[gentoo-dev] Re: Re: Council meeting summary for meeting on June 11, 2009

2009-06-21 Thread Steven J Long
Denis Dupeyron wrote: This list is for technical discussions only. I look forward to the day when that actually happens, and we are not regaled with countless emails about technical issues that were solved 3 years ago, accompanied by juvenile insults at anyone who might disagree. Also, public

Re: [gentoo-dev] [RFC] Overlays and Metadata Cache

2009-06-21 Thread Patrick Lauer
On Saturday 20 June 2009 21:00:46 Ciaran McCreesh wrote: On Sat, 20 Jun 2009 20:40:17 +0200 Patrick Lauer patr...@gentoo.org wrote: Have you thought about the security implications of this? Yes. How much do you trust the people running the overlays listed in layman?

Re: [gentoo-dev] Re: Re: Council meeting summary for meeting on June 11, 2009

2009-06-21 Thread Thomas Anderson
On Sun, Jun 21, 2009 at 08:09:04AM +0100, Steven J Long wrote: Denis Dupeyron wrote: This list is for technical discussions only. I look forward to the day when that actually happens, and we are not regaled with countless emails about technical issues that were solved 3 years ago,

Re: [gentoo-dev] packages up for grabs

2009-06-21 Thread Ben de Groot
Raúl Porcel wrote: Since i don't have too much time nor motivation to fix packages(i prefer doing arch work), i'm asking someone to take the following packages, i'm dumping them to net-p2p atm, but its just Betelgeuse and me, so feel free to maintain them. net-p2p/deluge

Re: [gentoo-dev] [RFC] Overlays and Metadata Cache

2009-06-21 Thread Ciaran McCreesh
On Sun, 21 Jun 2009 10:43:27 +0200 Patrick Lauer patr...@gentoo.org wrote: How much do you trust the people running the overlays listed in layman? VirtualBox. And how do you use VirtualBox to prevent one malicious person from running arbitrary code on the system of anyone using

Re: [gentoo-dev] Gentoo stats server/client @ 2009-06-21

2009-06-21 Thread Sebastian Pipping
First thanks for sharing your concerns and setup bits. That's the right thing at the the right time. Robin H. Johnson wrote: Relevant to this, I might not want to disclose my profile inheritance tree. Here's one of them for you: /etc/make.profile

Re: [gentoo-dev] [RFC] Overlays and Metadata Cache

2009-06-21 Thread Patrick Lauer
The metadata cache is inert in the sense that it isn't executable code (and if anyone tries to execute it ... You're doing it wrong comes to mind), so adding it does not pessimize the situation. But generating that cache means running code, and one of the things that code could do is

Re: [gentoo-dev] [RFC] Overlays and Metadata Cache

2009-06-21 Thread Ciaran McCreesh
On Sun, 21 Jun 2009 17:00:01 +0200 Patrick Lauer patr...@gentoo.org wrote: But generating that cache means running code, and one of the things that code could do is modify every overlay distributed by the box in question such that anyone using any of those overlays will run arbitrary code

[gentoo-dev] Gentoo Council 2009/2010 - _reopen_nominations candidate

2009-06-21 Thread Jorge Manuel B. S. Vicetto
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi. Due to an oversight on my part, the _reopen_nominations candidate was not initially added to the ballots for the council200906 election. This has now been fixed. If you have already voted, please add it (if you want to) to your ballot. I suggest

Re: [gentoo-dev] [RFC] Overlays and Metadata Cache

2009-06-21 Thread Zac Medico
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Patrick Lauer wrote: The metadata cache is inert in the sense that it isn't executable code (and if anyone tries to execute it ... You're doing it wrong comes to mind), so adding it does not pessimize the situation. But generating that cache means

Re: [gentoo-dev] Gentoo stats server/client @ 2009-06-21

2009-06-21 Thread Sebastian Pipping
Sebastian Pipping wrote: A) Download and keep a snapshot of layman-global.txt in sync ourselves B) Use heuristic on layman's cache - Resolve ${cache} from /etc/layman/layman.cfg - Parse all ${cache}/cache_*.xml files using the Layman API - Compare the list of

[gentoo-dev] Re: Gentoo stats server/client @ 2009-06-21

2009-06-21 Thread Duncan
Sebastian Pipping webmas...@hartwork.org posted 4a3e49c6.5070...@hartwork.org, excerpted below, on Sun, 21 Jun 2009 16:55:02 +0200: What it does not catch is people putting their own ebuilds right into the main tree. As they lose them all on the next sync are we safe to assume that no one

Re: [gentoo-dev] Gentoo stats server/client @ 2009-06-21

2009-06-21 Thread Robin H. Johnson
On Sun, Jun 21, 2009 at 04:55:02PM +0200, Sebastian Pipping wrote: Robin H. Johnson wrote: Relevant to this, I might not want to disclose my profile inheritance tree. Here's one of them for you: /etc/make.profile /etc/managed-portage/hosts/build_webdb/make.profile

[gentoo-dev] Re: Gentoo stats server/client @ 2009-06-21

2009-06-21 Thread Duncan
Robin H. Johnson robb...@gentoo.org posted robbat2-20090621t215006-7395728...@orbis-terrarum.net, excerpted below, on Sun, 21 Jun 2009 15:09:41 -0700: Any concerns or ideas for improvement? /usr/portage might NOT be from the public rsync. - Many devs have it straight from CVS. - Infra has it

[gentoo-dev] Automated Package Removal and Addition Tracker, for the week ending 2009-06-21 23h59 UTC

2009-06-21 Thread Robin H. Johnson
The attached list notes all of the packages that were added or removed from the tree, for the week ending 2009-06-21 23h59 UTC. Removals: x11-apps/lbxproxy 2009-06-16 07:02:20 remi x11-apps/proxymngr 2009-06-16 07:02:21 remi x11-apps/xfindproxy