Re: merged /usr vs. symlink farms

2021-08-21 Thread Theodore Ts'o
On Sun, Aug 22, 2021 at 02:15:31AM +0200, Simon Richter wrote: > > The latter is what brought us into a situation where it is no longer safe to > move files between packages and between aliased directories in the same > upgrade, and because users will be expected to upgrade in a single step > betw

Re: merged /usr vs. symlink farms

2021-08-21 Thread Simon Richter
Hi, On 21.08.21 19:47, Luca Boccassi wrote: By all means, go and fix it, make it a top priority for dpkg to sort out, all hands on deck, whatever needed - but to demand the entire project has to stand still, and to de-facto derail the effort put in to catch up with the rest of the world by impo

Bug#992664: ITP: ruby-parser -- Ruby parser written in pure Ruby

2021-08-21 Thread Hideki Yamane
Package: wnpp Severity: wishlist Owner: Hideki Yamane X-Debbugs-Cc: debian-devel@lists.debian.org, pkg-ruby-extras-maintain...@lists.alioth.debian.org * Package name: ruby-parser Version : 3.0.2.0 * URL : https://github.com/whitequark/parser * License : MIT Pr

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Stephan Verbücheln
What about HTTP 304 Not Modified? Regards

Re: merged /usr vs. symlink farms

2021-08-21 Thread Guillem Jover
On Fri, 2021-08-20 at 07:56:33 -0600, Sam Hartman wrote: > > "Theodore" == Theodore Ts'o writes: > Theodore> FWIW, from following the discussion, I've become more and > Theodore> more convinced that a symlink farm is *not* the right > Theodore> answer, regardless of whether it is d

Re: merged /usr vs. symlink farms

2021-08-21 Thread Guillem Jover
On Sat, 2021-08-21 at 18:47:50 +0100, Luca Boccassi wrote: > My recollection (which might be wrong, but a quick look at release > notes seems to support it with 11.04 having multiarch 2 years before > Wheezy) is that Canonical led the way with the multiarch effort in > Ubuntu, and Debian followed w

Re: testing for rootfs vs. /usr reproducibility regressions

2021-08-21 Thread Timothy M Butterworth
On 8/21/21, Andy Smith wrote: > Hi Tim, > > On Fri, Aug 20, 2021 at 05:29:54PM -0400, Timothy M Butterworth wrote: >> I have a new-be question, what is the point of merged-usr? > > I put "debian merged-usr" into my favourite search engine and the > first result was: > > https://wiki.debian.org

Re: merged /usr vs. symlink farms

2021-08-21 Thread Colin Watson
On Sat, Aug 21, 2021 at 06:47:50PM +0100, Luca Boccassi wrote: > My recollection (which might be wrong, but a quick look at release > notes seems to support it with 11.04 having multiarch 2 years before > Wheezy) is that Canonical led the way with the multiarch effort in > Ubuntu, and Debian follow

Re: merged /usr vs. symlink farms

2021-08-21 Thread Luca Boccassi
On Sat, 2021-08-21 at 16:20 +0200, Wouter Verhelst wrote: > On Sat, Aug 21, 2021 at 02:40:02PM +0100, Luca Boccassi wrote: > > On Sat, 2021-08-21 at 10:26 +0200, Wouter Verhelst wrote: > > > It bothers me that you believe "we've been doing this for a while > > > and it didn't cause any problems, so

Re: testing for rootfs vs. /usr reproducibility regressions

2021-08-21 Thread Andy Smith
Hi Tim, On Fri, Aug 20, 2021 at 05:29:54PM -0400, Timothy M Butterworth wrote: > I have a new-be question, what is the point of merged-usr? I put "debian merged-usr" into my favourite search engine and the first result was: https://wiki.debian.org/UsrMerge Does this page and those linked fr

Re: merged /usr vs. symlink farms

2021-08-21 Thread Theodore Ts'o
On Sat, Aug 21, 2021 at 10:26:13AM +0200, Wouter Verhelst wrote: > It bothers me that you believe "we've been doing this for a while and it > didn't cause any problems, so let's just continue doing things that way > even if the people who actually wrote the damn code say that path is > littered wit

Re: merged /usr vs. symlink farms

2021-08-21 Thread Wouter Verhelst
On Sat, Aug 21, 2021 at 02:40:02PM +0100, Luca Boccassi wrote: > On Sat, 2021-08-21 at 10:26 +0200, Wouter Verhelst wrote: > > It bothers me that you believe "we've been doing this for a while > > and it didn't cause any problems, so let's just continue doing > > things that way even if the people

Re: merged /usr vs. symlink farms

2021-08-21 Thread Luca Boccassi
On Sat, 2021-08-21 at 10:26 +0200, Wouter Verhelst wrote: > On Fri, Aug 20, 2021 at 11:21:55AM +0100, Luca Boccassi wrote: > > On Thu, 2021-08-19 at 19:55 -0400, Theodore Ts'o wrote: > > > On Thu, Aug 19, 2021 at 10:39:45PM +0200, Simon Richter wrote: > > > > > > > > I think no one likes that idea

Re: merged /usr vs. symlink farms

2021-08-21 Thread Luca Boccassi
On Fri, 2021-08-20 at 23:15 +0200, Simon Richter wrote: > Hi, > > On 8/20/21 3:56 PM, Sam Hartman wrote: > > > Simon's position seemed to be that we need a dpkg update  in order > > to > > move forward and that we cannot depend on that mid-release. > > Yes, except if we give up "apt dist-upgrade

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Jeremy Stanley
On 2021-08-21 12:04:32 +0100 (+0100), Phil Morrell wrote: > On Sat, Aug 21, 2021 at 10:40:32AM +0200, Wouter Verhelst wrote: [...] > > However, I've not been able to come up with a scheme which is simple > > enough to be doable on a LAN while at the same time be usable by larger > > network provide

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread David Kalnischkies
On Sat, Aug 21, 2021 at 09:45:54AM +0200, Tomas Pospisek wrote: > On 21.08.21 09:14, Philipp Kern wrote: > > defense in depth if we wanted to, but maybe the world just agreed that > > you need to get your clock roughly correct. ;-) > > I remember seeing apt-get refusing to update packages or the i

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread David Kalnischkies
On Sat, Aug 21, 2021 at 12:04:32PM +0100, Phil Morrell wrote: > On Sat, Aug 21, 2021 at 10:40:32AM +0200, Wouter Verhelst wrote: > > On Fri, Aug 20, 2021 at 07:20:22PM +, Jeremy Stanley wrote: > > > Yes transparent proxies or overridden DNS lookups could be used to > > > direct deb.debian.org a

Re: Debian 11 Bullseye Setup Problems Error Report

2021-08-21 Thread Philip Hands
Paul Wise writes: > On Wed, Aug 18, 2021 at 10:42 AM admin4 wrote: > >> is there a Debian "testing" team? > > That is composed of everyone who uses Debian and especially those who > decide to report an issue they found. While that probably accounts for the bulk of the effort, there are also peo

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Thomas Goirand
On 8/20/21 4:56 PM, Russ Allbery wrote: > Jeremy Stanley writes: > >> I agree with all of the above, my point was that the current state of >> HTTPS doesn't especially improve integrity for Debian package management >> over the signed indices and checksums we already rely on, and trying to >> use

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Phil Morrell
On Sat, Aug 21, 2021 at 10:40:32AM +0200, Wouter Verhelst wrote: > On Fri, Aug 20, 2021 at 07:20:22PM +, Jeremy Stanley wrote: > > Yes transparent proxies or overridden DNS lookups could be used to > > direct deb.debian.org and security.debian.org to your alternative > > location, > > I've bee

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Philip Hands
Wouter Verhelst writes: > On Fri, Aug 20, 2021 at 07:20:22PM +, Jeremy Stanley wrote: >> Yes transparent proxies or overridden DNS lookups could be used to >> direct deb.debian.org and security.debian.org to your alternative >> location, > > I've been thinking for a while that we should bake

