4 ms·

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754910 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754910 is quite telling. This does not diminish the i

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754910 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754910 is quite telling. This does not diminish the importance of Daniel's work on debian-live, but there's always two sides to every story.

DiabloD3 11y ago
The way I interpret this is someone, instead of coordinating things with Daniel, who is the upstream of that package and the maintainer of the package, they just went and fixed it using an inferior fix that Daniel was trying to ship in his own conflicting possible future version. That is pretty ignorant, and I can't blame Daniel. This is somewhere up there with Debian habitually backporting security patches into an ancient version of Apache to the point its a broken unsecure mess, and adding an unapproved patch to ssh that caused it to generate completely broken and highly unsecure keys.
- plorkyeran 11y ago
  AFAICT you have it backwards -- the other packager is the upstream developer and maintainer of the pre-existing ubuntu package. The only thing that Daniel's package had going for it was that he had submitted it earlier, but he had not gone through the process of filing an ITP to tell other people that they don't need to spend time on packaging it. I find the whole thread somewhat cringey to read and I'm not sure why he thinks it reflects well on him.
  - curun1r 11y ago
    Regardless of who was in the right, there's a number of people on that thread who come off as incredibly disrespectful and should be issuing public apologies for their behavior. I get that it was a heated argument, but people deserve more respect than that, especially when they're volunteering their time.
    - andoriyu 11y ago
      No. Because Daniel ignored protocols someone else had to volunteer time to clean up that mess. It's quite possible such thing happened before and Daniel failed to learn a lesson. Either way — it's pointless drama and rage quit.
  - chris_wot 11y ago
    Is there an ITR process ("Intent To Replace")? Because the issues REALLY got bad when the following was written: live-build has been deprecated by debian-cd, and live-build-ng is replacing it. In a purely Debian context at least, live-build is deprecated. live-build-ng is being developed in collaboration with debian-cd and D-I. I'm aware that I'm going to be upsetting people, but this has been a long time coming and I'm not going to spend time bikeshedding over naming. I would rather spend that time on integration of live image creation into official Debian infrastructure and building the best system for live image creation possible. Consider this thread marked as wontfix. https://lists.debian.org/debian-live/2015/11/msg00008.html https://lists.debian.org/debian-live/2015/11/msg00008.html So in other words, there was an upset about Daniel not filing an ITP, and then this casual email gets sent saying an entire project has been deprecated, that discussion is not needed as it was a fait accomplis and the hundred and thousands of man hours people contributed to it weren't important? Not good, and very poorly handled.
    - voltagex_ 11y ago
      That one stood out to me - plus the other part that says that debian-live was never an official project, which seems to be in contradiction to https://www.debian.org/News/weekly/2006/08/ https://www.debian.org/News/weekly/2006/08/
      - chris_wot 11y ago
        Well, too late does that same guy realise that things have gone pear shaped! He's gone from "this has been a long time coming" and "consider this thread marked as wontfix" to the below: https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=155;bug=804315 https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=155;bug=80... original aim for this was that this new tool would be integrated into the existing Debian Live project, and that we would bring the Debian Live project into Debian. This is not the way it has gone. Except that is not what he wrote. He didn't say anything about integrating into the project. Instead he said the project a. Wasn't an official Debian project (when actually it does look like it was), and b. They were about to deprecate the entire project! I have to call bullshit on this one. There was never any intent to integrate with the project. That's one dishonest email!
- maheart 11y ago
  > This is somewhere up there with Debian habitually backporting security patches into an ancient version of Apache to the point its a broken unsecure mess, and adding an unapproved patch to ssh that caused it to generate completely broken and highly unsecure keys. Please don't spread FUD. Debian does a great job of creating and maintaining a stable, secure, and coherent operating system. They may modify upstream software so that it complies with the Linux FHS, but the goal is to achieve a coherent system (e.g. config in /etc, data in /var/lib, etc). IMO, they do a better job than any other Linux distro. Debian also has a strict policy on decoupling libraries from programs. This means that when a security update is released (e.g. the security fix for latest libpng vulnerability), you only need to update a single package. Finally, Debian aims to be stable, which means they'll keep an eye out for vulnerabilities and backport fixes. This is done instead of forcing you to move between versions of software, which has the potential to break things, or create new security issues (e.g. changes in config). The Debian+openssl vulnerability happened in 2008. Go back, and look at Debian's security record (e.g. go to LWN and see Debian release fixes for the latest vulnerabilities just as quickly as Red Hat and Canonical/Ubuntu).
  - DiabloD3 11y ago
    You're preaching to the choir however. I've used Debian for over 15 years, use it on all my home machines that run Linux, and also use it for prod everywhere at work. Everything you listed is why I still use Debian, even when Debian politics like this keeps ruining Debian further. I won't touch Ubuntu with a twelve foot pole, and I think RHEL family distros are trash. However, when I say Debian has deep internal politics issues, I am saying this unbiasedly: I like Debian, but I wish they'd stop ruining my distro of choice.
symlinkk 11y ago
Can someone give us a clue what's going on in this thread? I can't follow the jargon at all.
- colechristensen 11y ago
  A group of people failing to cooperate, communicate, or generally work together in a reasonable way. It's both a failure of each individual to work together constructively amongst some confusion or disagreement and a systematic failure of the whole organization to set expectations and have reasonable clear remedies for such conflicts.
- geofft 11y ago
  "ITP" stands for "intent to package". When you want to package something in Debian, you file a Debian bug with "ITP" in the subject. (The bug is filed against "wnpp", an entry in the bug tracker that doesn't actually represent a Debian package but represents "work-needing and prospective packages.") The ITP bug does not actually do anything with regards to the upload process; it's simply a coordination point. You can ignore the ITP process and upload a package straight to "NEW". For historical reasons, the team that maintains the Debian package archive is called the "ftp-master" team, though the archive is generally retrieved via HTTP. They have the final authority (subject to, like, a project-wide vote or whatever) on what actually goes into the archive, and it's their job to prevent things like packages being hijacked from an active maintainer, in addition to verifying free software status, non-atrocious packaging quality, etc. Part of that verification takes time, especially for brand-new packages. What happened in this bug is that Daniel did not file an ITP and uploaded the package, and Serge did file an ITP and uploaded the package, and the NEW queue got both of them. Who's in the right is pretty unclear. Daniel had his package in the queue well ahead, but Serge followed the procedure, and the very reason the procedure exists is to avoid conflicts like this. So Ansgar, a member of the ftp-master team, told them to work it out amongst themselves (a common response for conflicts). Later, Paul, also on the ftp-master team, said the same thing in stronger words, in the email rejecting both of their uploads. Serge also had uploaded a newer version of cgmanager which unblocked systemd-shim (the compatibility layer for running non-systemd systems). Daniel had uploaded an older version that was not useful for systemd-shim. So Daniel and Serge worked things out amongst themselves, except Daniel did not actually get around to uploading his package, so Serge uploaded his original package after timing out on Daniel. Serge was technically in the right, but that isn't really the metric. Serge was also probably socially in the right, but this was unfortunately a murky case. Paul accepted Serge's next upload after hearing both Serge and Daniel saying that they were working together, even though Serge just uploaded his original package (without Daniel's packaging and without listing him as a maintainer). There are obvious echos with what happened in Debian Live: Daniel feels hurt because other people ignored work he was doing in favor of their own thing, and everyone else felt frustrated because Daniel's work didn't support things that the rest of Debian needed, and there was no sign of that changing in a timely fashion.
Sir_Cmpwn 11y ago
The final email on this page is a very important read. If you tl;dr this link, skip to the last email before you leave.
chris_wot 11y ago
Actually, it appears that Daniel was wronged there also. If you are going to upload a new package and you know there might be a conflict, wouldn't you notify the other person? Seems like Daniel has been wronged. Dick move by the debian-cd teams.

DiabloD3 11y ago

The way I interpret this is someone, instead of coordinating things with Daniel, who is the upstream of that package and the maintainer of the package, they just went and fixed it using an inferior fix that Daniel was trying to ship in his own conflicting possible future version. That is pretty ignorant, and I can't blame Daniel. This is somewhere up there with Debian habitually backporting security patches into an ancient version of Apache to the point its a broken unsecure mess, and adding an unapproved patch to ssh that caused it to generate completely broken and highly unsecure keys.

plorkyeran 11y ago
AFAICT you have it backwards -- the other packager is the upstream developer and maintainer of the pre-existing ubuntu package. The only thing that Daniel's package had going for it was that he had submitted it earlier, but he had not gone through the process of filing an ITP to tell other people that they don't need to spend time on packaging it. I find the whole thread somewhat cringey to read and I'm not sure why he thinks it reflects well on him.
- curun1r 11y ago
  Regardless of who was in the right, there's a number of people on that thread who come off as incredibly disrespectful and should be issuing public apologies for their behavior. I get that it was a heated argument, but people deserve more respect than that, especially when they're volunteering their time.
  - andoriyu 11y ago
    No. Because Daniel ignored protocols someone else had to volunteer time to clean up that mess. It's quite possible such thing happened before and Daniel failed to learn a lesson. Either way — it's pointless drama and rage quit.
- chris_wot 11y ago
  Is there an ITR process ("Intent To Replace")? Because the issues REALLY got bad when the following was written: live-build has been deprecated by debian-cd, and live-build-ng is replacing it. In a purely Debian context at least, live-build is deprecated. live-build-ng is being developed in collaboration with debian-cd and D-I. I'm aware that I'm going to be upsetting people, but this has been a long time coming and I'm not going to spend time bikeshedding over naming. I would rather spend that time on integration of live image creation into official Debian infrastructure and building the best system for live image creation possible. Consider this thread marked as wontfix. https://lists.debian.org/debian-live/2015/11/msg00008.html https://lists.debian.org/debian-live/2015/11/msg00008.html So in other words, there was an upset about Daniel not filing an ITP, and then this casual email gets sent saying an entire project has been deprecated, that discussion is not needed as it was a fait accomplis and the hundred and thousands of man hours people contributed to it weren't important? Not good, and very poorly handled.
  - voltagex_ 11y ago
    That one stood out to me - plus the other part that says that debian-live was never an official project, which seems to be in contradiction to https://www.debian.org/News/weekly/2006/08/ https://www.debian.org/News/weekly/2006/08/
    - chris_wot 11y ago
      Well, too late does that same guy realise that things have gone pear shaped! He's gone from "this has been a long time coming" and "consider this thread marked as wontfix" to the below: https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=155;bug=804315 https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=155;bug=80... original aim for this was that this new tool would be integrated into the existing Debian Live project, and that we would bring the Debian Live project into Debian. This is not the way it has gone. Except that is not what he wrote. He didn't say anything about integrating into the project. Instead he said the project a. Wasn't an official Debian project (when actually it does look like it was), and b. They were about to deprecate the entire project! I have to call bullshit on this one. There was never any intent to integrate with the project. That's one dishonest email!
maheart 11y ago
> This is somewhere up there with Debian habitually backporting security patches into an ancient version of Apache to the point its a broken unsecure mess, and adding an unapproved patch to ssh that caused it to generate completely broken and highly unsecure keys. Please don't spread FUD. Debian does a great job of creating and maintaining a stable, secure, and coherent operating system. They may modify upstream software so that it complies with the Linux FHS, but the goal is to achieve a coherent system (e.g. config in /etc, data in /var/lib, etc). IMO, they do a better job than any other Linux distro. Debian also has a strict policy on decoupling libraries from programs. This means that when a security update is released (e.g. the security fix for latest libpng vulnerability), you only need to update a single package. Finally, Debian aims to be stable, which means they'll keep an eye out for vulnerabilities and backport fixes. This is done instead of forcing you to move between versions of software, which has the potential to break things, or create new security issues (e.g. changes in config). The Debian+openssl vulnerability happened in 2008. Go back, and look at Debian's security record (e.g. go to LWN and see Debian release fixes for the latest vulnerabilities just as quickly as Red Hat and Canonical/Ubuntu).
- DiabloD3 11y ago
  You're preaching to the choir however. I've used Debian for over 15 years, use it on all my home machines that run Linux, and also use it for prod everywhere at work. Everything you listed is why I still use Debian, even when Debian politics like this keeps ruining Debian further. I won't touch Ubuntu with a twelve foot pole, and I think RHEL family distros are trash. However, when I say Debian has deep internal politics issues, I am saying this unbiasedly: I like Debian, but I wish they'd stop ruining my distro of choice.

symlinkk 11y ago

Can someone give us a clue what's going on in this thread? I can't follow the jargon at all.

colechristensen 11y ago
A group of people failing to cooperate, communicate, or generally work together in a reasonable way. It's both a failure of each individual to work together constructively amongst some confusion or disagreement and a systematic failure of the whole organization to set expectations and have reasonable clear remedies for such conflicts.
geofft 11y ago
"ITP" stands for "intent to package". When you want to package something in Debian, you file a Debian bug with "ITP" in the subject. (The bug is filed against "wnpp", an entry in the bug tracker that doesn't actually represent a Debian package but represents "work-needing and prospective packages.") The ITP bug does not actually do anything with regards to the upload process; it's simply a coordination point. You can ignore the ITP process and upload a package straight to "NEW". For historical reasons, the team that maintains the Debian package archive is called the "ftp-master" team, though the archive is generally retrieved via HTTP. They have the final authority (subject to, like, a project-wide vote or whatever) on what actually goes into the archive, and it's their job to prevent things like packages being hijacked from an active maintainer, in addition to verifying free software status, non-atrocious packaging quality, etc. Part of that verification takes time, especially for brand-new packages. What happened in this bug is that Daniel did not file an ITP and uploaded the package, and Serge did file an ITP and uploaded the package, and the NEW queue got both of them. Who's in the right is pretty unclear. Daniel had his package in the queue well ahead, but Serge followed the procedure, and the very reason the procedure exists is to avoid conflicts like this. So Ansgar, a member of the ftp-master team, told them to work it out amongst themselves (a common response for conflicts). Later, Paul, also on the ftp-master team, said the same thing in stronger words, in the email rejecting both of their uploads. Serge also had uploaded a newer version of cgmanager which unblocked systemd-shim (the compatibility layer for running non-systemd systems). Daniel had uploaded an older version that was not useful for systemd-shim. So Daniel and Serge worked things out amongst themselves, except Daniel did not actually get around to uploading his package, so Serge uploaded his original package after timing out on Daniel. Serge was technically in the right, but that isn't really the metric. Serge was also probably socially in the right, but this was unfortunately a murky case. Paul accepted Serge's next upload after hearing both Serge and Daniel saying that they were working together, even though Serge just uploaded his original package (without Daniel's packaging and without listing him as a maintainer). There are obvious echos with what happened in Debian Live: Daniel feels hurt because other people ignored work he was doing in favor of their own thing, and everyone else felt frustrated because Daniel's work didn't support things that the rest of Debian needed, and there was no sign of that changing in a timely fashion.

Sir_Cmpwn 11y ago

The final email on this page is a very important read. If you tl;dr this link, skip to the last email before you leave.

chris_wot 11y ago

Actually, it appears that Daniel was wronged there also. If you are going to upload a new package and you know there might be a conflict, wouldn't you notify the other person? Seems like Daniel has been wronged. Dick move by the debian-cd teams.