20:01:53 #startmeeting 20:01:53 Meeting started Fri Oct 12 20:01:53 2018 UTC. The chair is waldi. Information about MeetBot at http://wiki.debian.org/MeetBot. 20:01:53 Useful Commands: #action #agreed #help #info #idea #link #topic. 20:01:57 if noone else wants 20:02:00 #chair ta 20:02:00 Current chairs: ta waldi 20:02:04 #chair ansgar 20:02:04 Current chairs: ansgar ta waldi 20:02:46 #topic Check action items from last meeting 20:03:18 no action items on last months meeting 20:03:48 so done 20:04:08 i'm reordering the entries, as i have to go shortly 20:04:20 #topic Status of secure boot signing 20:04:29 See https://lists.debian.org/debian-efi/2018/10/msg00000.html 20:04:32 ansgar: sorry about pestering you. i think Sledge talked to you? 20:05:04 #link https://lists.debian.org/debian-efi/2018/10/msg00000.html 20:05:06 ansgar: thanks 20:05:26 I would like to have either recording which key an upload trusts (bwh's suggestion) or the Ubuntu patch to not have trusted keys in the kernel, but just use the one UEFI/shim tursts before we start using the production keys. 20:06:02 On the plus side, I have enabled secure boot with Debian's kernel on a laptop and it works :) 20:06:27 okay. i intend to do some tests as well after the hands-on session with the intel guys yesterday 20:06:53 (Ubuntu has a kernel patch for the latter) 20:07:21 okay. do you know where or do i have to search for it? 20:07:40 In the diff.gz, load_uefi.c or load_efi.c or so. 20:08:04 okay, thx 20:08:21 Plus the sig verification function needs to be called with slightly different parameters AFAIU. 20:09:12 #topic How much do we care about copyright holders in d/copyright 20:09:35 I think this text is ok 20:09:36 ScottK would like to have the text for this finished 20:11:19 okay. who wants to send it? 20:11:24 I think it should say "documenting copyright *holders*" in the first sentence of (4) or so. 20:11:44 Just copyright might be confusing (does it mean license or copyright holders?) 20:12:18 it means both 20:13:16 yes, i think aw well that it should be explicit as we only want to change the listing of holders, not the licenses 20:13:49 i'm sorry, but i have to go 20:13:57 see you tomorrow 20:14:56 hmm, ok, with the rest of the paragraph, its about the holders 20:16:12 so shall scottk send the email? 20:16:40 Fine with me. 20:17:26 #action scottk shall send email about copyright holders 20:18:26 #topic Sources for architectures on ports 20:19:28 hmm, what does that mean? 20:19:49 It is about source packages that don't built anything for the main archive, but only for ports.d.o. 20:20:23 These get tagged as cruft and one port maintainer was unhappy when something disappeared. 20:21:13 ah, I remember, shall we change the tagging as cruft? 20:21:18 I'm not very enthusiastic to change that; I would like to see more cruft removal from unstable in the future (e.g. packages that haven't been installable for a long time in unstable/exp) 20:22:22 Which will probably conflict with having sources w/o any binary or uninstallable arch:all packages (which are only installable on a port) 20:23:55 #agreed at the moment don't change the tagging as cruft 20:24:52 #topic Unsupportable software for stable 20:25:19 What is this one about? 20:26:44 I think this is about software in stable that gets no security fixes or other updates anymore 20:27:22 but isn't that a matter of the release team? 20:27:25 That sounds more like a release team thing? 20:27:42 Maybe we should wait for the next meeting so waldi can explain. 20:27:46 it was waldis topic ... 20:27:48 ok 20:28:03 #topic CUPS license change (GPL -> Apache) 20:29:33 CUPS switches to Apache-2 which is incompatible with GPL-2 or so. 20:29:41 So CUPS is the new OpenSSL ;-) 20:29:59 yes, and 2.3 is already in experimental ... 20:30:58 I wonder if any other distribution saw this as a problem? Given most don't see a problem with GPL-2 and OpenSSL either... 20:31:22 (and Fedora still wasn't sued; nor was Canonical for merging ZFS into their Linux kernel package) 20:31:55 #link https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/2L2FK52XUKXHVK23AOPMCTOW3PQCTL5Z/ 20:32:39 do you know how many packages are affected? 20:32:51 No idea. 20:33:18 We also just count some forms of "linking" for some reason too... 20:34:11 dlopen() (or "import openssl") is somehow different from ld ;-) 20:35:02 "CUPS is fairly ubiquitous and easily falls under the "OS-supplied library" exception in the GPL 2." (from that thread above, citing someone from apple) 20:35:09 so only static linking is a problem 20:35:57 ok, I will look for affected packages until next meeting ... 20:36:04 Yes, but if we would say the exception applies to CUPS, it would probably apply to OpenSSL too. 20:36:23 yes, like everybody else :-) 20:36:25 (Which would arguably make life easier... And Fedora wasn't sued into oblivion.) 20:36:40 Debian has traditionally not applied the system library exception to any libraries, and I'm not sure if it's fine to apply it between system libraries either. 20:36:51 (at the risk of reopening that debate. :-) ) 20:38:29 Yes, that's basically a question the CUPS license change brings back :) 20:39:37 but than we must remove some packages 20:40:24 Yes, Python scripts using OpenSSL (indirectly) that are licensed under GPL-2-only ;) 20:41:05 Or ones using CUPS. 20:41:54 Mithrandir: do you have a link to a previous discussion at hand? 20:42:07 ta: I do not 20:44:02 ansgar: did we ask a lawyer about this in the past? 20:44:32 Don't know. That was too long ago for me :) 20:45:15 so maybe we should do this again/now? 20:46:25 Maybe. I would like to ask Joerg about historic things first. 20:47:06 ok 20:47:27 Though first I still need to find a new appartment... 20:48:13 #action talk to ganneff about openssl history (related to CUPS license change) 20:48:33 #topic OpenSSL 20:48:47 I have no idea why this is on the agenda 20:49:10 Ah, because it is the same as CUPS. 20:49:44 ok, then we are finished with that 20:50:02 #topic Any other business 20:50:43 anybody? 20:51:17 Nothing really. There is a plan to publish the debug archive for the security archive now. 20:52:09 yes, that would be nice 20:53:39 so we are finished for today, thanks to everybody :-) 20:53:43 #endmeeting