Proposing to proceed with creating AWS and Azure accounts for Debian
Hi,
Unfortunately I am not able to get a timely reply from SPI's legal
counsel advising us about the AWS and Azure marketplace agreements, due
to factors outside of SPI's control. (We discussed it in a March phone
call and I promptly sent over the agreement texts that evening.) But I
think we should proceed anyway.
The risks to SPI and Debian of proceeding despite concerns over the
indemification language, nonzero as they are, are comparatively small in
practice when we consider the realpolitik / public-relations
implications of possible litigation scenarios.
For those who haven't been following, the TL;DR is that any lawsuits
against Amazon for the Debian images which Debian publishes in the AWS
Marketplace might give Amazon the contractual right to involve SPI,
including covering their legal fees and any damages owed. Likewise for
Azure. Small risk in practice for cases which wouldn't appropriately
involve Debian/SPI anyway.
By contrast, the disruption to Debian's cloud image publication plans
from waiting long enough to resolve these questions would be definite,
significant, and near-term in light of the imminent release of Debian 10
"buster".
Therefore, given the long delays so far, in my mind the tradeoffs weigh
in favor of taking a risk and signing the agreements as they are. If
this worries any SPI directors, the DPL, or members of the Debian cloud
team, please reply to this message sharing those concerns - drop
debian-cloud@lists.debian.org from the recipient list if you do not want
your concerns to be publicly archived, but please keep board@spi-inc.org
and preferably leader@debian.org.
Please send any concerns by end of day UTC on Friday, April 12. In the
absence of any blocking concerns by then, I will reply here that evening
(Montreal time) or weekend giving the all-clear for whoever is going to
do the technical work to create the AWS and Azure accounts as required,
in a self-service online manner under the standard terms and conditions.
I or another SPI debit card holder can be involved as necessary to get
past "you must provide a debit card" hurdles, assuming my email archives
already show DPL approval or assuming the DPL gives his approval.
The separate discussion about where to point the upcoming
debian-cloud-accounts@ alias in the spi-inc.org domain can continue in
parallel, in the other thread.
- Jimmy Kaplowitz
president@spi-inc.org
Reply to: