[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: dgit and false attributions (was: rescue_1.106_source.changes ACCEPTED into unstable)



Hi Cyril,

Cyril Brulebois <kibi@debian.org> writes:

> Hi,
>
> Debian FTP Masters <ftpmaster@ftp-master.debian.org> (2025-12-12):
>> Thank you for your contribution to Debian.
>> 
>> Accepted:
>> 
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>> 
>> Format: 1.8
>> Date: Fri, 12 Dec 2025 18:29:29 +0100
>> Source: rescue
>> Architecture: source
>> Version: 1.106
>> Distribution: unstable
>> Urgency: medium
>> Maintainer: Debian Install System Team <debian-boot@lists.debian.org>
>> Changed-By: Philip Hands <phil@hands.com>
>> Closes: 1122360
>> Changes:
>>  rescue (1.106) unstable; urgency=medium
>>  .
>>    * Team upload.
>>  .
>>    [ Updated translations ]
>>    * Estonian (et.po) by Priit Jõerüüt
>>    * Persian (fa.po) by Danial Behzadi & "Ab"
>>    * Hungarian (hu.po) by Szia Tomi
>>    * Lao (lo.po) by "BoneNI"
>>  .
>>    [ Holger Wansing ]
>>    * Remove FSF's postal address from d/copyright (no longer used)
>>  .
>>    [ Philip Hands ]
>>    * salsa-ci: enable a rescue test on openQA
>>    * usrmerge: move installed files under usr/ (closes: #1122360)
>
> Spotted while investigating an opu for rescue…
>
>
> Are we really OK as a project (Debian) or as a team (installer team)
> to have commits that are created on behalf of others, without their
> knowledge or consent?

As the person that seems to have inadvertently caused the creation of
those commits, I completely agree that they shouldn't have ended up
pretending to be your work.

I guess they were created either by a `git debrebase conclude` or during
the dgit push, but I'm not certain which of those it would be -- I'll
report a bug against dgit (possibly after CCC) to see if we can work out
how I managed that, and how to do something better in future.

I would have expected those commits to have my name on them, and am
rather surprised that's not the case.

> No, I did *not* author either of those commits:
>   https://salsa.debian.org/installer-team/rescue/-/commit/e31c95f521feae5a4968039a0f7561d5345df9d4
>   https://salsa.debian.org/installer-team/rescue/-/commit/b3ff2972eb222c3fd3750c024952cf01b762e0ab
>
> I'm listed both as author and committer, and yet I'm neither of those!
>
> I can understand the need to have some kind of starting point and an
> artificial merge because of <waves at technical challenges>.

Quite.

I can understand why it makes some sort of sense to also want your name
to be somehow attached to those commits (given that they're mechanically
generated from a version that you uploaded to the archive) but that
could have been put in the commit message or perhaps just one of the
Author or Committer, or some such.

> I cannot understand how creating commits in my name is acceptable.
>
> At the very least, pretty please make it clear via either field who's
> running that machinery…

Totally agreed.

> Cheers,
> -- 
> Cyril Brulebois (kibi@debian.org)            <https://debamax.com/>
> D-I release manager -- Release team member -- Freelance Consultant

Cheers, Phil.
-- 
Philip Hands -- https://hands.com/~phil

Attachment: signature.asc
Description: PGP signature


Reply to: