Re: Debian choice of upstream tarballs for packaging

2021-08-16 Thread Paul Wise
On Mon, Aug 16, 2021 at 1:19 AM Paul Wise wrote: > 1. the ecosystems I'm talking about include cargo, npm, browser > extensions, rubygems, pypi, CPAN etc. Examples of what current Debian practices are for these ecosystems: (Amost?) all rust-* packages come from crates.io. Many/most browser exte

Re: Debian choice of upstream tarballs for packaging

2021-08-16 Thread Paul Wise
On Mon, Aug 16, 2021 at 8:25 PM Pirate Praveen wrote: > Many node modules don't tag their releases so its really hard to get > exact source code corresponding to an npmjs.com release. It is probably worth filing upstream issues when you discover that. > Also with mono repos becoming more popular

Re: Debian security repository canonical URI?

2021-08-16 Thread Peter Pentchev
On Mon, Aug 16, 2021 at 11:05:00PM -0500, Daniel Lewart wrote: > Debian Developers, > > First, thank you to Ansgar, et al, for changing > /updates to -security ! > > There are a variety of Debian security repository URIs published. > Below are four of them and some authoritative URLs that use the

Debian security repository canonical URI?

2021-08-16 Thread Daniel Lewart
Debian Developers, First, thank you to Ansgar, et al, for changing /updates to -security ! There are a variety of Debian security repository URIs published. Below are four of them and some authoritative URLs that use them. This inconsistency is confusing. Which URI is best? #2 and #4 are elimin

Re: debian:stable docker image points wrong path for security updates

2021-08-16 Thread Hideki Yamane
Hi Tianon, On Mon, 16 Aug 2021 11:56:35 -0700 Tianon Gravi wrote: > Just to close the loop, > https://github.com/docker-library/official-images/pull/10730 (for > anyone who wants to follow along). :) Thanks! :) Now release-notes CI works. https://salsa.debian.org/ddp-team/release-notes/-/jobs

Re: merged /usr

2021-08-16 Thread Sam Hartman
> "Marco" == Marco d'Itri writes: Marco> This is a legitimate but very minor goal which could also be Marco> achieved by changing dpkg. I'm focus on your statement because I think you'll take the time to consider what I have to say even if you ultimately disagree. I think statements

Re: Debian choice of upstream tarballs for packaging

2021-08-16 Thread Pirate Praveen
On 17/08/21 1:43 am, Sean Whitton wrote: > I agree with this, and already do it for all or almost all of the > packages I maintain. There will probably need to be lots of exceptions, > however. Many node modules don't tag their releases so its really hard to get exact source code corresponding

Re: Debian choice of upstream tarballs for packaging

2021-08-16 Thread Sean Whitton
Hello, On Mon 16 Aug 2021 at 09:18AM +08, Paul Wise wrote: > I noticed that sometimes Debian's choice of upstream source for > packaging can be suboptimal. This is especially apparent for the > different per-language upstream packaging ecosystems[1], where the > upstream packaging differs from th

Re: debian:stable docker image points wrong path for security updates

2021-08-16 Thread Tianon Gravi
On Sun, 15 Aug 2021 at 08:17, Tianon Gravi wrote: > I'll be working on an updated build first thing tomorrow morning. > > (What I would suggest in the meantime and even generally is using > either "buster" or "bullseye" explicitly instead of the "stable" > square wheel, as both tags should still b

Re: Gitlab support for Debian repositories (Was: Regarding the new "Debian User Repository")

2021-08-16 Thread Wouter Verhelst
On Mon, Aug 16, 2021 at 04:47:32PM +, Holger Levsen wrote: > On Mon, Aug 16, 2021 at 03:59:50PM +0200, Wouter Verhelst wrote: > > > because here, our focus would be to publish things :) > > Sure. But also to find problems early rather than late, no? > > no. Well, then we disagree (and that's

Re: Gitlab support for Debian repositories (Was: Regarding the new "Debian User Repository")

2021-08-16 Thread Holger Levsen
On Mon, Aug 16, 2021 at 03:59:50PM +0200, Wouter Verhelst wrote: > > because here, our focus would be to publish things :) > Sure. But also to find problems early rather than late, no? no. -- cheers, Holger ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ holger@(debian|reproducible-builds|layer-acht).org ⢿⡄⠘⠷⠚⠋⠀

