Re: GPL-licensed software linked against libssl on buildds!

2010-02-02 Thread Roger Leigh
On Tue, Feb 02, 2010 at 07:59:53AM +0100, Lucas Nussbaum wrote: On 02/02/10 at 01:07 +0100, Wouter Verhelst wrote: At any rate, here are some facts: - A package that builds differently because something is (or is not) installed on the build system is buggy. Period. It has nothing to do

Re: GPL-licensed software linked against libssl on buildds!

2010-02-01 Thread Wouter Verhelst
On Wed, Jan 20, 2010 at 10:37:48PM +1300, Lucas Nussbaum wrote: On 20/01/10 at 00:48 -0800, Steve Langasek wrote: On Wed, Jan 20, 2010 at 02:22:33PM +1300, Lucas Nussbaum wrote: Why spend a lot of time on tasks that provide little benefit, and also some disadvantages (in some cases,

Re: GPL-licensed software linked against libssl on buildds!

2010-02-01 Thread Lucas Nussbaum
On 02/02/10 at 01:07 +0100, Wouter Verhelst wrote: At any rate, here are some facts: - A package that builds differently because something is (or is not) installed on the build system is buggy. Period. It has nothing to do with the build system, it's the package. ... but I question that

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Stefano Zacchiroli
On Tue, Jan 19, 2010 at 03:40:22PM -0800, Russ Allbery wrote: Because we want our users to be able to patch and rebuild our software to suit their needs. Asking them to set up a chroot build environment is asking quite a lot. AOL. Yesterday night I drafted a reply (which has lingered in my

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Steve Langasek
On Wed, Jan 20, 2010 at 02:22:33PM +1300, Lucas Nussbaum wrote: Why spend a lot of time on tasks that provide little benefit, and also some disadvantages (in some cases, the fixes might be non-obvious, and requires changes to the packaging that tend to obscure it, for example by using

netatalk: Please avoid accidental linking against libssl [was: GPL-licensed software linked against libssl on buildds!]

2010-01-20 Thread Fabian Greffrath
Package: netatalk Version: 2.0.5-2 Severity: important Holger Levsen: how about the compromise and doing both, except that for (1) we file the bugs with severity important? Hi Jonas, as recently pointed out on debian-devel [1], the netatalk package is accidently linked against libssl on

Re: Bug#565969: netatalk: Please avoid accidental linking against libssl [was: GPL-licensed software linked against libssl on buildds!]

2010-01-20 Thread Jonas Smedegaard
On Wed, Jan 20, 2010 at 09:55:35AM +0100, Fabian Greffrath wrote: as recently pointed out on debian-devel [1], the netatalk package is accidently linked against libssl on some arches due to dirty buildd chroots. To avoid this license violation, explicit Build-Conflicts against libssl-dev

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Neil McGovern
On Tue, Jan 19, 2010 at 02:36:08PM -0800, Russ Allbery wrote: Neil McGovern ne...@debian.org writes: On Tue, Jan 19, 2010 at 11:59:35AM -0800, Russ Allbery wrote: This is a bug in the netatalk Debian packaging. You cannot assume the package will be built in a clean chroot; among other

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Neil McGovern
On Tue, Jan 19, 2010 at 11:32:17PM +0100, Martin Zobel-Helas wrote: Would it be time to start looking at LVM snapshops + sbuild perhaps? we already have two or three buildds doing that... The buildd team (esp. HE) working on that and if it works out to be stable enough, we can see if we can

Re: Bug#565969: netatalk: Please avoid accidental linking against libssl [was: GPL-licensed software linked against libssl on buildds!]

2010-01-20 Thread Steve Langasek
On Wed, Jan 20, 2010 at 10:25:01AM +0100, Jonas Smedegaard wrote: On Wed, Jan 20, 2010 at 09:55:35AM +0100, Fabian Greffrath wrote: as recently pointed out on debian-devel [1], the netatalk package is accidently linked against libssl on some arches due to dirty buildd chroots. To avoid this

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Patrick Schoenfeld
On Tue, Jan 19, 2010 at 04:04:07PM -0800, Russ Allbery wrote: hu? since when do we have a broader interest in people patching and rebuilding packages? I know that there are *some* people interested in that (me included) but I don't see that a broader audience wants to support that. Uh,

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Lucas Nussbaum
On 20/01/10 at 00:48 -0800, Steve Langasek wrote: On Wed, Jan 20, 2010 at 02:22:33PM +1300, Lucas Nussbaum wrote: Why spend a lot of time on tasks that provide little benefit, and also some disadvantages (in some cases, the fixes might be non-obvious, and requires changes to the packaging

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Lucas Nussbaum
On 20/01/10 at 09:30 +0100, Stefano Zacchiroli wrote: On Tue, Jan 19, 2010 at 03:40:22PM -0800, Russ Allbery wrote: Because we want our users to be able to patch and rebuild our software to suit their needs. Asking them to set up a chroot build environment is asking quite a lot. AOL.

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Stefano Zacchiroli
On Wed, Jan 20, 2010 at 10:13:46PM +1300, Lucas Nussbaum wrote: What's the problem with documentation such as https://wiki.ubuntu.com/PbuilderHowto (except it's an Ubuntu documentation)? I think that the process of building with pbuilder is reasonably well documented. Let's be realistic. We

Re: Bug#565969: netatalk: Please avoid accidental linking against libssl [was: GPL-licensed software linked against libssl on buildds!]

2010-01-20 Thread Jonas Smedegaard
On Wed, Jan 20, 2010 at 01:28:49AM -0800, Steve Langasek wrote: On Wed, Jan 20, 2010 at 10:25:01AM +0100, Jonas Smedegaard wrote: On Wed, Jan 20, 2010 at 09:55:35AM +0100, Fabian Greffrath wrote: as recently pointed out on debian-devel [1], the netatalk package is accidently linked against

Bug#565969: Info received (Bug#565969: netatalk: Please avoid accidental linking against libssl [was: GPL-licensed software linked against libssl on buildds!])

2010-01-20 Thread Debian Bug Tracking System
Thank you for the additional information you have supplied regarding this Bug report. This is an automatically generated reply to let you know your message has been received. Your message is being forwarded to the package maintainers and other interested parties for their attention; they will

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Steve Langasek
On Wed, Jan 20, 2010 at 10:37:48PM +1300, Lucas Nussbaum wrote: I'm not asking anyone to spend time on this task, but I still consider missing build-conflicts a bug. Ignoring these bugs by insisting on clean chroot environments for all official package builds is no solution - what if one

Re: Bug#565969: netatalk: Please avoid accidental linking against libssl [was: GPL-licensed software linked against libssl on buildds!]

2010-01-20 Thread Jonas Smedegaard
tags 565969 pending thanks On Wed, Jan 20, 2010 at 11:15:23AM +0100, Jonas Smedegaard wrote: On Wed, Jan 20, 2010 at 01:28:49AM -0800, Steve Langasek wrote: On Wed, Jan 20, 2010 at 10:25:01AM +0100, Jonas Smedegaard wrote: On Wed, Jan 20, 2010 at 09:55:35AM +0100, Fabian Greffrath wrote: as

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Bernhard R. Link
* Lucas Nussbaum lu...@lucas-nussbaum.net [100120 01:26]: There are two ways to attack that problem: (1) We decide that we want to provide the guarantee that packages build the correct way in unclean envs. That mean making such bugs RC, basically, and making efforts to find such bugs. If you

Re: Re: Bug#565969: netatalk: Please avoid accidental linking against libssl [was: GPL-licensed software linked against libssl on buildds!]

2010-01-20 Thread Fabian Greffrath
Ahh, problem isolated: The proper option to use is --with-openssl-dir=no - so the convenient DEB_BUILD_OPTIONS=openssl will be preserved :-) Sure?! # ./configure --with-openssl-dir=no|grep -i ssl checking for SSL... /usr (enabling RANDNUM and DHX support) SSL: CFLAGS =

Re: Bug#565969: Re: Bug#565969: netatalk: Please avoid accidental linking against libssl [was: GPL-licensed software linked against libssl on buildds!]

2010-01-20 Thread Jonas Smedegaard
On Wed, Jan 20, 2010 at 04:15:26PM +0100, Fabian Greffrath wrote: Ahh, problem isolated: The proper option to use is --with-openssl-dir=no - so the convenient DEB_BUILD_OPTIONS=openssl will be preserved :-) Sure?! Nope. I went offline (train ride to Copenhagen an hour from my home) where I

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Russ Allbery
Patrick Schoenfeld schoenf...@debian.org writes: On Tue, Jan 19, 2010 at 04:04:07PM -0800, Russ Allbery wrote: Uh, since as long as I've been part of the project. I think this is at least the third time that I recall the same topic coming up on -devel. Wow. How often a topic comes up on

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Patrick Schoenfeld
On Wed, Jan 20, 2010 at 10:30:13AM -0800, Russ Allbery wrote: That does not mean that we shouldn't fix such bugs if they arise (obviously we should) but having priority on it is a different thing. Then I'm not sure that you're disagreeing with me? Oh I don't. However in one of your first

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Russ Allbery
Patrick Schoenfeld schoenf...@debian.org writes: On Wed, Jan 20, 2010 at 10:30:13AM -0800, Russ Allbery wrote: That does not mean that we shouldn't fix such bugs if they arise (obviously we should) but having priority on it is a different thing. Then I'm not sure that you're disagreeing with

Re: GPL-licensed software linked against libssl on buildds!

2010-01-20 Thread Michael Banck
On Tue, Jan 19, 2010 at 03:40:22PM -0800, Russ Allbery wrote: Lucas Nussbaum lu...@lucas-nussbaum.net writes: On 19/01/10 at 14:36 -0800, Russ Allbery wrote: Well, I would argue that proper package builds in dirty environments is something we want in Debian anyway, and while this isn't

GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Fabian Greffrath
Hi, it seems that some buildds occasionally have libssl-dev installed in their chroot. A friend of mine has found out that the netatalk package depends on libssl0.9.8 [sparc] in sid and [hppa, mipsel] in squeeze. Other architectures are not affected. For GPL-licensed software like netatalk this

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Russ Allbery
Fabian Greffrath fab...@greffrath.com writes: it seems that some buildds occasionally have libssl-dev installed in their chroot. A friend of mine has found out that the netatalk package depends on libssl0.9.8 [sparc] in sid and [hppa, mipsel] in squeeze. Other architectures are not affected.

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Neil McGovern
On Tue, Jan 19, 2010 at 11:59:35AM -0800, Russ Allbery wrote: This is a bug in the netatalk Debian packaging. You cannot assume the package will be built in a clean chroot; among other things, the buildd software explicitly does not guarantee that all packages will be removed. Would it be

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Martin Zobel-Helas
Hi Neil, On Tue Jan 19, 2010 at 22:29:25 +, Neil McGovern wrote: On Tue, Jan 19, 2010 at 11:59:35AM -0800, Russ Allbery wrote: This is a bug in the netatalk Debian packaging. You cannot assume the package will be built in a clean chroot; among other things, the buildd software

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Russ Allbery
Neil McGovern ne...@debian.org writes: On Tue, Jan 19, 2010 at 11:59:35AM -0800, Russ Allbery wrote: This is a bug in the netatalk Debian packaging. You cannot assume the package will be built in a clean chroot; among other things, the buildd software explicitly does not guarantee that all

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Lucas Nussbaum
On 19/01/10 at 14:36 -0800, Russ Allbery wrote: Neil McGovern ne...@debian.org writes: On Tue, Jan 19, 2010 at 11:59:35AM -0800, Russ Allbery wrote: This is a bug in the netatalk Debian packaging. You cannot assume the package will be built in a clean chroot; among other things, the

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Holger Levsen
Hi, On Dienstag, 19. Januar 2010, Martin Zobel-Helas wrote: we already have two or three buildds doing that... The buildd team (esp. HE) working on that and if it works out to be stable enough, we can see if we can roll out it to all buildds. very cool. thank you! cheers, Holger

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Russ Allbery
Lucas Nussbaum lu...@lucas-nussbaum.net writes: On 19/01/10 at 14:36 -0800, Russ Allbery wrote: Well, I would argue that proper package builds in dirty environments is something we want in Debian anyway, and while this isn't the ideal method to find it, it would be a bug regardless of how the

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Patrick Schoenfeld
Hi, On Tue, Jan 19, 2010 at 03:40:22PM -0800, Russ Allbery wrote: Why would we want that? I mean, it's very difficult to guarantee that packages build correctly in dirty envs. I don't really see the point of enforcing that when we have the technology (pbuilder, sbuild + lvm snapshots)

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Julien Cristau
On Wed, Jan 20, 2010 at 00:48:15 +0100, Patrick Schoenfeld wrote: hu? since when do we have a broader interest in people patching and rebuilding packages? I know that there are *some* people interested in that (me included) but I don't see that a broader audience wants to support that. Just

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Russ Allbery
Patrick Schoenfeld schoenf...@debian.org writes: On Tue, Jan 19, 2010 at 03:40:22PM -0800, Russ Allbery wrote: Because we want our users to be able to patch and rebuild our software to suit their needs. Asking them to set up a chroot build environment is asking quite a lot. hu? since when

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Lucas Nussbaum
On 19/01/10 at 16:04 -0800, Russ Allbery wrote: People do occasionally test whether packages rebuild properly in dirty environments and file bugs when they don't. Being absolutely certain it will always work is, of course, hard, but I think fixing the bug when we detect it is the right

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Russ Allbery
Lucas Nussbaum lu...@lucas-nussbaum.net writes: On 19/01/10 at 16:04 -0800, Russ Allbery wrote: People do occasionally test whether packages rebuild properly in dirty environments and file bugs when they don't. Being absolutely certain it will always work is, of course, hard, but I think

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Holger Levsen
Hi, On Mittwoch, 20. Januar 2010, Lucas Nussbaum wrote: There are two ways to attack that problem: how about the compromise and doing both, except that for (1) we file the bugs with severity important? cheers, Holger signature.asc Description: This is a digitally signed message

Re: GPL-licensed software linked against libssl on buildds!

2010-01-19 Thread Lucas Nussbaum
On 20/01/10 at 01:49 +0100, Holger Levsen wrote: On Mittwoch, 20. Januar 2010, Lucas Nussbaum wrote: There are two ways to attack that problem: how about the compromise and doing both, except that for (1) we file the bugs with severity important? There are a lot of more useful QA tasks