Re: [RFC] General Resolution to deploy tag2upload

[Sean Whitton <spwhitton@spwhitton.name>]

Hello,

On Sat 15 Jun 2024 at 06:03pm +02, Joerg Jaspert wrote:

> On 17258 March 1977, Sean Whitton wrote:
>
>> So, why am I proposing a GR?
>
> This one took me by surprise, honestly.
>
> Looking into my notmuch, the last time tag2upload came up in my
> ftpmaster inbox was in 2019. Between then and now there doesn't appear to
> be any serious contact with us about it. There had been mentionings on
> some mailing list somewhere, but nothing coming to us, that I can
> find.

In recent years, you have stepped in with your expertise in a number of
emergencies, and I am most grateful for that.

But with respect, you have not otherwise been active in the ftpmaster
team, and you didn't significantly participate in the original
tag2upload discussions.  So I think you may be missing things.

We have been seeking help behind the scenes over the past four years.
No progress was made, so we decided to draft a GR.

> Even then, back in 2019, one of the major points that ftpteam members
> raised had been "the archive has to be the final point to check if an
> upload is accepted" and that we do retain *all* user signatures of
> source packages, and that such a service must provide the same level
> of possible verification. Some other requirements on the signature too
> (collision resistant, need to be verifyable with only stuff included
> in the source package). Also something about not using Perl, but meh,
> lets ignore that one here.
>
> So, 5 years of (hopefully) development, but the major point (this should
> *not* bypass/circumvent archive upload checks and restrictions) did not
> get addressed. More like, entirely ignored.

Like Russ, I'm grateful for how you've set out some things more clearly
in this message.  I'm looking forward to reading your reply to him.

I would ask you not to characterise the disagreement we are having as
merely over a technical detail.
It's the essence of tag2upload that the tag metadata is minimal, and
easily generated by a short shell script, like git-debpush.

We did not ignore your position: we argued against it.  No-one from
ftpmaster has responded to our arguments for wanting the metadata to be
minimal.  So as I say, I'm looking forward to your reply to Russ.

-- 
Sean Whitton