Stephan Lachnit <stephanlachnit@debian.org> writes: > On Thu, Nov 18, 2021 at 4:16 PM Simon Richter <sjr@debian.org> wrote: >> >> On 11/18/21 4:08 PM, Stephan Lachnit wrote: >> >> > I guess this raises the (maybe already answered) question if the >> > additional license QA from NEW is for the end-product (i.e. Debian >> > stable) or for the servers that run the Debian infrastructure, which >> > of course includes experimental. >> >> The latter. > > On Thu, Nov 18, 2021 at 4:29 PM Andrey Rahmatullin <wrar@debian.org> wrote: >> >> On Thu, Nov 18, 2021 at 04:08:23PM +0100, Stephan Lachnit wrote: >> >> > I think this is exactly why it makes sense. I think we can trust the >> > DDs to not make any large mistakes (e.g. putting steam in main). >> The existence of NEW means we currently don't, for completely new >> packages. > > I guess these two answers sum it up then. Thanks. There is also the issue of cryptographic software, and the laws regarding its export from the USA, which Debian deals with by treating every package as though it _might_ at some point incorporate some crypto, and therefore registering every package with BXA as part of the NEW process. https://wiki.debian.org/USExportControl#Cryptographic_software_in_Debian_main_archive This may seem like a lot of silly nonsense, but apparently Debian's process is considered the gold standard by which they judge others, and I'd assume that one important factor there is that there is no back-door route by which we publish things from our mirrors prior to them going through this registration dance. Cheers, Phil. P.S. depending upon what exactly you're trying to do with pre-NEW packages, this may be part of the solution: https://salsa.debian.org/salsa-ci-team/pipeline/#using-automatically-built-apt-repository -- |)| Philip Hands [+44 (0)20 8530 9560] HANDS.COM Ltd. |-| http://www.hands.com/ http://ftp.uk.debian.org/ |(| Hugo-Klemm-Strasse 34, 21075 Hamburg, GERMANY
Attachment:
signature.asc
Description: PGP signature