Debian Med video conference tomorrow, Tuesday 2021-08-17 18:00 UTC

2021-08-16 Thread Andreas Tille
Hi, this is the call for the next video conference of the Debian Med team that are an established means to organise the tasks inside our team. We do these conferences twice per month on every 2th and 17th of a month. Usually it takes us only 15-20min depending what we are talking about and

Re: merged /usr

2021-08-16 Thread Wouter Verhelst
On Mon, Aug 16, 2021 at 04:17:01PM +0200, Marco d'Itri wrote: > On Aug 16, Wouter Verhelst wrote: > > On Fri, Aug 13, 2021 at 07:53:20AM +0200, Marco d'Itri wrote: > > > Implementations with real /bin /sbin /lib* directories and symlink farms > > > are not useful because they would negate the majo

Re: Debian package manager privilege escalation attack

2021-08-16 Thread Wouter Verhelst
On Thu, Aug 12, 2021 at 01:19:23PM +, Holger Levsen wrote: > On Thu, Aug 12, 2021 at 01:12:37AM -0500, Brian Thompson wrote: > > Would you agree that there is an issue with sudo access that is enabled > > by default on most Debian and Debian-based distributions? The bug may > > not be in apt, b

Re: Steam Deck: good news for Linux gaming, bad news for Debian :(

2021-08-16 Thread Wouter Verhelst
On Sat, Aug 14, 2021 at 07:48:06AM +0100, Jonathan Dowland wrote: > Backports is not analogous to the concepts Timothy was presenting. It's > *one* repository, not a system where people (not just Debian maintainers) > can create repos. extrepo tries to help there, and now that bullseye is released

Re: merged /usr

2021-08-16 Thread Marco d'Itri
On Aug 16, Wouter Verhelst wrote: > On Fri, Aug 13, 2021 at 07:53:20AM +0200, Marco d'Itri wrote: > > Implementations with real /bin /sbin /lib* directories and symlink farms > > are not useful because they would negate the major benefits of > > merged-/usr, i.e. the ability of sharing and indep

Adding an epoch to the 'steam' package

2021-08-16 Thread Simon McVittie
Before Valve's Steam game distribution platform became available on Linux, the Debian source package name 'steam' was used by an unrelated package sTeam, an "environment for cooperative knowledge managment" (a wiki and related software). sTeam was removed from Debian in 2010, and from Ubuntu in 201

Re: merged /usr

2021-08-16 Thread Wouter Verhelst
On Fri, Aug 13, 2021 at 10:16:57AM +0100, Luca Boccassi wrote: > On Fri, 2021-08-13 at 07:53 +0200, Marco d'Itri wrote: > > Implementations with real /bin /sbin /lib* directories and symlink farms > > are not useful because they would negate the major benefits of > > merged-/usr, i.e. the ability

Re: merged /usr

2021-08-16 Thread Wouter Verhelst
On Fri, Aug 13, 2021 at 07:53:20AM +0200, Marco d'Itri wrote: > Implementations with real /bin /sbin /lib* directories and symlink farms > are not useful because they would negate the major benefits of > merged-/usr, i.e. the ability of sharing and independently updating > /usr. In those cases,

Re: Gitlab support for Debian repositories (Was: Regarding the new "Debian User Repository")

2021-08-16 Thread Wouter Verhelst
Hi Holger, On Wed, Aug 11, 2021 at 05:12:54PM +, Holger Levsen wrote: > Hi Wouter, > > sorry for the late reply but I think it's still relevant... > (just thus rather leaving almost full quote as context.) > > On Thu, Jul 08, 2021 at 11:25:26AM +0200, Wouter Verhelst wrote: > > On Mon, Jul 0

Re: Debian choice of upstream tarballs for packaging

2021-08-16 Thread Sam Hartman
> "Paul" == Paul Wise writes: Paul> Hi all, I noticed that sometimes Debian's choice of upstream Paul> source for packaging can be suboptimal. This is especially Paul> apparent for the different per-language upstream packaging Paul> ecosystems[1], where the upstream packaging

Re: Question Re: Advertising in Packages

2021-08-16 Thread Sam Hartman
> "Paul" == Paul Wise writes: Paul> On Mon, Aug 16, 2021 at 2:22 AM Antonio Russo wrote: >> "Can one advertise non-free services in a Debian package? Is >> doing so a violation of some Debian policy? Paul> There is no specific rule against this, but I feel that Paul> cul

Re: merged /usr

2021-08-16 Thread Marco d'Itri
On Aug 16, David Kalnischkies wrote: > Is perhaps pure existence not enough, do I need to provide an upgrade > path as simple as possible as well? If you have specific ideas about how the upgrade path could be improved then I am interested in hearing them. I think that it is hard to beat "apt in

Re: merged /usr

2021-08-16 Thread Luca Boccassi
On Mon, 2021-08-16 at 11:47 +0200, David Kalnischkies wrote: > On Mon, Aug 16, 2021 at 12:59:31AM +0200, Marco d'Itri wrote: > > BTW: the usrmerge package has been in the archive for 6 years now. > > /usr/bin/apt exists for 8 years now and the release notes advice using > it in every section. So,

Bug#992237: general: dpkg broken, so no security updates available

2021-08-16 Thread Olaf Zaplinski
Package: general Severity: important Dear Maintainer, see below: Get:1 http://security.debian.org/debian-security bullseye-security InRelease [44.1 kB] Hit:2 http://deb.debian.org/debian bullseye InRelease Hit:3 http://deb.debian.org/debian bullseye-updates InRelease Hit:4 http://deb.debian.or

Re: Question Re: Advertising in Packages

2021-08-16 Thread Jonas Smedegaard
Quoting Paul Wise (2021-08-16 05:06:05) > On Mon, Aug 16, 2021 at 2:22 AM Antonio Russo wrote: > > >"Can one advertise non-free services in a Debian package? > > Is doing so a violation of some Debian policy? > > There is no specific rule against this, but I feel that culturally > Debian

Re: Question Re: Advertising in Packages

2021-08-16 Thread Ansgar
On Sun, 2021-08-15 at 20:16 -0600, Antonio Russo wrote: > I have a question that I originally posed in debian-vote, but was > directed here instead: > >    "Can one advertise non-free services in a Debian package? Yes. I guess this would be up to the maintainer to decide what is reasonable with t

Re: Question Re: Advertising in Packages

2021-08-16 Thread Marc Haber
On Mon, 16 Aug 2021 08:04:53 +, "Andrew M.A. Cater" wrote: >On Sun, Aug 15, 2021 at 09:14:18PM -0600, Antonio Russo wrote: >> I feel like if we are forced to rebrand Debian's browser to ensure user >> freedoms, then we simply must do so. I'd rather support Firefox/Mozilla, >> but I don't thin

Re: merged /usr

2021-08-16 Thread David Kalnischkies
On Mon, Aug 16, 2021 at 12:59:31AM +0200, Marco d'Itri wrote: > BTW: the usrmerge package has been in the archive for 6 years now. /usr/bin/apt exists for 8 years now and the release notes advice using it in every section. So, how come people are still typing apt-get interactively to upgrade? Is

Re: merged /usr

2021-08-16 Thread David Kalnischkies
On Sun, Aug 15, 2021 at 05:52:06PM +0100, Simon McVittie wrote: > On Sun, 15 Aug 2021 at 11:52:21 +0200, David Kalnischkies wrote: > One way out of this would be to say that it is a RC bug for packages > in bookworm to have different contents when built in equivalent > merged-/usr and unmerged-/usr

Bug#992237: marked as done (general: dpkg broken, so no security updates available)

2021-08-16 Thread Debian Bug Tracking System
Your message dated Mon, 16 Aug 2021 10:49:44 +0200 with message-id <878s11wz87@hands.com> and subject line Re: Bug#992237: general: dpkg broken, so no security updates available has caused the Debian Bug report #992237, regarding general: dpkg broken, so no security updates available to be mar

Re: Question Re: Advertising in Packages

2021-08-16 Thread Andrew M.A. Cater
On Sun, Aug 15, 2021 at 09:14:18PM -0600, Antonio Russo wrote: > On 8/15/21 9:06 PM, Paul Wise wrote: > > On Mon, Aug 16, 2021 at 2:22 AM Antonio Russo wrote: > > > >>"Can one advertise non-free services in a Debian package? > >> Is doing so a violation of some Debian policy? > > > > Ther