Re: Bug#745761: [RFR] templates://igtf-policy-bundle/{templates.in}
On 29-04-14 21:48, Justin B Rye wrote:
> I suspect you'll see a second draft of this...
>
> Christian PERRIER wrote:
>> Rationale:
>> --- igtf-policy-bundle.old/debian/templates.in 2014-04-24 08:41:06.143267631 +0200
>> +++ igtf-policy-bundle/debian/templates.in 2014-04-29 19:07:52.910508550 +0200
>> @@ -1,23 +1,27 @@
>> Template: igtf-policy-@PROFILE@/install_profile
>> Type: boolean
>> Default: true
>> -_Description: Install the IGTF @PROFILE@ CAs in /etc/grid-security/certificates?
>> - This package installs the IGTF CAs in /etc/grid-security/certificates.
>> - There are two ways to deal with these certificates:
>> - - yes: install all, except those in the exclude list
>> - - no: install only CAs in the include list.
>> - The include/exclude lists are covered by the next question.
>> +_Description: Install the IGTF @PROFILE@ CA certificates in /etc/grid-security/certificates?
>
> This could get a bit long if the profiles can have names like
> "unaccredited" (looks like they can).
Actually, the only profiles now are classic, MICS and SLCS, with IOTA in
the pipe-line (but no CAs yet). Unaccredited and experimental are
not profiled and not handled through debconf.
> Does it really need to specify
> the install path here? I'd suggest moving that to the long
> description only.
I agree it's getting long, but it is the most accurate. Asking the user
to trust the CAs is less direct and may lead to some confusion about
what that trust entails.
> And the long description should probably also
> mention the effect produced by putting the files in this location
> (that is, it means they're trusted).
>
>> + This package installs the IGTF Certification Authority certificates in /etc/grid-security/certificates.
>
> Maybe:
> Please specify whether the IGTF Certification Authority certificates for
> the @PROFILE@ profile should be installed as trusted in
> /etc/grid-security/certificates.
Somehow "installed as trusted" feels like it might mean more than just
"installed", where it is really "installed, and therefore trusted". It's
the ambiguity of the language I guess.
>
>> + .
>> + If you choose this option, all certificates will be installed, except
>> + those in the "exclude" list.
>> + .
>> + If you do not choose this option, only
>> + certificates from the "include" list will be installed.
>> + .
>> + You will then have the opportunity to define the relevant list.
>
> Wait, wait, wait. Is that what the original is saying? I thought it
> was just asking whether the files should be installed (after all,
> that's what the question in the synopsis asks), with a secondary
> warning that there would be some sort of subsequent question about
> whether the default policy should be inclusive or exclusive. But sure
> enough, there doesn't seem to *be* any such follow-up question.
Actually this is what I originally meant, and I agree with the rephrasing.
> I was thinking it could be boiled down to a single sentence along the
> lines of "(deciding) whether certificates should be included by
> default unless explicitly excluded, or vice versa." But perhaps that
> might be too compressed.
But that is the crux of the matter: whether to choose "all but some" or
"none but some".
>
>> - Rephrasing the sentence mentioning the opportunity to tune lists
>> should also avoid reference to the way the question will be asked.
>>
>> Il also made sure that "CA" is explained at least once.
>
> Rethinking what the actual question is... should it perhaps be
>
> _Description: Trust IGTF @PROFILE@ CAs by default?
> Trusted IGTF Certification Authority certificates are installed in
> /etc/grid-security/certificates.
> .
> Accept this option to have certificates included by default unless they
> are explicitly excluded. Reject it to choose the reverse policy,
> excluding them unless explicitly included.
> .
> You will then have the opportunity to define the list of exceptions.
That's bang on, although I'm still not sure about the 'trust' in the
synopsis.
> Meanwhile in the control file...
>
>> Package: igtf-policy-classic
> [...]
>> Description: IGTF classic profile for Authority Root Certificates
>
> I know what a Root Certificate Authority is, and I can imagine what a
> Root Authority Certificate might be, but what on earth is an
> "Authority Root Certificate"? Google shows me no hits that aren't
> either copies of this text or random chunks out of the middle of some
> longer string of nouns (usually "Something Certificate Authority
> Root Certificate Something Somethings"). I strongly suspect this is
> garbled and should be... um... "CA Root Certificates", perhaps? Or
> just "root certificates", since after all, that's what it calls them
> below...
I think 'Certificate Authorities' is best. After all, not all these are
in fact *Root* CAs. Some of them are intermediates.
>
>> The International Grid Trust Federation (IGTF) maintains a common
>
> There's another confusing issue here: http://www.igtf.net/ says the
> IGTF is the "InterOPERABLE GLOBAL Trust Federation". On the other
> hand, the organisation's charter definitely calls it the InterNATIONAL
> GRID Trust Federation. Has it officially changed?
I could ask but I've never heard it referred to as Interoperable or Global.
>
> (My patch sticks to the "-national Grid" version.)
>
>> trust base for the benefit of distributed science and research
>> computing infrastructures by maintaining a list of trust anchors, for
>> accredited authorities. The distribution contains root certificates,
>> certificate revocation list (CRL) locations, contact information, and
>> signing policies.
>> .
>> This package contains the trust anchors for the classic profile.
>
> Talking about maintaining an esoteric thing by maintaining a list of
> esoteric things is awkward. And does "for accredited authorities"
> mean:
> a) it maintains the list on behalf of these authorities, or
> b) the trust anchors are for the use of accredited authorities, or
> c) the listed trust anchors constitute accredited authorities?
> From context I think it's meant to be (c), but I'm not sure that's
> grammatical.
Yes, I think this is (c).
>
> Then, mentioning the contents of the upstream "distribution" can be a
> bit confusing from the point of view of someone who's trying to work
> out what's in a Debian package. If I'm understanding it correctly
> then this boilerplate paragraph might be more readable as:
>
> The International Grid Trust Federation (IGTF) maintains a common trust
> base for the benefit of distributed science and research computing
> infrastructures. It provides a list of accredited trust anchors, with
> root certificates, certificate revocation list locations, contact
> information, and signing policies.
Already much better!
>
> [...]
>> Package: igtf-policy-unaccredited
> [...]
>> Description: IGTF unaccredited Authority Root Certificates
>
> If the certificates are unaccredited, what do they claim to certify?
> Or is it talking about unaccredited CAs?
Yes, the CAs are unaccredited so it should probably read: "IGTF
unaccredited Certificate Authorities"
Thanks for the comments,
Dennis
Reply to: