ask github to encourage signed git tags

2015-08-21 Thread Thomas Koch
Hi, we want upstream to sign releases. Nowadays a lot of software is on github and a release is just a git tag. - An unsigned git tag ... :-( Github has a site that shows tags[1] but it does not give any indication whether the tag is signed or not. [1] e.g. https://github.com/Flameeyes/unpaper/

Re: ask github to encourage signed git tags

2015-08-21 Thread Timo Weingärtner
Hi, 2015-08-21 09:51:45 Thomas Koch: > we want upstream to sign releases. Nowadays a lot of software is on github > and a release is just a git tag. - An unsigned git tag ... :-( > > Github has a site that shows tags[1] but it does not give any indication > whether the tag is signed or not. > [1]

use signed git tags to verify upstream tarball

2015-08-21 Thread Thomas Koch
Sometimes we are lucky and upstream uses signed git tags. That still does not help us to verify the orig.tar.gz. It can however still be very useful. If we store some git objects in debian/upstream/.../ than we can at least verify those files that are the same in the tarball and in the tagged gi

Re: libstdc++ follow-up transitions

2015-08-21 Thread Simon McVittie
On 18/08/15 00:37, Steve Langasek wrote: > On Mon, Aug 17, 2015 at 01:46:16PM +0100, Simon McVittie wrote: >> Having done more rebuilds in Ubuntu, it would be great if you could >> publish a complete list of the transitions you believe to be necessary > > Here's the count of source packages in Ubu

Re: ask github to encourage signed git tags

2015-08-21 Thread Asheesh Laroia
On Fri, Aug 21, 2015 at 9:51 AM, Thomas Koch wrote: > > Does anybody have contact to github? > Yes, I do! I've pinged a friend at GitHub and CC:d the people who have participated in this thread so far. Let's see how that conversation goes. -- Asheesh.

Re: ask github to encourage signed git tags

2015-08-21 Thread Harlan Lieberman-Berg
Asheesh Laroia writes: > Yes, I do! I've pinged a friend at GitHub and CC:d the people who have > participated in this thread so far. Let's see how that conversation goes. Just as an FYI, signing a git tag produces a slightly weaker security guarantee than signing a tarball. Specifically, an att

Re: libstdc++ follow-up transitions

2015-08-21 Thread Rene Engelhard
Hi, On Fri, Aug 21, 2015 at 12:12:40PM +0100, Simon McVittie wrote: > hunspell is one notable exception, if it does indeed need renaming (I > haven't verified) It was already bin-NMUed without renaming 16d ago. That said, a testbuild of LO with non-transitioned libs did NOT give me a build failur

Bug#796337: ITP: node-cross-spawn-async -- Cross platform child_process#spawn

2015-08-21 Thread Ross Gammon
Package: wnpp Severity: wishlist Owner: Ross Gammon X-Debbugs-CC: debian-devel@lists.debian.org * Package name: node-cross-spawn-async Version : 2.0.0 Upstream Author : IndigoUnited (http://indigounited.com) * URL : https://github.com/IndigoUnited/node-cross-spawn-asy

Re: use signed git tags to verify upstream tarball

2015-08-21 Thread Danny Edel
On 21/08/15 11:12, Thomas Koch wrote: > Sometimes we are lucky and upstream uses signed git tags. That still does not > help us to verify the orig.tar.gz. It can however still be very useful. > Hi Thomas, In case you're intrested, I've tried to reproduce a "git archive" style tarball (for examp

Bug#796363: ITP: libsis-base-java -- supplies some utility classes needed for libraries like sis-jhdf5

2015-08-21 Thread Olivier Sallou
Package: wnpp Severity: wishlist Owner: Olivier Sallou * Package name: libsis-base-java Version : 14.12.0 Upstream Author : ETH Zuerich, CISD * URL : https://wiki-bsse.ethz.ch/display/JHDF5/Download+Page * License : Apache Programming Lang: C, Java Descript

Re: gfortran: handling binNMU for .mod file format change

2015-08-21 Thread Michael Banck
Hi, I had a look at your dh-fortran-mod package, and am quite sorry I missed this until now :-/ I assume this is meant for ${misc:Depends} in the -dev package, right? On Wed, Mar 12, 2014 at 06:44:50PM +0100, Sébastien Villemot wrote: > Le dimanche 11 août 2013 à 11:11 +0900, Ryo IGARASHI a écri

Who has rights to override/ignore systemd inhibitors?

2015-08-21 Thread Jayson Willson
Hello. I have realized, that my user (groups: tty,disk,mail,news,dialout,voice,sudo,audio,www-data,video,plugdev,users,mlocate,kvm,vboxusers,libvirt) can ignore inhibitors (such as root being logged in) using "systemctl suspend/poweroff/etc -i" without password prompt (with standard polkit conf

Re: Permissions on collab-maint

2015-08-21 Thread Geeg Geeg
I need... some shit.. just get me some shit... On Fri, Aug 21, 2015 at 12:12 PM, Alexander Wirt wrote: > Hi, > > I am doing some urgent fixes on debian collab-maint. After I finished only > DDs > (group Debian) will be able to create repos and change hooks. > > If you need to create a new reposi

Bug#796390: ITP: libsis-jhdf5-java -- HDF library for Java

2015-08-21 Thread Olivier Sallou
Package: wnpp Severity: wishlist Owner: Olivier Sallou * Package name: libsis-jhdf5-java Version : 14.12.1 Upstream Author : ETH Zuerich CISD * URL : http://svncisd.ethz.ch/repos/cisd/jhdf5/tags/release/ * License : Apache Programming Lang: C, Java Descript

