Re: Permission to distribute

2024-04-06 Thread Paul Wise
On Thu, 2024-04-04 at 01:01 -0700, John Lee wrote: > I just wondered if I can sell computers that I build with Debian > Linux pre-installed. The computers may also include programs I > create. I tried to find the answer to this question but still > unsure.  In addition to the other response you g

Bug#1068521: ITP: kf6-kstatusnotifieritem -- Implementation of Status Notifier Items

2024-04-06 Thread Patrick Franz
Package: wnpp Severity: wishlist Owner: Patrick Franz X-Debbugs-Cc: debian-devel@lists.debian.org, delta...@debian.org,debian-qt-...@lists.debian.org * Package name: kf6-kstatusnotifieritem Version : 6.0.0 Upstream Contact: KDE * URL : https://invent.kde.org/framework

Bug#1068520: ITP: kf6-kcolorscheme -- Classes to read and interact with KColorScheme

2024-04-06 Thread Patrick Franz
Package: wnpp Severity: wishlist Owner: Patrick Franz X-Debbugs-Cc: debian-devel@lists.debian.org, delta...@debian.org,debian-qt-...@lists.debian.org * Package name: kf6-kcolorscheme Version : 6.0.0 Upstream Contact: KDE * URL : https://invent.kde.org/frameworks/kcolo

Bug#1068519: ITP: kf6-ktexttemplate -- Library to allow application developers to separate the structure of documents from the data they contain

2024-04-06 Thread Patrick Franz
Package: wnpp Severity: wishlist Owner: Patrick Franz X-Debbugs-Cc: debian-devel@lists.debian.org, delta...@debian.org, debian-qt-...@lists.debian.org * Package name: kf6-ktexttemplate Version : 6.0.0 Upstream Contact: KDE * URL : https://invent.kde.org/frameworks/kte

Bug#1068518: ITP: kf6-ksvg -- Library for rendering SVG-based themes with stylesheet re-coloring and on-disk caching

2024-04-06 Thread Patrick Franz
Package: wnpp Severity: wishlist Owner: Patrick Franz X-Debbugs-Cc: debian-devel@lists.debian.org, delta...@debian.org,debian-qt-...@lists.debian.org * Package name: kf6-ksvg Version : 6.0.0 Upstream Contact: KDE * URL : https://invent.kde.org/frameworks/ksvg * Licens

Re: xz backdoor

2024-04-06 Thread Christoph Anton Mitterer
Hey. Seems some of the reverse engineers may have found some more interesting stuff[0]. As far as I understand it, that would still require a running an reachable sshd (so we'd still be mostly safe). But he also thinks[1] that it may allow an interactive session. (Not that this would change a l

Re: xz backdoor

2024-04-06 Thread Pierre-Elliott Bécue
Hello, Michael Shuler wrote on 06/04/2024 at 16:31:28+0200: > On 4/5/24 10:30, Pierre-Elliott Bécue wrote: >> Pierre-Elliott Bécue wrote on 31/03/2024 at 14:31:37+0200: >>> Wookey wrote on 31/03/2024 at 04:34:00+0200: >>> On 2024-03-30 20:52 +0100, Ansgar 🙀 wrote: > Yubikeys, Nitrokey

Re: finally end single-person maintainership (Was: becoming a debian member under a not-real name)

2024-04-06 Thread Colin Watson
On Sat, Apr 06, 2024 at 06:32:47PM +0200, Bastian Germann wrote: > Am 06.04.24 um 18:29 schrieb Colin Watson: > > There might be some small errors in this, but I couldn't see any when > > eyeballing the resulting uniquified list of Maintainer fields. It looks > > like 78% of source packages in uns

Re: finally end single-person maintainership (Was: becoming a debian member under a not-real name)

2024-04-06 Thread Bastian Germann
Am 06.04.24 um 18:29 schrieb Colin Watson: There might be some small errors in this, but I couldn't see any when eyeballing the resulting uniquified list of Maintainer fields. It looks like 78% of source packages in unstable are team-maintained, which can't reasonably be called an "exception".

Re: New supply-chain security tool: backseat-signed

2024-04-06 Thread Jeremy Stanley
On 2024-04-06 16:30:44 +0100 (+0100), Simon McVittie wrote: [...] > Indeed, if upstream does ship generated files in addition to the actual > source code, we have traditionally said that Debian package maintainers > "should, except where impossible for legal reasons, preserve the entire > building

Re: New supply-chain security tool: backseat-signed

2024-04-06 Thread Simon McVittie
On Sat, 06 Apr 2024 at 15:54:51 +0200, kpcyrd wrote: > On 4/6/24 1:42 PM, Adrian Bunk wrote: > > You cannot simply proclaim that some git tree is the preferred form of > > modification without shipping said git tree in our ftp archive. > > > > If your claim was true, then Debian and downstreams wo

Re: Debian Project Leader election 2024: First call for votes

2024-04-06 Thread 陳昌倬
On Sat, Apr 06, 2024 at 01:46:28AM +0200, Debian Project Secretary - Kurt Roeckx wrote: > - - -=-=-=-=-=- Don't Delete Anything Between These Lines =-=-=-=-=-=-=-=- > 9c605edd-40a5-469c-9489-cbf80ac05970 > [1] Choice 1: Andreas Tille > [2] Choice 2: Sruthi Chandran > [ ] Choice 3: None Of The Abov

Re: New supply-chain security tool: backseat-signed

2024-04-06 Thread Adrian Bunk
On Sat, Apr 06, 2024 at 03:54:51PM +0200, kpcyrd wrote: >... > autotools pre-processed source code is clearly not "the preferred form of > the work for making modifications", which is specifically what I'm saying > Debian shouldn't consider a "source code input" either, to eliminate this > vector f

Re: xz backdoor

2024-04-06 Thread Michael Shuler
On 4/5/24 10:30, Pierre-Elliott Bécue wrote: Pierre-Elliott Bécue wrote on 31/03/2024 at 14:31:37+0200: Wookey wrote on 31/03/2024 at 04:34:00+0200: On 2024-03-30 20:52 +0100, Ansgar 🙀 wrote: Yubikeys, Nitrokeys, GNUK, OpenPGP smartcards and similar devices. Possibly also TPM modules in com

Re: New supply-chain security tool: backseat-signed

2024-04-06 Thread kpcyrd
On 4/6/24 1:42 PM, Adrian Bunk wrote: You cannot simply proclaim that some git tree is the preferred form of modification without shipping said git tree in our ftp archive. If your claim was true, then Debian and downstreams would be violating licences like the GPL by not providing the preferred

Bug#1068505: RFH: reprepro -- Move experimental multi-version feature to unstable

2024-04-06 Thread Bastian Germann
Package: wnpp X-Debbugs-Cc: debian-devel@lists.debian.org Control: affects -1 src:reprepro Hi, To tackle the much-requested #570623 multiple version management in reprepro, I took over Maintainership of the package and integrated the existing work in experimental. There are three important bugs

Re: New supply-chain security tool: backseat-signed

2024-04-06 Thread Guillem Jover
Hi! On Sat, 2024-04-06 at 19:13:22 +0800, Sean Whitton wrote: > On Fri 05 Apr 2024 at 01:31am +03, Adrian Bunk wrote: > > Right now the preferred form of source in Debian is an upstream-signed > > release tarball, NOT anything from git. > > The preferred form of modification is not simply up for

Re: New supply-chain security tool: backseat-signed

2024-04-06 Thread Adrian Bunk
On Sat, Apr 06, 2024 at 07:13:22PM +0800, Sean Whitton wrote: > Hello, > > On Fri 05 Apr 2024 at 01:31am +03, Adrian Bunk wrote: > > > > > Right now the preferred form of source in Debian is an upstream-signed > > release tarball, NOT anything from git. > > The preferred form of modification is

Re: Upstream dist tarball transparency (was Re: Validating tarballs against git repositories)

2024-04-06 Thread James Addison
Thanks for the response! On Fri, 5 Apr 2024 11:12:33 +0200, Guillem wrote: > On Wed, 2024-04-03 at 23:53:56 +0100, James Addison wrote: > > On Wed, 3 Apr 2024 19:36:33 +0200, Guillem wrote: > > > On Fri, 2024-03-29 at 23:29:01 -0700, Russ Allbery wrote: > > > > On 2024-03-29 22:41, Guillem Jover w

Re: Validating tarballs against git repositories

2024-04-06 Thread Sean Whitton
Hello, On Fri 05 Apr 2024 at 03:19pm +01, Simon McVittie wrote: > There are basically three dgit-compatible workflows, with some minor > adjustments around handling of .gitignore files: > > - "patches applied" (git-debrebase, etc.): > This is the workflow that proponents of dgit sometimes recom

Re: New supply-chain security tool: backseat-signed

2024-04-06 Thread Sean Whitton
Hello, On Fri 05 Apr 2024 at 01:31am +03, Adrian Bunk wrote: > > Right now the preferred form of source in Debian is an upstream-signed > release tarball, NOT anything from git. The preferred form of modification is not simply up for proclamation. Our practices, which are focused around git, mak