Re: package ownership in Debian
George Danchev wrote:
> On Saturday 29 July 2006 09:48, Martin Schulze wrote:
> > Manoj Srivastava wrote:
> > > > Co-maintainers are much closer to what is being done in a package
> > > > than joe-random developer. Also, co-maintainership is far less
> > > > prone to fire-and-forget uploads that hose things, and are nicer to
> > > > people who feel very strongly about their packages.
> > >
> > > Co-maintainerships require communication, and ability and
> > > desire to share decisions, can result in a culture of "it is someone
> > > elses problem (neat aphorism in german, I believe)", and if the team
> > > does not trust one of the members, then things can turn ugly.
> >
> > There's a nother problem with team maintained packages. The Security
> > Team has to work on packages that are team-maintained in sid every
> > once in a while. Often we want to get in touch with the maintainer
> > privately before disclosure or before releasing the advisory.
> >
> > With team-maintained packages, the maintainer address often points to
> > a mailing list, so we can't talk to them. Even worse are packages
> > in whose changelog the entries aren't signed by a real person but
> > by a list address as well. That's some sort of anonymous maintenance.
> >
> > For such packages the Securtity Team has problems reaching a person
> > to talk to them in time so that we can discuss fixes and prepare
> > updates.
> >
> > The last example I remember is not old and it demonstrated another
> > problem. We contacted the list address but only got a response after
> > we've opened a bug report when released the advisory without any
> > maintainer response. I'm not exactly sure team-maintenance really
> > helps here...
>
> Good point. If a mailing list is listed in Maintainer:, then I see adding all
> package co-maintainers to the Uploaders: field, as a possible resolution. Hm,
> some of these co-maintainers might in fact be non-DD's, but I don't see any
> problems for the security team to talk to such parties when dealing with the
> situation described above. Or am I badly wrong about that ?
It's not too relevant whether the maintainer is a DD or is not yet.
Only when we would like to keep things under a blanket for a while,
we'd really like the issue not to be leaked before their official
disclosure.
Regards,
Joey
--
MIME - broken solution for a broken design. -- Ralf Baechle
Reply to: