[gentoo-dev] RFC: dnssec root key trust anchor package

2010-11-13 Thread Daniel Black

In light of the dnssec root key signing there is the issue of how to get this 
into default installs of operating systems. A number of programs that are 
DNSSEC aware will need access to the dnssec root key. I see this has the same 
problem that app-misc/ca-certificates solved and a net-dns/dnssec root package 
should be created to install the root key.

I'm thinking this should install into /etc/dnssec/ which would contain the 
root key in xml and a bind format (also used by unbound) along with the certs 
and keys required to verify this. (source http://data.iana.org/root-anchors/)

Looking at what other distros are doing I have only found the debian bug ( 
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;bug=594911 ) which is 
solving it for one package rather than for all DNSSEC root key users.

Looking at the ICANN proposals it seems this package will be updated every 2-5 
years. Managing this as a distribution package will acheive a more consistant 
rollover when this occurs compared to relying on users to manage their own 
dnssec root download and operations.

Am I going about this the right way or is there a better way?

Daniel



[gentoo-dev] Re: CAcert certificate distribution license to third parties (i.e. distributors like gentoo)

2010-06-26 Thread Daniel Black
On Sunday 13 December 2009 22:44:05 Daniel Black wrote:
 Recently this got produced as a draft license for parties distributing
 CAcert's root certificate(s) (like us).
 
 https://svn.cacert.org/CAcert/Policies/Agreements/3PVDisclaimerAndLicence.h
 tml
 
 This is still in draft hasn't been discussed in CAcert's policy group yet.
 
 If you want to follow/contribute to this discussion look for a post to the
 policy list soon.
 https://lists.cacert.org/wws/info/cacert-policy
 
 I make no inferences good or bad about this. Mainly because I'm writing
 this with a headache.
 
 Cheers,
 
 Daniel

Recently Sasha from Fedora has proposed CAcert's root distribution license as 
CC-ND. This avoids many complications of the draft proposal above.

By joining the list you can vote for it.

the proposal:
https://lists.cacert.org/wws/arc/cacert-policy/2010-06/msg00151.html

Once registered on this site there is a send to (your email) link on the top 
right to preserve threading.

ref: http://spreitzer.name/set-the-cacert-root-certificates-free

Daniel


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-dev] CAcert certificate distribution license to third parties (i.e. distributors like gentoo)

2009-12-16 Thread Daniel Black
On Tuesday 15 December 2009 23:19:22 Richard Freeman wrote:
 On 12/15/2009 01:46 AM, Daniel Black wrote:
  I did email the debian maintainer too. no response yet. They have
  interactive builds though and I guess we do too now. Will be a royal pain
  if every CA/software did the same thing.
 
 The last thing gentoo needs is interactive builds. 
agree.
 
 I'd rather put a disclaimer in the handbook that when you install gentoo
 you bear the consequences of anything you do with it: if you're in a
 jurisdiction where software licenses are binding on those who use
 software then be sure to set ACCEPT_LICENSE accordingly, and all users
 should monitor the outputs of their builds for important notices.
sounds reasonable.

 If legal experts feel that the only thing that will work would be an
 interactive build, then we should:
I'm not sure it is. Its very early days of this license.

after reading this license without (or significantly less of) a headache i'm 
thinking 1.4 2) to advice the end-user of the NRP-DaL refers to advising the 
user that the license exists rather the text of it. Gentoo maintainers could 
simple add the NRP-DaL to the LICENSE of the ebuild.  Portage 2.2's requiring 
the user add acceptable licenses to ACCEPT_LICENSE is probably sufficient.

 I'm generally in favor of including CACert by default, but if they're
 going to shoot themselves in the foot over licensing then that is their
 loss.
they aren't trying to they just don't know our issues. I did ask for wider 
consultation and to be wary of clauses incompatible with distributors normal 
operations.

 .. and I really don't see why CACert is pushing this either...

Clearing up a legal loop to allow distribution in a way that communicates the 
NRP-DaL to the end-user. Their own page http://www.cacert.org/index.php?id=3 
doesn't mention NRP-DaL either so as you can see, their are just progressing 
with a few little bumps and inconsistencies like everyone else.

https://lists.cacert.org/wws/arc/cacert-board/2009-12/msg00080.html


Daniel


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-dev] CAcert certificate distribution license to third parties (i.e. distributors like gentoo)

2009-12-15 Thread Daniel Black
On Tuesday 15 December 2009 07:10:25 Robin H. Johnson wrote:
 
 This is entirely moot. The CACert materials in Gentoo come from Debian's
 ca-certificates package. We do NOT independently supply them.
 http://packages.debian.org/sid/ca-certificates
 
 I think this might enable us to entirely sidestep a large part of the
 discussion.

quite possible.

 Watch what Debian does, and see what related actions if any we
  need to take.

I did email the debian maintainer too. no response yet. They have interactive 
builds though and I guess we do too now. Will be a royal pain if every 
CA/software did the same thing.



signature.asc
Description: This is a digitally signed message part.


[gentoo-dev] CAcert certificate distribution license to third parties (i.e. distributors like gentoo)

2009-12-13 Thread Daniel Black

Recently this got produced as a draft license for parties distributing 
CAcert's root certificate(s) (like us).

https://svn.cacert.org/CAcert/Policies/Agreements/3PVDisclaimerAndLicence.html

This is still in draft hasn't been discussed in CAcert's policy group yet.

If you want to follow/contribute to this discussion look for a post to the 
policy list soon.
https://lists.cacert.org/wws/info/cacert-policy

I make no inferences good or bad about this. Mainly because I'm writing this 
with a headache.

Cheers,

Daniel


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-dev] And thanks for all the fish...

2009-03-21 Thread Daniel Black

And thankyou for all the fish you've given.
http://cia.vc/stats/author/corsair

You've done a pretty good job of making Gentoo great especially for ppc64.

Good luck with whatever you do next.



[gentoo-dev] truecrypt licensing - bug #241650

2009-02-27 Thread Daniel Black

I've run out of interest to chase down the answer to the range of issues here.

Can someone with a few hours look trough all the info and see if truecrypt 
license has improved to a situation where it is not putting the gentoo-
foundation or gentoo user's at risk.

If you could provide a fully cited reply on the bug report.

Next step? Gentoo Foundation lawyers?

Sorry for the lack of interest especially to all those who want to use 
truecrypt in the time being.

Daniel Black



list purpose. was: Re: [gentoo-dev] Re: gentoo-x86 commit in app-forensics/memdump: memdump-1.0.1.ebuild ChangeLog

2009-01-05 Thread Daniel Black

I'm not sure I want to see this list being a QA list for commits.

If there is a commit that raises an interesting question for everyone sure put 
it here.

Otherwise please take up QA faults with the author or devrel if you think they 
are consistantly under-standard.

just my 2c.

-- 
Daniel Black dragonhe...@gentoo.org
Gentoo Foundation


signature.asc
Description: This is a digitally signed message part.


[gentoo-dev] Last Rites: app-crypt/tpm-module removal notice

2009-01-02 Thread Daniel Black
TPM support has been in the linux kernel for a while.

The current version doesn't build and is probably outdated (bug #249291).

app-crypt/tpm-module will be removed before February 2009.
-- 
Daniel Black dragonhe...@gentoo.org
Gentoo Foundation



Re: [gentoo-dev] Time to say goodbye

2008-12-24 Thread Daniel Black

Thanks for all your great work over the years.

Much appreciated.

Best wishes for whatever you end up doing.


-- 
Daniel Black dragonhe...@gentoo.org
Gentoo Foundation



Re: [gentoo-dev] Goodbye

2008-05-21 Thread Daniel Black

Alon,

Well ignoring the rant that largely ment you'd had enough, I just want to 
thankyou again.

You have been the best of any developer I have seen in terms of 
responsiveness, gentoo user (customer?) service, upstream collaboratation.

In your 1.5 - 2 years of doing gentoo developer work I hope others have picked 
on your leadership and, at least to themselves, appreciated the countless 
hours solving problems for Gentoo and upstream packages.

Thankyou for the countless hours that you have dedicated to keeping many 
crypto packages up to date, bug free, and working nicely with others.

In the solitude of effectively a one person herd, and i'm largely to blame, 
you've done exceptionally well. I'm note sure I could of coped as long.

I'm hoping at the end of such a dedicated time you have had some fun.

Keep well in whatever you do next.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


signature.asc
Description: This is a digitally signed message part.


[gentoo-dev] Re: [gentoo-commits] gentoo-x86 commit in profiles/default-linux/alpha: ChangeLog use.mask

2008-04-01 Thread Daniel Black
On Wed, 2 Apr 2008 12:51:59 am Christian Faulhammer wrote:
 Hi,

 Daniel Black (dragonheart) [EMAIL PROTECTED]:
  +  01 Apr 2008; Daniel Black [EMAIL PROTECTED] use.mask:
  +  mask ssh2 as net-libs/libssh2 does not have keywords yet

  How likely is it that libssh2 is anytime soon keyworded for all these
 arches?

Not sure - I'll do a bug report and see what happens.

 Up to now only amd64/x86 exist, so I propose masking 
 USE=libssh2 in base and unmask in amd64 and x86 profiles.

I've hopefully covered the other bases already (despite how potentially 
lengthy it was).

 V-Li



-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


signature.asc
Description: This is a digitally signed message part.


Re: [gentoo-dev] public system of ratings

2008-02-16 Thread Daniel Black
On Sat, 16 Feb 2008 07:49:09 pm Oleg Puchinin wrote:
 Day kind!
 I recently have started to use Gentoo, and I had one question.

I counted two.

 What for to charge developers of a problem of check of packages?
I don't know what this means.

  Why to not make public system of ratings?

There has been no major motivation to implement such a system.
  For example voting 

  is not compiled At all 
 works
 ...
 It is excellent
 I wish to see a package in Gentoo 

bugs.gentoo.org has the ability to assign votes to bugs. If you like something 
you can blog about it.

 And so for each [new] package.

Small amounts of this can be done on bug reports.

Get involved with overlay projects like sunrise to increase the usages of 
packages you like. Maybe oneday you'll even become a gentoo developer and can 
make a package mainstream.


 Oleg.



-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


signature.asc
Description: This is a digitally signed message part.


[gentoo-dev] kxdocker (and associated packages is being purged)

2007-08-04 Thread Daniel Black
The following packages have been masked pending removal in 30 days (roughly):

kde-misc/kxdocker-configurator
kde-misc/kxdocker-i18n
kde-misc/kxdocker-dcop
kde-misc/kxdocker
kde-misc/kxdocker-trayiconlogger
kde-misc/kxdocker-resources

Reasons:
- no developed by upstream [1]
- no active maintainer [2]

These are still available in the xeffects overlay for those who want them [3].

[1] http://www.xiaprojects.com/www/prodotti/kxdocker/main.php?action=download
[2] https://bugs.gentoo.org/show_bug.cgi?id=124159#c3
[3] http://www.gentoo.org/proj/en/overlays/userguide.xml

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpvljmlQRs82.pgp
Description: PGP signature


[gentoo-dev] Last rites for app-forensics/regviewer

2007-06-21 Thread Daniel Black
regviewer has a compile problem due to ancient autoconf goo that hasn't been 
updated (bug #154763)

Its last (and only) upstream release was in 2003.

I'm not sure what drugs I was on when I added it however it will be removed 
with extreme sober prejudice in the next few weeks without a fresh maintainer 
to defend it.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpXArHLtFMkt.pgp
Description: PGP signature


[gentoo-dev] trial software in portage?

2007-05-14 Thread Daniel Black

As software licenses seem to be so popular to talk about on gentoo-dev how 
about this one.

Marijn mentioned on Irc that the bestcrypt license commercial trial license 
shouldn't be a supported package in Gentoo.

Seeking further there is more

Other licenses with a free time limited evaluation that are supported in 
Gentoo portage:
ALMWorks-1.2
Arkkra
OTN
RAR

BestCrypt is similar:
BestCrypt for Linux is distributed as software with 30 days evaluation 
period. After evaluation period expired, the user has to either pay for 
his/her copy of BestCrypt software for Linux or uninstall it. (see  End User 
License Agreement.)
http://www.jetico.com/index.htm#/linux.htm (Additional Notes)

Is there a need for official policy here (and a bit of package removals)?


-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpfekwYzQnoB.pgp
Description: PGP signature


[gentoo-dev] afflib licence (BSD4 like)

2007-02-07 Thread Daniel Black
Was looking at http://www.afflib.org/LICENSE.txt and was wondering if it 
really had any Gentoo implications with adding it as a package.

I asked a few questions. Does the following seem reasonable?

[1] https://bugs.gentoo.org/show_bug.cgi?id=123175

--  Forwarded Message  --

Subject: Re: afflib licence
Date: Wednesday 07 February 2007 09:56
From: Simson Garfinkel [EMAIL PROTECTED]
To: Daniel Black [EMAIL PROTECTED]
Cc: Brian Carrier [EMAIL PROTECTED], Carl Hoffman [EMAIL PROTECTED]

Hi, Daniel. Thanks for your email. We'd be happy to have you add
AFFLIB to the Gentoo distribution.

I'll answer your questions:
 Is inclusion in an online database like http://packages.gentoo.org?
 advertising and therefore subject to the clause 3?

No, we do not consider that advertising.

 What happens if a security
 vulnerability is found and a GLSA (Gentoo Linux Security Advisory)
 is issued.

We wouldn't consider that to be an advertisement either.

 What about a magazine article on Gentoo?

We don't consider that to be an advertisement.

 The University of California, Berkeley revoked their clause 3 in
 1999 I
 believe because of similar legal vagueness over advertising.
 (ref: http://www.freebsd.org/copyright/license.html)

Yes, I'm aware that they did this.

We've decided to keep the advertising clause because Basis
Technology, the company that funded a substantial amount of the
AFFLIB development, wishes to be acknowledged in computer forensic
products that use AFF.  We do not consider the bundling of AFFLIB on
a CDROM or online distribution of Linux utilities to meet the
requirements in section 3.

Section 3 states:

* 3. All advertising materials mentioning features or use of this
software
*must display the following acknowledgement:

If your advertising of Gentoo mentions features or use of AFFLIB,
then we would expect you to say that AFFLIB is a product of Simson
Garfinkel and Basis Technology. But if you are merely including the
code and not mentioning the fact that you include AFFLIB in your
advertisements, then you have no need to mention Simson Garfinkel or
Basis Technology in your advertisements either.

I hope that this email clears up any questions that you might have.
But if you have others, please feel free to drop me an email.

-Simson

On Feb 6, 2007, at 6:58 AM, Daniel Black wrote:
 Simson,

 Was looking at the afflib product and was considering adding it to
 the Gentoo
 distribution when I looked at the license and found the BSD-4 license
 variant.

 The problem with the particular license is the condition 3
 advertising clause
 and its vagueity.

 Is inclusion in an online database like http://packages.gentoo.org?
 advertising and therefore subject to the clause 3? What happens if
 a security
 vulnerability is found and a GLSA (Gentoo Linux Security Advisory)
 is issued.
 Is this an advertisement? If Gentoo does a booth at an Expo is this
 included?
 What about a magazine article on Gentoo?

 The University of California, Berkeley revoked their clause 3 in
 1999 I
 believe because of similar legal vagueness over advertising.
 (ref: http://www.freebsd.org/copyright/license.html)

 Can you consider doing the same?

 Other references:
 http://farragut.flameeyes.is-a-geek.org/articles/2007/01/08/a-
 shadow-lies-upon-all-bsd-distributions
 --
 Daniel Black [EMAIL PROTECTED]
 Gentoo Foundation

---

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpidPCO0WYp1.pgp
Description: PGP signature


Re: [gentoo-dev] eclass proposal - savedconfig.eclass - draft commited

2007-02-04 Thread Daniel Black
Added draft of eclass as savedconfig.eclass. Hope it includes all suggested 
technical options.

There is a masked version of dropbear-0.48.1-r1 that uses it.

Hope it suits your needs.

Feel free to abuse my coding style (or lack there of). Or poor use of bash 
schematics.

On my todo list is:
- to move away from cp --parents with something BSD friendly.
- understand what $PORTAGE_CONFIGROOT is

Could consider if anyone is interested:
- USE=SAVEDCONFIG capitalised so that it looks and is assumed to be 
dominate.
- pkg_postinst - ewarn have modified the saved configuration of this package. 
I assume you have set your USE flags to include the appropriate dependencies 
and/or emerged the dependencies already.
- implement warn_config (though I don't think its really needed)

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpmidpUiJ7NI.pgp
Description: PGP signature


Re: [gentoo-dev] new herd suggestion: religion

2007-02-02 Thread Daniel Black

Wondering if the religion herd would kindly see over the last rites of 
packages on their journey into oblivion?

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpJiNMiFzyiY.pgp
Description: PGP signature


Re: [gentoo-dev] eclass proposal - savedconfig.eclass

2007-02-01 Thread Daniel Black
On Thursday 01 February 2007 18:48, Mike Frysinger wrote:
 On Thursday 01 February 2007, Daniel Black wrote:
  Also creates the following symlinks to it

 i dont see much value in these symlinks ... what do they gain us ?


An easy way to find the closest config when merging a revision/version bump of 
the same package. There are probably some cleaner ways with portage foo.

I see your point that it is a weak reason for symlinks to exist. The hard work 
should be done by the eclass to find the closest config.

  As some packages, like uclibc, have regular cross compile functionality
  which require separate config files for each host. This can be achieved
  with the -s option.

 i dont think the ebuild should care whether it's being cross-compiled ...
 any package should be cross-compilable so the ebuild should really be
 agnostic

 in other words, the search path for the .config should always check
 $CTARGET subdirs followed by $CHOST followed by the normal $CATEGORY

Sure, makes sense.

So clarifying by default the save_config will store it in normal $CATEGORY and 
allow the user to move it into under specific $CTARGET or $CHOST directory if 
that is their desire.

 -mike

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpEiqgUFRzCx.pgp
Description: PGP signature


Re: [gentoo-dev] eclass proposal - savedconfig.eclass

2007-02-01 Thread Daniel Black
On Thursday 01 February 2007 18:55, Brian Harring wrote:
 On Thu, Feb 01, 2007 at 06:21:01PM +1100, Daniel Black wrote:
  Fellow devs,
  WARN_CONFIG
 
  warn_config (useflags)
 
  warns the user that the useflags have been overridden by savedconfig
 
  Anything else?

 overriding use flags by a secondary configuration is a mess waiting to
 happen... needs actual integration in some fashion imo, rather then
 well... you probably should define it in both since it may ignore
 it.

So some foo that says:
die you have enabled X USE flag but your saved config reflects the X USE flag 
been unset. Please correct your saved config by setting GUI=yes 
in /etc/portage/savedconfig/${CATEGORY}/${PXXX}/config.h or unset the USE 
flag X.

Suggested implementation?

 Goes without saying, ignoring manager forced use configuration also
 means crap/missing deps are thus possible...

Yes. So a consistant USE flags/savedconfig is highly desireable.


 Feel free to clarify that little snippet ;)
 ~harring

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpTxvOLRTnEW.pgp
Description: PGP signature


Re: [gentoo-dev] New developer: Martin Jackson (mjolnir)

2007-02-01 Thread Daniel Black

 Please welcome Martin as a new fellow developer among us !

Welcome to Gentoo and netmon in particular.

May your free time be filled with many solved bug reports, version bumps, and 
better integration activities.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpdhj1tgAqwk.pgp
Description: PGP signature


Re: [gentoo-dev] New developer: Dean Stephens (desultory)

2007-02-01 Thread Daniel Black
On Friday 02 February 2007 06:02, Christian Heim wrote:
 It's my pleasure to introduce to you Dean Stephens (also known as
 desultory) our latest addition joining the forums monkeys.

 Dean is joining us from Bangor (that's in Maine). Don't know anything else
 about him, so feel free to harass him on IRC.

The good thing about the Gentoo community is there is so many mediums to 
harass you. Its all about choice after all.

 So please welcome Dean as a new fellow developer among us !

Welcome.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgppr2IEnyiqK.pgp
Description: PGP signature


Re: [gentoo-dev] eclass proposal - savedconfig.eclass

2007-02-01 Thread Daniel Black
On Friday 02 February 2007 06:27, Ciaran McCreesh wrote:
 On Thu, 1 Feb 2007 04:50:20 -0500 Mike Frysinger [EMAIL PROTECTED]

 wrote:
 | easier to just say USE=savedconfig overrides everything else

 Which means no dep resolution...

USE flags are still used for dependencies.

On Thursday 01 February 2007, Daniel Black wrote:
 The savedconfig configuration control does NOT aim to:
 - replace the USE flag determination of dependencies

It will be possible to configure an option that conflicts with a USE flag in 
some cases. Given the grief that would be caused by trying to determine this 
on every package that uses savedconfig it really isn't worth it.

Having said that there are 2 pseudo options here:

make USE=SAVEDCONFIG capitalised so that it looks and is assumed to be 
dominate.

ewarn You have modified the saved configuration of this package. I assume you 
have set your USE flags to include the appropriate dependencies and/or 
emerged the dependencies already.


-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgp821Hc5OAs6.pgp
Description: PGP signature


[gentoo-dev] eclass proposal - savedconfig.eclass

2007-01-31 Thread Daniel Black
 else?

Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpekacYAqKrP.pgp
Description: PGP signature


Re: [gentoo-dev] [RFC] Ideas for projects...

2007-01-22 Thread Daniel Black

While hanging around lca07 it was mentioned how bandwidth hungry Gentoo is.

Given a lot of the world is still on dialup this could increase the potential 
userbase for Gentoo.

As such the project idea is Automated Xdelta Generation.

principles:
no manual generation of xdeltas by gentoo devs
simple user usage (FEATURES=xdelta)
avoiding digesting problems
remain compatible with existing ebuilds

user interface:

FEATURES=xdelta emerge ~sys-kernel/gentoo-sources-2.6.20
found /usr/portage/distfiles/linux-2.6.19.tar.bz2
fetching linux-2.6.19_xdelta_2.6.20.xdelta
generating linux-2.6.20.tar
digest /usr/portage/distfiles/linux-2.6.20.tar matches
storing /usr/portage/distfiles/linux-2.6.20.tar.bz2
(more fetching)
unpacking
..
...
...

FEATURES=xdelta emerge ~sys-kernel/hardened-sources-2.6.20
found /usr/portage/distfiles/linux-2.6.20.tar.bz2
digest mismatch - checking linux-2.6.20.tar
digest good - assuming it was xdelta generated
(more fetching)
unpacking
.

I'm thinking xdeltas that gets generated on the staging server and some portage 
support so facilitate a minimal download.

Note: i haven't looked at previous xdelta portage patches from years ago.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpb4nnRYGEDq.pgp
Description: PGP signature


Re: [gentoo-dev] bugs.gentoo.org migration - completed! -THANKYOU

2007-01-07 Thread Daniel Black

 Thanks to myself, kingtaco, ramereth, solar, jforman and cshields for
 all playing a part of getting this together so far!

 A special thank you to our sponsor GNi (gni.com) for the hardware.
 I hear there will be an article on them in an upcoming GWN.

Thankyou all,

You've spent many hours working towards a smooth transition and this has 
occurred really smoothly (as far as I have seen).

I've noticed the usage of bugs.gentoo.org is now, dare i say it, 
pleasureable :-).

Thankyou again GNI for your hardware.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpGh0CCsOUk5.pgp
Description: PGP signature


Re: [gentoo-dev] New Developer: Alon Bar-Lev (alonbl)

2006-10-06 Thread Daniel Black

Welcome Alon,

Pleasure to have you on board.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation
-- 
gentoo-dev@gentoo.org mailing list



[gentoo-dev] gnutls-1.4.4 unmasked and becoming stable

2006-09-21 Thread Daniel Black
As previously mentioned versions prior to gnutls-1.4.4 have an outstanding 
security bug https://bugs.gentoo.org/show_bug.cgi?id=147682.

This package (gnutls-1.4.4), and (libtasn1-0.3.5), have now been unmasked and 
some are stabled.

After emerging these packages a revdep-rebuild will be required for packages 
that link against gnutls (and libtasn1) to work.

If any package fails to build against the newer gnutls please file a bug at 
bugs.gentoo.org.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation
-- 
gentoo-dev@gentoo.org mailing list



Re: [gentoo-dev] help with gnutls-1.4.4 needed[FIXED] - helpers still very welcome.

2006-09-19 Thread Daniel Black
On Tuesday 19 September 2006 21:35, Daniel Black wrote:
 As reported
 https://bugs.gentoo.org/show_bug.cgi?id=147800 gnutls-1.4.4 links itself
 against an existing gnutls-1.2* version if installed. I haven't been able
 to find the cause of this.

Bug fixed in gnutls-1.4.4-r1.

Testers still welcome as below.

 If anyone missed my previous plea to do some preliminary testing with
 gnutls here it is again:
 ---
 To participate please:
 1. add
 ~net-libs/gnutls-1.4.4
 ~dev-libs/libtasn1-0.3.5
 to /etc/portage/package.unmask and /etc/portage/package.keywords files.

 2. emerge -1 ~net-libs/gnutls-1.4.4

 3. run revdep-rebuild

 4. and report bugs on bugs.gentoo.org making them block bug 147682

 revdep-rebuild may get the order of the rebuild incorrect so please watch
 out for this error.
 


 --
 Daniel Black [EMAIL PROTECTED]
 Gentoo Foundation

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation
-- 
gentoo-dev@gentoo.org mailing list



Re: [gentoo-dev] security test request - gnutls-1.4.4 and libtasn1-0.3.5

2006-09-15 Thread Daniel Black
On Thursday 03 August 2006 15:42, Daniel Black wrote:
 I've added new versions of these libs to gentoo. They are currently in
 package.mask because I've missed a few bumps versions in between and there
 is an ABI change. Some old deprecated functions have been removed.

