser exist? And why not?

config-edit -appli dpkg (soon to become 'cme edit dpkg') is able to parse, 
modify and save DEP-3 patches ( note that this command also deal with 
debian/copyright, debian/control and some other debian files).

This command is part of libconfig-model-perl package

HTH

Dominique
--
http://config-model.wiki.sourceforge.net/ -o- http://search.cpan.org/~ddumont/
http://www.ohloh.net/accounts/ddumont -o- http://ddumont.wordpress.com/


signature.asc
Description: This is a digitally signed message part.


Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-18 Thread Jakub Wilk

* Dominique Dumont d...@debian.org, 2012-01-18, 10:41:

Does a DEP-3 parser exist? And why not?
config-edit -appli dpkg (soon to become 'cme edit dpkg') is able to 
parse, modify and save DEP-3 patches ( note that this command also deal 
with debian/copyright, debian/control and some other debian files).


Huh? What has dpkg to do with DEP-3?

And how do I use this parser? I want something as simple as: for a given 
patch, check if the header complies to DEP-3 and if it does, dump it in 
some machine-readable format.


--
Jakub Wilk


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120118174144.ga9...@jwilk.net



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-18 Thread Stefano Zacchiroli
On Tue, Jan 17, 2012 at 10:05:06AM +0100, Josselin Mouette wrote:
 Le lundi 16 janvier 2012 à 18:07 +, Ian Jackson a écrit :
  I think the DPL should appoint a dictator who will rule on when
  consensus has been achieved on a DEP.

(I originally interpreted this as being enclosed within sarcasm tags)

 Seconded. The DEP process is missing a clear way to make a DEP change
 state. With a single-person (or small team) responsibility, everything
 should be clearer.

I'm not sure I see the point. DEP was never meant to be a device that
gives more power to anyone. It was just a device to keep track of a
discussion that was already happening, document it in some durable form,
and monitor its status. It's not like that the person with the power of
marking a DEP as ACCEPTED has the power of creating the corresponding
consensus.

Consensus should exist by itself, ditto for an implementation, and then
the corresponding DEP could be marked ACCEPTED. If that happens too
soon, no big deal, it's in a VCS, we can revert the commit.  Some people
might be fooled in the interim in believing something is more standard
than how much it actual is, but the same could have happened to anyone
looking at the archive of some discussion (i.e. without DEP).

If a DEP is in strict need of a formal rubber stamp of standardization,
then its implementation should probably correspond to formal
integration into policy (as, IIRC, it is the case for DEP-5).


The above notwithstanding, we can probably learn from this thread that,
for the future, it would help to first announce I'm about to mark
DEP-$x as ACCEPTED and then doing that.  I personally don't think it is
a big deal, but given that others disagree, ... why not.


Cheers.
-- 
Stefano Zacchiroli zack@{upsilon.cc,pps.jussieu.fr,debian.org} . o .
Maître de conférences   ..   http://upsilon.cc/zack   ..   . . o
Debian Project Leader...   @zack on identi.ca   ...o o o
« the first rule of tautology club is the first rule of tautology club »


signature.asc
Description: Digital signature


Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-18 Thread Dominique Dumont
Le Wednesday 18 January 2012 18:41:44, Jakub Wilk a écrit :
 config-edit -appli dpkg (soon to become 'cme edit dpkg') is able to 
 parse, modify and save DEP-3 patches ( note that this command also deal 
 with debian/copyright, debian/control and some other debian files).
 
 Huh? What has dpkg to do with DEP-3?

This command is designed to help debian packager do their job, i.e editing 
debian package files, including debian/patches in DEP-3 format.

 And how do I use this parser? I want something as simple as: for a given 
 patch, check if the header complies to DEP-3 and if it does, dump it in 
 some machine-readable format.

Currently, it cannot be used outside of the more general debian package 
files editor. 

I guess that config-edit could be slightly modified to be applied to 
individual package files. In check only mode, it should be able to 
validate the DEP-3 patches and issues error or warning in case of trouble. 

Even if Config::Model does not really qualify as simple, would that 
interest you ? ( then we could work out the  dump it in some 
machine-readable format part )

If not, feel free to reuse the parser code [1]

All the best

Dominique
[1] 
https://metacpan.org/source/DDUMONT/Config-Model-1.265/lib/Config/Model/Backend/Debian/Dpkg/Patch.pm

--
http://config-model.wiki.sourceforge.net/ -o- http://search.cpan.org/~ddumont/
http://www.ohloh.net/accounts/ddumont -o- http://ddumont.wordpress.com/


signature.asc
Description: This is a digitally signed message part.


Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-18 Thread Jakub Wilk

* Dominique Dumont domi.dum...@free.fr, 2012-01-18, 19:37:

https://metacpan.org/source/DDUMONT/Config-Model-1.265/lib/Config/Model/Backend/Debian/Dpkg/Patch.pm


Judging by a quick look, it doesn't support dpatch patches[0] or 
pseudo-headers[0][1].



[0] Don't ask what are these features good for. But they are in the 
specification.


[1] Also don't ask me how to unambiguously tell where the pseudo-header 
starts.


--
Jakub Wilk


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120118191501.ga4...@jwilk.net



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-18 Thread Fernando Lemos
On Wed, Jan 18, 2012 at 4:37 PM, Dominique Dumont domi.dum...@free.fr wrote:
 Le Wednesday 18 January 2012 18:41:44, Jakub Wilk a écrit :
 And how do I use this parser? I want something as simple as: for a given
 patch, check if the header complies to DEP-3 and if it does, dump it in
 some machine-readable format.

 Currently, it cannot be used outside of the more general debian package
 files editor.

You can use dpkg-copyright instead of dpkg, though:

http://search.cpan.org/~ddumont/Config-Model-1.265/lib/Config/Model/models/Debian/Dpkg/Copyright.pod

Regards,


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/CANVYNa-ivQQYdbEcno5di=+yv8f_iu6chnef4ddqwxvb0fw...@mail.gmail.com



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-17 Thread Josselin Mouette
Le lundi 16 janvier 2012 à 18:07 +, Ian Jackson a écrit : 
 I think the DPL should appoint a dictator who will rule on when
 consensus has been achieved on a DEP.

Seconded. The DEP process is missing a clear way to make a DEP change
state. With a single-person (or small team) responsibility, everything
should be clearer.

-- 
 .''`.  Josselin Mouette
: :' :
`. `'
  `-


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/1326791106.3223.346.camel@pi0307572



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-17 Thread Simon McVittie

On 16/01/12 16:01, Jonathan Wiltshire wrote:

A CVE field, mandatory if a
CVE has been published for this patch and is the major component of this
patch, would allow easy tracing of patches back to CVE publications
later (for review perhaps, or by other distributions).


I wonder whether CVE IDs are close enough to being a (limited-scope) bug 
tracking system to treat them as such, analogous to Bug-Debian, 
Bug-Fedora etc.; I've previously used Bug-CVE: CVE-2011- in 
ioquake3, although I haven't been completely consistent about that.


(Also, a Bug-* line would ideally have a URI - is there a canonical URI 
corresponding to each CVE ID, preferably one that doesn't still just say 
RESERVED long after the embargo date?)


S


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4f155d83.4030...@debian.org



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-17 Thread Jonathan Wiltshire

On 2012-01-17 11:37, Simon McVittie wrote:

On 16/01/12 16:01, Jonathan Wiltshire wrote:

A CVE field, mandatory if a
CVE has been published for this patch and is the major component of 
this

patch, would allow easy tracing of patches back to CVE publications
later (for review perhaps, or by other distributions).


I wonder whether CVE IDs are close enough to being a (limited-scope)
bug tracking system to treat them as such, analogous to Bug-Debian,
Bug-Fedora etc.; I've previously used Bug-CVE: CVE-2011- in
ioquake3, although I haven't been completely consistent about that.


It *should* be the case that each CVE identifiers is unique to a 
problem; occasionally they get revoked if a duplicate becomes apparent. 
In rare cases they are disputed and marked as such.



(Also, a Bug-* line would ideally have a URI - is there a canonical
URI corresponding to each CVE ID, preferably one that doesn't still
just say RESERVED long after the embargo date?)


Useful:
http://security-tracker.debian.org/tracker/CVEID
https://bugzilla.redhat.com/show_bug.cgi?id=CVEID

Generally not so useful:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVEID (the official CVE 
database)

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVEID



--
Jonathan Wiltshire  j...@debian.org
Debian Developer http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/823bcc7d8ef2bcd0a17e814917f98...@hogwarts.powdarrmonkey.net



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Bernd Zeimetz
Hi,

 FTR given that I got no reports of problems with DEP-3, that it's already
 well established, I just changed the state of the DEP-3 from CANDIDATE
 to ACCEPTED.

just because that you didn't get any reports you should not set a status
to ACCEPTED. IMHO the driver of a DEP should not do that at all, at
least not without asking on common lists first. No reaction on your DEP
could just mean that people consider it as a waste of time or don't like
your format.

-- 
 Bernd ZeimetzDebian GNU/Linux Developer
 http://bzed.dehttp://www.debian.org
 GPG Fingerprints: ECA1 E3F2 8E11 2432 D485 DD95 EB36 171A 6FF9 435F


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4f142f0c.40...@bzed.de



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Jon Dowland
On Mon, Jan 16, 2012 at 03:07:08PM +0100, Bernd Zeimetz wrote:
 just because that you didn't get any reports you should not set a status
 to ACCEPTED. IMHO the driver of a DEP should not do that at all, at
 least not without asking on common lists first. No reaction on your DEP
 could just mean that people consider it as a waste of time or don't like
 your format.

Who should have that authority, then? The DEP-0 proposers?  Since the whole DEP
process itself is  still in CANDIDATE, we could end up in an interesting
situation if/when it comes to migrate *that* to ACCEPTED ☺

DEP-0 merely says

 consensus exists that the implementation has been a success

Perhaps that needs unpacking.


-- 
Jon Dowland


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120116144947.GB9047@pris



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Raphael Hertzog
Hi,

On Mon, 16 Jan 2012, Bernd Zeimetz wrote:
 just because that you didn't get any reports you should not set a status
 to ACCEPTED. IMHO the driver of a DEP should not do that at all, at
 least not without asking on common lists first. No reaction on your DEP
 could just mean that people consider it as a waste of time or don't like
 your format.

We did have lots of discussion when we were designing it. People commented
and reacted.

Remember that this format is there to help and is not mandatory (although
it's likely to be considered as a best practice in terms of packaging).

So if you find it a waste of time, ignore it.

But it's already widely used (I have used it for my own packages, Ubuntu
is recommending it too), it has been designed following an open process to
let everybody participate and ensure it fits as many scenario as possible.
It's lightweight and compatible with many of Git's convention.

And I have been asked about moving it to ACCEPTED by someone else already
(I think it was zack but I no longer remember). And the reason why I post
here is precisely so that people can object _if needed_.

So do you have a reason to object to the ACCEPTED status of this DEP
or was this pure rhetoric ?

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Pre-order a copy of the Debian Administrator's Handbook and help
liberate it: http://debian-handbook.info/liberation/


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120116145824.ga2...@rivendell.home.ouaza.com



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Jonathan Wiltshire

On 2012-01-16 15:02, Stefano Zacchiroli wrote:

Does anyone have further comments about DEP-3?  If so, please state
them.  Otherwise, let's forget about the process details (no matter 
if
they could have been better or not) and rejoice for a nice standard 
way

of adding useful metadata to patches in the Debian archive.


It is only a small thing but I did not realise DEP-3 was still a 
candidate or I would have spoken earlier. A CVE field, mandatory if a 
CVE has been published for this patch and is the major component of this 
patch, would allow easy tracing of patches back to CVE publications 
later (for review perhaps, or by other distributions).


Such a field should probably be comma-separated if more than one CVE 
identifier is relevant to the patch.



--
Jonathan Wiltshire  j...@debian.org
Debian Developer http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/e9846bdb29accb9445e617d2fa272...@hogwarts.powdarrmonkey.net



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Tanguy Ortolo
Jonathan Wiltshire, 2012-01-16 17:01+0100:
 It is only a small thing but I did not realise DEP-3 was still a 
 candidate or I would have spoken earlier. A CVE field, mandatory if a 
 CVE has been published for this patch and is the major component of this 
 patch, would allow easy tracing of patches back to CVE publications 
 later (for review perhaps, or by other distributions).

Then it would be better to make it independant from CVE, since they
are not the only security vulnerability database.

-- 
 ,--.
: /` )   Tanguy Ortolo xmpp:tan...@ortolo.eu irc://irc.oftc.net/Tanguy
| `-'Debian Developer
 \_


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/jf1k4a$27a$1...@dough.gmane.org



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Jonathan Wiltshire

On 2012-01-16 16:43, Tanguy Ortolo wrote:

Jonathan Wiltshire, 2012-01-16 17:01+0100:

It is only a small thing but I did not realise DEP-3 was still a
candidate or I would have spoken earlier. A CVE field, mandatory if 
a
CVE has been published for this patch and is the major component of 
this

patch, would allow easy tracing of patches back to CVE publications
later (for review perhaps, or by other distributions).


Then it would be better to make it independant from CVE, since they
are not the only security vulnerability database.


Ack; but we (in the security team) only track CVE really. The Debian 
bug number is useful but only within Debian, the CVE identifier is 
cross-distribution.




--
Jonathan Wiltshire  j...@debian.org
Debian Developer http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/2e6c5e69749b3b03b3cf91bcdc007...@hogwarts.powdarrmonkey.net



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Steve Langasek
On Mon, Jan 16, 2012 at 12:14:26PM +0100, Raphael Hertzog wrote:
 FTR given that I got no reports of problems with DEP-3, that it's already
 well established, I just changed the state of the DEP-3 from CANDIDATE
 to ACCEPTED.
 
 Of course this does not mean that the DEP-3 can't be extended or improved
 (in particular when it doesn't break backwards compatibility)
 but it does mean that this format is ready for widespread usage. Use it to
 document the patches that you add to Debian packages:
 http://dep.debian.net/deps/dep3/

+1 for moving this to accepted.

-- 
Steve Langasek   Give me a lever long enough and a Free OS
Debian Developer   to set it on, and I can move the world.
Ubuntu Developerhttp://www.debian.org/
slanga...@ubuntu.com vor...@debian.org


signature.asc
Description: Digital signature


Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Thomas Goirand
On 01/16/2012 07:14 PM, Raphael Hertzog wrote:
 Hello,

 FTR given that I got no reports of problems with DEP-3, that it's already
 well established, I just changed the state of the DEP-3 from CANDIDATE
 to ACCEPTED.

 Of course this does not mean that the DEP-3 can't be extended or improved
 (in particular when it doesn't break backwards compatibility)
 but it does mean that this format is ready for widespread usage. Use it to
 document the patches that you add to Debian packages:
 http://dep.debian.net/deps/dep3/

 Cheers,
   
IMHO, that's a very good thing if we can improve Debian, and
don't hold back proposals indefinitively, especially when most of
us are already implementing such DEP.

I'm really not sure what makes you authoritative for it though,
and I'd like to understand (which doesn't conflict with the fact
I'm happy dep3 is in state ACCEPTED, and that you decided to
do it!).

Also, does this mean that you've patched the policy, that lintian
would soon more aggressively complain about lacks of patch
comments, and that we'll have a new Standard-Version?

BTW, what's the status of DEP5?
I'm already always uploading DEP5 compliant copyright files
myself, and I'd be happy to see it go in the policy. Having them
parsable is, IMHO, a very good thing, so that we can make
statistics about what license we have, and do all sorts of
incompatibility checks (like, who's using GPL and badly
mixing it with MPL or OpenSSL for example...).

Cheers,

Thomas


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4f145f83.5050...@debian.org



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Mehdi Dogguy

On 16/01/12 18:33, Thomas Goirand wrote:


Also, does this mean that you've patched the policy, that lintian
would soon more aggressively complain about lacks of patch comments,
and that we'll have a new Standard-Version?



Lintian already complains when a quilt patch doesn't contain a
description, fwiw.

See http://lintian.debian.org/tags/quilt-patch-missing-description.html

Regards,

--
Mehdi


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4f1464df.5000...@dogguy.org



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Jakub Wilk

* Raphael Hertzog hert...@debian.org, 2012-01-16, 12:14:
FTR given that I got no reports of problems with DEP-3, that it's 
already well established, I just changed the state of the DEP-3 from 
CANDIDATE to ACCEPTED.


Does a DEP-3 parser exist? And why not?

--
Jakub Wilk


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120116181507.ga2...@jwilk.net



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Ian Jackson
Jon Dowland writes (Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED 
status):
 Who should have that authority, then? The DEP-0 proposers?  Since
 the whole DEP process itself is still in CANDIDATE, we could end up
 in an interesting situation if/when it comes to migrate *that* to
 ACCEPTED ☺

I think the DPL should appoint a dictator who will rule on when
consensus has been achieved on a DEP.

If the dictator gets it wrong then insofar as a DEP is a technical
policy for Debian (which DEP-3 definitely is) the Technical Committee
could overrule the decision, as could a GR of course.

Ian.


--
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/20244.26459.605817.973...@chiark.greenend.org.uk



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Raphael Hertzog
On Tue, 17 Jan 2012, Thomas Goirand wrote:
 I'm really not sure what makes you authoritative for it though,
 and I'd like to understand (which doesn't conflict with the fact
 I'm happy dep3 is in state ACCEPTED, and that you decided to
 do it!).

I just did it as the DEP driver because I believe that there's a
consensus that the implementation has been a success and that's the
criteria set in DEP-0.

Since the goal was only to provide a format to standardize the
meta-information and that many people are successfully using this
format to document their patch, I think we can assert that the DEP
has been successful.

I have not counted how many patches embed those standardized fields so I
can't say how widely it is used but I know from the interaction with
various DD / teams that it's relatively well accepted (the quilt
maintainer even recently added a --dep3 option to quilt header).

 Also, does this mean that you've patched the policy, that lintian
 would soon more aggressively complain about lacks of patch
 comments, and that we'll have a new Standard-Version?

No, the policy is not the proper place for this, but I believe that a
recommendation in the developers-reference would be appropriate.

Lintian already recommends the usage of DEP3 in the long description of
the relevant informative tags it has:
http://lintian.debian.org/tags/dpatch-missing-description.html
http://lintian.debian.org/tags/quilt-patch-missing-description.html

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Pre-order a copy of the Debian Administrator's Handbook and help
liberate it: http://debian-handbook.info/liberation/


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120116194919.ge15...@rivendell.home.ouaza.com



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Thomas Goirand
On 01/17/2012 01:56 AM, Mehdi Dogguy wrote:
 On 16/01/12 18:33, Thomas Goirand wrote:

 Also, does this mean that you've patched the policy, that lintian
 would soon more aggressively complain about lacks of patch comments,
 and that we'll have a new Standard-Version?


 Lintian already complains when a quilt patch doesn't contain a
 description, fwiw.

I know that, but it's currently just warnings, not hard errors.

Thomas


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4f1489d4.5080...@debian.org



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Charles Plessy
Le Mon, Jan 16, 2012 at 12:14:26PM +0100, Raphael Hertzog a écrit :
 
 FTR given that I got no reports of problems with DEP-3, that it's already
 well established, I just changed the state of the DEP-3 from CANDIDATE
 to ACCEPTED.
 
 Of course this does not mean that the DEP-3 can't be extended or improved
 (in particular when it doesn't break backwards compatibility)
 but it does mean that this format is ready for widespread usage. Use it to
 document the patches that you add to Debian packages:
 http://dep.debian.net/deps/dep3/

Bonjour Raphaël,

with my DEP admin hat on, I congratulate and thank you for homing this DEP
to completion.

In my understanding of the process, DEP 3 will not be changed anymore.  The
format it defines has been implemented in different tools, and this is the
achievement of DEP 3.  Modifications of the format are of course possible, as a
new DEP (taking as inspiration the RFCs 822, 2822 and then 5322), or outside
the DEP process.

Have a nice day,

-- 
Charles Plessy
Debian Enhancement Process team,
http://dep.debian.net
Tsurumi, Kanagawa, Japan


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120116235059.gc9...@merveille.plessy.net



Re: Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

2012-01-16 Thread Russ Allbery
Thomas Goirand z...@debian.org writes:

 Also, does this mean that you've patched the policy, that lintian would
 soon more aggressively complain about lacks of patch comments, and that
 we'll have a new Standard-Version?

No.  DEP-3 is an optional standard.

I'm not sure if it should be incorporated into Policy or not.  It's
probably not a bad idea, although we should deal with DEP-5 first and see
if that provides a reasonable precedent for how to do so.

 BTW, what's the status of DEP5?

One of the DEP drivers is not yet happy with the level of specificity and
detail provided to ensure that the results are interoperable, and I'd like
to see those concerns resolved before including it in Policy.  (Which is
currently being worked on, as I understand it.)

-- 
Russ Allbery (r...@debian.org)   http://www.eyrie.org/~eagle/


-- 
To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/87ty3vqffk@windlord.stanford.edu