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Tobias Frost
On Sat, Aug 21, 2021 at 10:40:32AM +0200, Wouter Verhelst wrote: > On Fri, Aug 20, 2021 at 07:20:22PM +, Jeremy Stanley wrote: > > Yes transparent proxies or overridden DNS lookups could be used to > > direct deb.debian.org and security.debian.org to your alternative > > location, > > I've bee

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Andrew M.A. Cater
On Sat, Aug 21, 2021 at 12:31:26PM +0200, Simon Richter wrote: > Hi, > > On 21.08.21 10:40, Wouter Verhelst wrote: > > > I've been thinking for a while that we should bake a feature in apt > > whereby a network administrator can indicate somehow that there is a > > local apt mirror and that apt s

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Simon Richter
Hi, On 21.08.21 10:40, Wouter Verhelst wrote: I've been thinking for a while that we should bake a feature in apt whereby a network administrator can indicate somehow that there is a local apt mirror and that apt should use that one in preference to deb.debian.org. I've been thinking the same

Re: inconsistent mailgraph settings

2021-08-21 Thread Mattia Rizzolo
On Sat, Aug 21, 2021 at 10:36:04AM +0200, Tomas Pospisek wrote: > Hi Vincent, > > On 20.08.21 16:50, Vincent Lefevre wrote: > > My bug report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989734 > > has been closed again, with no explanations. > > https://bugs.debian.org/cgi-bin/bugreport.cgi

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Wouter Verhelst
On Fri, Aug 20, 2021 at 07:20:22PM +, Jeremy Stanley wrote: > Yes transparent proxies or overridden DNS lookups could be used to > direct deb.debian.org and security.debian.org to your alternative > location, I've been thinking for a while that we should bake a feature in apt whereby a network

Re: inconsistent mailgraph settings

2021-08-21 Thread Tomas Pospisek
Hi Vincent, On 20.08.21 16:50, Vincent Lefevre wrote: My bug report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989734 has been closed again, with no explanations. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989734;msg=12 claims that the bug was closed via https://bugs.debian.org

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Wouter Verhelst
On Thu, Aug 19, 2021 at 10:11:33PM +, Jeremy Stanley wrote: > On 2021-08-19 16:37:13 -0400 (-0400), Kyle Edwards wrote: > > On 8/19/21 3:46 PM, Simon Richter wrote: > > > For the most part, users would configure https if they are behind a > > > corporate firewall that disallows http, or modifie

Re: merged /usr vs. symlink farms

2021-08-21 Thread Wouter Verhelst
On Fri, Aug 20, 2021 at 11:21:55AM +0100, Luca Boccassi wrote: > On Thu, 2021-08-19 at 19:55 -0400, Theodore Ts'o wrote: > > On Thu, Aug 19, 2021 at 10:39:45PM +0200, Simon Richter wrote: > > > > > > I think no one likes that idea, but it's the only solution that doesn't > > > immediately fail bec

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Tomas Pospisek
On 21.08.21 09:14, Philipp Kern wrote: On 20.08.21 21:11, Russ Allbery wrote: The way I would put it is that the security benefit of using TLS for apt updates is primarily that it makes certain classes of attempts to mess with the update channel more noisy and more likely to produce immediate er

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Hideki Yamane
Hi all, Thanks for your comments! It seems that no big blocker to make https default for deb.debian.org and security.debian.org. On Thu, 19 Aug 2021 22:38:20 +0900 Hideki Yamane wrote: > Now deb.debian.org and security.debian.org provide https access > but created sources.list file use htt

Re: Q: Use https for {deb,security}.debian.org by default

2021-08-21 Thread Philipp Kern
On 20.08.21 21:11, Russ Allbery wrote: The way I would put it is that the security benefit of using TLS for apt updates is primarily that it makes certain classes of attempts to mess with the update channel more noisy and more likely to produce immediate errors. One thing of note is that it intro