Re: Bits from the Wanna Build team

2015-08-21 Thread Steve Langasek
Hi Mehdi, On Fri, Aug 21, 2015 at 01:12:12PM +0200, Mehdi Dogguy wrote: > Auto-building arch:all packages > === > We have worked on getting arch:all packages buildable on our > autobuilders. We've got a few patches [2,3] added to make that > happen. Architecture indepe

Re: Bits from the Wanna Build team

2015-08-21 Thread Jakub Wilk
* Mehdi Dogguy , 2015-08-21, 13:12: We tested our changes as much as we were able to and enabled arch:all uploads for Sid and Experimental. :D Before rushing on uploading source-only packages, please do test your packages by building, installing and testing them locally in order to minimize

Re: Bits from the Wanna Build team

2015-08-21 Thread Luca Falavigna
2015-08-21 19:54 GMT+02:00 Jakub Wilk : > Hmm, how do you build only arch:all packages in sbuild? See commit below, not uploaded to sid yet: https://anonscm.debian.org/cgit/buildd-tools/sbuild.git/commit/?id=fec82ed70d7efdfe17f676c60e1114bd8bb4a888 -- Cheers, Luca

Bug#796401: ITP: disorderfs -- FUSE filesystem that introduces non-determinism

2015-08-21 Thread Andrew Ayer
Package: wnpp Severity: wishlist Owner: Andrew Ayer * Package name: disorderfs Version : 0.1.0 Upstream Author : Andrew Ayer * License : GPL-3+ Programming Lang: C++ Description : FUSE filesystem that introduces non-determinism disorderfs is an overlay FUSE files

Re: Who has rights to override/ignore systemd inhibitors?

2015-08-21 Thread Simon McVittie
On 21/08/15 17:14, Jayson Willson wrote: > Hello. I have realized, that my user (groups: > tty,disk,mail,news,dialout,voice,sudo,audio,www-data,video,plugdev, > users,mlocate,kvm,vboxusers,libvirt) > can ignore inhibitors (such as root being logged in) using "systemctl > suspend/poweroff/etc -i" R

Re: Who has rights to override/ignore systemd inhibitors?

2015-08-21 Thread Jayson Willson
Thank you very much for your answer, I have understood everything. Only one question is left: Does it mean, that with such configuration those users, which are connected using ssh, for example, won't be able to shutdown computer, unless he passes polkit authentication? Also, are users, who logge

Re: Who has rights to override/ignore systemd inhibitors?

2015-08-21 Thread Simon McVittie
On 21/08/15 20:18, Jayson Willson wrote: > Does it mean, that with such configuration those users, which are > connected using ssh, for example, won't be able to shutdown computer, > unless he passes polkit authentication? You could try it and find out? But I believe you are correct. > Also, are

Bug#796464: general: there is no auto crash reporting

2015-08-21 Thread Richard Jasmin
Package: general Severity: important debian should implement an automatic crash detection and reporting system like Fedora and Ubuntu teams have.If not mistaken, Fedora uses upstream of what ubuntu uses --apport. There is no reason for debian to not have this feature.Yes, it is mostly a gui tool.

Bug#796464: general: there is no auto crash reporting

2015-08-21 Thread Aron Xu
On Sat, Aug 22, 2015 at 6:04 AM, Richard Jasmin wrote: > Package: general > Severity: important > > debian should implement an automatic crash detection and reporting system like > Fedora and Ubuntu teams have.If not mistaken, Fedora uses upstream of what > ubuntu uses --apport. > > There is no re

Bug#796467: general: if user has mail then how do we tell them if in GUI mode?

2015-08-21 Thread Richard Jasmin
Package: general Severity: important telling user has mail is easy as pi in console mode and when using a server. But how do we tell the user they have mail without a configured mail client when under runlevel 5? The activation of X11 practically hides all console activity. We would need a UI too

Re: Bug#796467: general: if user has mail then how do we tell them if in GUI mode?

2015-08-21 Thread Adam Borowski
On Fri, Aug 21, 2015 at 05:20:17PM -0500, Richard Jasmin wrote: > telling user has mail is easy as pi in console mode and when using a server. > But how do we tell the user they have mail without a configured mail client > when under runlevel 5? The activation of X11 practically hides all console >

Re: Bug#796467: general: if user has mail then how do we tell them if in GUI mode?

2015-08-21 Thread Riley Baird
On Fri, 21 Aug 2015 17:20:17 -0500 Richard Jasmin wrote: > Package: general > Severity: important > > telling user has mail is easy as pi in console mode and when using a server. > But how do we tell the user they have mail without a configured mail client > when under runlevel 5? The activation

Bug#796467: general: if user has mail then how do we tell them if in GUI mode?

2015-08-21 Thread Josh Triplett
On Fri, 21 Aug 2015 17:20:17 -0500 Richard Jasmin wrote: > telling user has mail is easy as pi in console mode and when using a server. > But how do we tell the user they have mail without a configured mail client > when under runlevel 5? The activation of X11 practically hides all console > acti

Re: Bug#796464: general: there is no auto crash reporting

2015-08-21 Thread Stephen Allen
On Fri, Aug 21, 2015 at 05:04:43PM -0500, Richard Jasmin wrote: > Package: general > Severity: important > > debian should implement an automatic crash detection and reporting system like > Fedora and Ubuntu teams have.If not mistaken, Fedora uses upstream of what > ubuntu uses --apport. apport i

Bug#796487: ITP: repeatmasker-recon -- indentification of repeat families from biological sequences

2015-08-21 Thread Olivier Sallou
Package: wnpp Severity: wishlist Owner: Olivier Sallou * Package name: repeatmasker-recon Version : 1.08 Upstream Author : Institute for Systems Biology * URL : http://www.repeatmasker.org/ * License : GPL Programming Lang: C, Perl Description : indenti