 So far these have been working for me fine however I'd appreciate your
 assistance in further testing these before I unmask them.


Well a security bug has come up requiring a stable version of packages that 
are currently masked. I don't envisage mass breakage thanks to those of you 
who have previously tested the  gnutls 1.4.1 versions.

I would however appreciate a little more testing before it is marked stable.

To participate please:
1. add
~net-libs/gnutls-1.4.4
~dev-libs/libtasn1-0.3.5
to /etc/portage/package.unmask and /etc/portage/package.keywords files.

2. emerge -1 ~net-libs/gnutls-1.4.4

3. run revdep-rebuild

4. and report bugs on bugs.gentoo.org making them block bug 147682

I much appreciate your assistance in this manner.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Foundation


pgpmAYLhnz9AZ.pgp
Description: PGP signature


Re: [gentoo-dev] Brand spanking new developer - Anrdrew Ross aka aross

2006-08-09 Thread Daniel Black

  Hope so - don't want rumors that Gentoo kills relationships.

 Yes, that would be bad.. and may make the need for date-a-dev even more
 apparant.. And we don't want that. (There is no way I'm letting antarus
 and ChrisWhite win..)

Adopt a Developer needs developer requests?

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Crypto/Forensics/NetMon


pgppkPkaDgeZq.pgp
Description: PGP signature


[gentoo-dev] packages seeking maintainers

2006-08-03 Thread Daniel Black
I'm looking to offload the some packages to willing maintainers as I've really 
no interest in most of these. Most have no bugs outstanding. I mainly want to 
focus my efforts in other areas.

Existing devs feel free to just reassign metadata.xml to themselves and 
reassign a possible bug (or 2) outstanding. The * marked gnome applications 
I'm particularly keen to pass on as I am not a gnome user and don't have a 
sufficient testing environment for these (these are simple nicely packaged 
applications).

If you're not a dev and have an interest in a HIGH EFFORT package, or a number 
of medium effort applications, I'll consider being your mentor. My ability to 
mentor will be limited by the number of applicants. I may not be able to 
mentor you immediately. Applicants should have at least solved 20 bugs (not 
all of them version bumps) and have a good understanding of ebuilds 
(devmanual.gentoo.org).

Below are the packages sorted by maintainer's effort.

HIGH EFFORT
dev-embedded/avr-libc
dev-libs/ace
dev-util/cmake
dev-util/monotone

MEDIUM EFFORT:
app-crypt/johntheripper
dev-libs/botan
dev-embedded/avrdude
dev-embedded/pista
dev-embedded/yapide
app-benchmarks/iozone
app-benchmarks/lmbench
app-benchmarks/volanomark

Was trying to recruit someone for these 
https://bugs.gentoo.org/show_bug.cgi?id=124159
kde-misc/kxdocker
kde-misc/kxdocker-configurator
kde-misc/kxdocker-dcop
kde-misc/kxdocker-i18n
kde-misc/kxdocker-resources
kde-misc/kxdocker-trayiconlogger

media-libs/ploticus
media-video/dvdstyler
sys-apps/ifd-gempc
x11-misc/electricsheep
app-arch/sharutils

LOW EFFORT
sys-power/cpuspeedy
sys-power/gtk-cpuspeedy
*x11-libs/gksu
*x11-libs/libgksu
*x11-libs/libgksuui
*dev-util/alleyoop
app-editors/lfhex   A fast, efficient hex-editor with support 
for large files
app-emulation/libdsklibrary for accessing discs and disc 
image files.
dev-libs/blitz
dev-libs/log4c
media-libs/libptp2
net-dns/noip-updater
net-dns/updatedd
net-ftp/frox
net-misc/ipsorcery
net-misc/tinc
sys-libs/libstatgrab

NO EFFORT  (Normally a dead upstream.)
app-admin/kedpm
app-admin/ranpwd
app-admin/sdsc-syslog
app-cdr/sync2cd
an incremental archiving tool to CD/DVD
app-crypt/scsign
smartcard signing application
app-misc/pipeworks
app-shells/rrs
app-text/rfcutil
dev-db/gmyclient
dev-libs/mdsplib   METAR Decoder Software Package Library
dev-tcltk/tclgpgme
dev-util/intel2gas
media-gfx/fbv
net-analyzer/neti
net-misc/snitch
net-libs/roadrunner
sys-fs/cowloop
net-ftp/pftpfxp

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Crypto/Forensics/NetMon


pgpZd6ijNah9Z.pgp
Description: PGP signature


[gentoo-dev] test request - gnutls-1.4.1 and libtasn1-0.3.4

2006-08-02 Thread Daniel Black
I've added new versions of these libs to gentoo. They are currently in 
package.mask because I've missed a few bumps versions in between and there is 
an ABI change. Some old deprecated functions have been removed.

So far these have been working for me fine however I'd appreciate your 
assistance in further testing these before I unmask them.

To participate please:
1. add
~net-libs/gnutls-1.4.1
~dev-libs/libtasn1-0.3.4
to /etc/portage/package.unmask and /etc/portage/package.keywords files.

2. run revdep-rebuild

3. and report bugs on bugs.gentoo.org

Appreciate your assistance in this manner.

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Crypto/Forensics/NetMon


pgp2RuDS8uZqg.pgp
Description: PGP signature


[gentoo-dev] ethereal moved to wireshark

2006-07-25 Thread Daniel Black

As you probably read yesterday in GWN[1], Ethereal is being removed due to 
security vulnerabilities[2] and replaced with its successor, Wireshark.

Ethereal, as far as anyone can tell, is no longer being developed[3] as all 
the core developers have moved to Wireshark[4].

To make this transition as painless as possible, a package move has been setup 
so Ethereal users should automatically upgrade to Wireshark.

To keep the saved configuration from Ethereal and reuse it with Wireshark do 
the following for each user that has a saved Ethereal configuration:

cd $HOME
mv .ethereal .wireshark

[1] http://www.gentoo.org/news/en/gwn/20060724-newsletter.xml#doc_chap1_sect2
[2] http://security.gentoo.org/glsa/glsa-200607-09.xml
[3] http://www.ethereal.com/lists/ethereal-cvs/200605
[4] http://www.wireshark.org/faq.html#q1.2

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Crypto/dev-embedded/Forensics/NetMon


pgpXGDbgF8RVu.pgp
Description: PGP signature


Re: [gentoo-dev] ethereal moved to wireshark

2006-07-25 Thread Daniel Black
On Wednesday 26 July 2006 01:16, Graham Murray wrote:
 Is there an equivalent of (or replacement for) the command line
 tethereal?
tshark

-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Crypto/dev-embedded/Forensics/NetMon


pgpj1Ot1BfcHs.pgp
Description: PGP signature


Re: [gentoo-dev] Making dobin, doexe die by default and doins, doman, dodoc warn initially

2006-07-12 Thread Daniel Black
On Thursday 13 July 2006 07:36, Steve Dibb wrote:
 Henrik Brix Andersen wrote:
  On Wed, Jul 12, 2006 at 11:11:01PM +0200, Jakub Moc wrote:
  Uh... Sorry but it's pretty hard to imagine something more annoying than
  an ebuild that dies after a couple of hours compile just because
  upstream decided to rename Changelog.txt to ChangeLog.txt and noone
  noticed  during version bump, or because someone made a typo there. Fail
  to see any benefit from this... :S Ditto for manpages.
 
  How could that slip through the initial testing of the ebuild
  performed by the developer doing the version bump?

 Well, it could happen while testing an ebuild. :)  I'd be pretty ticked
 if I were testing Qt and I didn't realize they did change the doc files
 around before doing a test run.

there is always,

1. oh golly I made a mistake
2. rm -rf /var/tmp/portage/{package}/image
3. (vi|emacs|nano) {package}.ebuild
4. FEATURES=noauto ebuild  {package}.ebuild install
5. victory

sure the may be some packages that don't like going through an install twice 
but I'd hope most of the bigger ones would oblige happily.

A FEATURE like dowarn as an alternate to what John Myers said maybe be good 
for the time conscious dev.

 Besides that though, imho, a simple function with a boolean return type
 shouldn't kill the script executing it.  Throw a warning, yes, but not
 stop everything.

 Steve

As a general implementation strategy I think portage should
initially:
die on dobin, doexe

warn on
doins, doman, doexe

After the QA stuff is fixed in the tree, and the general feeling that mass 
hysteria won't break out because of it, change the warns to a die.

ECLASSES

if these use doins/man/doc then the should probably check them before 
installing:
[ -f ${doc} ]  dodoc ${doc}



-- 
Daniel Black [EMAIL PROTECTED]
Gentoo Crypto/dev-embedded/Forensics/NetMon


pgpvHx9mQGdVB.pgp
Description: PGP signature