On Wed, 07 Sep 2016 08:41:19 +0200, Christoph Biedl wrote: > > One of the package that I maintain (python-asyncssh) makes a DNS request > > during build and expects it to fail. Since Policy 4.9 forbids network > > access (in a rather confusing wording "may not"), I got this serious > > bug: > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=830568 > This was my constant fear since the first day I learned about this > policy. While I consider the change the right thing, I'm somewhat > concerned the wording leads to requirements that neither were intended > nor are necessary to reach the goal that I consider the idea behind > it: The behaviour of any network activity must not affect the result > of the build.
IIRC (I didn't re-read the whole bug log now) the intention in
#770016 was indeed more than "not affect the build result" but
"explicitly forbid any attempt to access the network because leak".
As a result policy 4.9. now says:
For packages in the main archive, no required targets may attempt
network access.
which in my understanding makes a DNS lookup for example.org in a
test which fails gracefully and has no relation whatsoever to the
resulting binary package a policy violation and thereby an RC bug.
If this was not the original intention or if the community now comes
to the conclusion that this is maybe a bit over the top (as Russ' and
Vorlon's mails seem to imply, and I share their sentiments), I think
we need to change the wording in policy.
Cheers,
gregor
--
.''`. Homepage https://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
: :' : Debian GNU/Linux user, admin, and developer - https://www.debian.org/
`. `' Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
`- NP: Ben Weaver: Voice In The Wilderness
signature.asc
Description: Digital Signature
