Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel > #111334

Re: New supply-chain security tool: backseat-signed

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hello,

On Sat 06 Apr 2024 at 02:42pm +03, Adrian Bunk wrote:

> On Sat, Apr 06, 2024 at 07:13:22PM +0800, Sean Whitton wrote:
>> Hello,
>>
>> On Fri 05 Apr 2024 at 01:31am +03, Adrian Bunk wrote:
>>
>> >
>> > Right now the preferred form of source in Debian is an upstream-signed
>> > release tarball, NOT anything from git.
>>
>> The preferred form of modification is not simply up for proclamation.
>> Our practices, which are focused around git, make it the case that
>> salsa & dgit in some combination are the preferred form for modification
>> for most packages.
>
> You cannot simply proclaim that some git tree is the preferred form of
> modification without shipping said git tree in our ftp archive.
>
> If your claim was true, then Debian and downstreams would be violating
> licences like the GPL by not providing the preferred form of modification
> in the archive.

Well, maybe we are!  Or maybe we're not when we publish those histories
on salsa and/or dgit-repos.

It also seems important to note that this is project-specific.  Whether
the git history is part of the preferred form of modification depends on
the project's practices and content.

I don't have a settled opinion on what we should be doing.  But what I
am sure about is that the preferred form for modification is determined
by the content of the project, and we can't change what the preferred
form for modification actually is just by choosing what exactly we
publish.

-- 
Sean Whitton

Back to linux.debian.devel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: New supply-chain security tool: backseat-signed Adrian Bunk <bunk@debian.org> - 2024-04-06 09:50 +0200
  Re: New supply-chain security tool: backseat-signed Jeremy Stanley <fungi@yuggoth.org> - 2024-04-06 09:50 +0200
  Re: New supply-chain security tool: backseat-signed kpcyrd <kpcyrd@archlinux.org> - 2024-04-06 09:51 +0200
    Re: New supply-chain security tool: backseat-signed Adrian Bunk <bunk@debian.org> - 2024-04-06 09:51 +0200
      Re: New supply-chain security tool: backseat-signed kpcyrd <kpcyrd@archlinux.org> - 2024-04-06 09:51 +0200
        Re: New supply-chain security tool: backseat-signed Adrian Bunk <bunk@debian.org> - 2024-04-06 09:52 +0200
      Re: New supply-chain security tool: backseat-signed James McCoy <jamessan@debian.org> - 2024-04-06 09:52 +0200
      Re: New supply-chain security tool: backseat-signed Sean Whitton <spwhitton@spwhitton.name> - 2024-04-06 13:20 +0200
        Re: New supply-chain security tool: backseat-signed Adrian Bunk <bunk@debian.org> - 2024-04-06 14:10 +0200
          Re: New supply-chain security tool: backseat-signed kpcyrd <kpcyrd@archlinux.org> - 2024-04-06 16:20 +0200
            Re: New supply-chain security tool: backseat-signed Adrian Bunk <bunk@debian.org> - 2024-04-06 17:00 +0200
            Re: New supply-chain security tool: backseat-signed Simon McVittie <smcv@debian.org> - 2024-04-06 17:40 +0200
              Re: New supply-chain security tool: backseat-signed Jeremy Stanley <fungi@yuggoth.org> - 2024-04-06 18:00 +0200
              Re: New supply-chain security tool: backseat-signed "Theodore Ts'o" <tytso@mit.edu> - 2024-04-11 17:00 +0200
              Re: New supply-chain security tool: backseat-signed "G. Branden Robinson" <g.branden.robinson@gmail.com> - 2024-04-11 20:30 +0200
                Re: New supply-chain security tool: backseat-signed Colin Watson <cjwatson@debian.org> - 2024-04-12 01:20 +0200
              Re: New supply-chain security tool: backseat-signed "Theodore Ts'o" <tytso@mit.edu> - 2024-04-11 16:30 +0200
                Re: New supply-chain security tool: backseat-signed Colin Watson <cjwatson@debian.org> - 2024-04-11 16:40 +0200
          Re: New supply-chain security tool: backseat-signed Sean Whitton <spwhitton@spwhitton.name> - 2024-04-07 09:50 +0200
        Re: New supply-chain security tool: backseat-signed Guillem Jover <guillem@debian.org> - 2024-04-06 14:30 +0200
          Re: New supply-chain security tool: backseat-signed Sean Whitton <spwhitton@spwhitton.name> - 2024-04-07 09:50 +0200

csiph-web