Re: Unofficial buildd network has been shut down
On Wed, Sep 01, 2004 at 03:36:54PM +1000, Hamish Moffatt wrote:
> > It saddens me to see that donations of accounts and free cpu cycles to
> > DDs are no longer appreciated by Debian. Any request to (re)build
> > package must now again go solely to <arch>@buildd.debian.org.
> Goswin, the problem isn't that we can't accept donated cycles but that
> we need packages that we can trust, which means built by a developer in
> the Debian keyring.
> It's nothing personal. I don't know the reasons why you weren't accepted
> as a DD and that's not really the issue at hand. But shutting down those
> buildds was the right thing to do I think.
So, you speak of an untrusted relationship between DDs and non-DDs.
I fully understand that you (as being a DD, in general, not in person) can't
trust non-DDs.
Therefore I request the removal of:
- all packages ever been built on untrusted hardware. This means at least
all packages built on arrakis, buildd2, wouter-arrakis, buildd-m68_arrakis,
spice, akire, crest, paco, pepe and pancho as well as all other packages
built on any other machine not totally owned and controlled by either a DD
or by DSA.
- all packages ever being built with a package of the toolchain on each of
the above mentioned machines, especially because Matthias Klose used spice,
arrakis and paco to make development on the gcc suite.
- all accounts that ever used one of this machines. You can't tell, if they
were compromised.
- all information on www.debian.org that encourage non-DDs to contribute
anything.
- all information on www.debian.org about sponsorship and binNMUs.
Why this?
Because if you don't trust, you have to remove all this stuff. For arrakis
this means that all packages in the archive since arrakis started to work as
a buildd on a non-DD owned hardware can't be trusted. IIRC arrakis started
back in 2000 or 2001.
Crest was installed by me, an evil & untrustworthy non-DD, so everything
that happened on this machine might have been compromised as well.
And when you don't trust non-DDs you also should remove all references on
the website that encourage non-DDs to contribute. The contribution will be
untrusted in any way.
So, when you're seriously concerned about trustworthy computing, you'll need
to do all the above mentioned removals.
Sounds silly? So, maybe you want to use an alternative:
Start building your trust on the work being done, not just on some obscure
status per se.
I do trust some non-DDs more than I trust some DDs. Just being a DDs doesn't
mean that you're trustworthy to me.
--
Ciao... //
Ingo \X/
Reply to: