18:00:17 #startmeeting 18:00:17 Meeting started Thu Aug 3 18:00:17 2017 UTC. The chair is lamby. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:00:17 Useful Commands: #action #agreed #help #info #idea #link #topic. 18:00:40 #link https://pad.riseup.net/p/reproducible-irc-meeting-11 18:01:18 So, who is about :) 18:01:30 * sangy waves 18:01:42 spectranaut? :p 18:01:46 * petn-randall is here. 18:02:05 No infinity0? :) 18:02:07 * StevenC99 aussi 18:02:38 * dkg waves, distractedl 18:02:39 y 18:02:47 hi I'm spectranaut :) 18:03:05 Hey dkg, are you making it to DebConf? :) 18:04:12 I hope dkg answered that question backwards in time with the "y" 18:04:36 here o/ 18:04:50 hey jwnx[m] 18:05:02 lamby: sadly, no :( 18:05:19 also, i have no time travel powers :( 18:05:26 if i had time travel powers, i would be at debconf 18:05:34 Fair point. 18:06:08 Aw, I was hoping to pick your brain on something gnupg… and socialise, of course… :) 18:06:28 h01ger got distracted by coffee I think, will give him some secs… 18:06:44 where is mapreri? 18:06:47 you're always welcome to pick my brain on something gnupg. in person over food or beverages would be preferable, but in a /query or on #debian-gnupg are a passable second-best 18:07:08 spectranaut: you'll never guess :3 18:07:25 spectranaut: has to be absent 18:07:25 dkg: pff, asking questions in /query! 18:08:39 is mapreri... on the way to debconf? :D 18:08:41 i dunno what questions you have -- some people ask me gnupg questions that are legitimately in /query! 18:08:54 h01ger: Error: Can't start another meeting, one is in progress. 18:09:00 h01ger: Too slow! 18:09:04 #topic apologies 18:09:13 Mattia cannot make it alas. 18:09:21 lamby: can you #chair h01ger please 18:09:23 I'm not sure about any others. 18:09:25 #chair h01ger 18:09:25 Current chairs: h01ger lamby 18:09:32 #save 18:09:41 hi 18:09:46 #topic 2. Update on reprotest 18:09:53 sangy, did you add this? 18:09:53 https://pad.riseup.net/p/reproducible-irc-meeting-11 has the agenda for those who wonder 18:09:57 I put this one up, yes 18:10:07 I sent an email to the ML, but I think it got lost in the noise 18:10:21 ah, i should review your commits and merge them, right 18:10:33 I added the fixes that infinity0 suggested to my branch, but I assume that the github repo is just a mirror, and I'm not that knowledgeable on how to send patches over to debian 18:10:49 * h01ger is adding bits to the agenda (spi, logo + dc17 so far) 18:10:50 it's cool, i can take them from github 18:11:04 ah ok. Then I'll do the PR as soon as the meeting is over :) 18:11:12 infinity0: thanks! 18:11:44 I guess that's it for this topic :) 18:11:54 another meta question (i think we started too fast…) 18:12:13 should we discuss gcc6 and other patched packages at the meeting? 18:12:24 further work on t.r-b.o? 18:12:34 sangy: oh, i meant i'll take the commits from github, but i'll send the review comments to the mailing list rather than on a github PR 18:12:36 h01ger: Please just add to agenda and we can skip if inappropriate… 18:12:41 ok 18:12:47 infinity0: ah, sounds good then 18:13:11 h01ger: (… with your name on the agenda, please) 18:13:16 (if we switch to github i figure that should be a group decision and apply to all our projects, to be decided later) 18:13:51 done so now 18:13:58 sangy: Cool, we good on this topic? :) 18:14:04 * h01ger doesnt like switching to github 18:14:18 lamby: yep, on my side yes 18:14:19 Please, let's not have separate discussions/side-issues! 18:14:20 i'd almost say i'd object 18:14:27 i dont mind mirroring at github, probably 18:14:34 fetching patches from github of course is awesome 18:14:35 another time, _please_ 18:14:42 #topic Reprobuild work at NYU's Appsec course 18:14:47 lamby: 18:14:49 sangy: Another one of yours :) 18:14:53 lamby: also claimed by me :) 18:14:53 please dont switch topic so fast 18:14:59 * sangy waits 18:15:13 #topic reprotest 18:15:18 h01ger: Please take over as chair, thanks. 18:15:22 ok 18:15:35 lamby: please do keep (co)-chairing! 18:16:03 infinity0: do you feel we need another topic today to discuss github? or shall we move that to the next irc meeting (and prepare with some RL discussion here?) 18:16:55 h01ger: we could discuss it at the end of this meeting if we have time, but i'm happy with the current situation (not using github except sometimes as a staging area for contributors) 18:17:09 ack, adding to the agenda then 18:17:16 #topic Reprobuild work at NYU's Appsec course 18:17:22 sangy… :) 18:17:24 * sangy continues 18:17:46 So, I think lamby is already aware of it, but my advisor wanted to add some work on reproducible builds on the appsec course 18:18:09 (NYU=new york university) 18:18:14 this course is really project heavy, so we could spend a month on trying to find/fix/contribute reproducibility issues 18:18:17 h01ger: oh, that's right. Sorry 18:18:50 o/ 18:18:51 I wanted to know if 1) this is a reasonable thing to do and if 2) members of the community could help us steer this/guide students 18:18:54 sangy: sounds awesome, anything you want from us? i guess we'd be happy about people coming by, sharing their work, asking questions, etc 18:19:23 sangy, how many students ? 18:19:31 hey sangy. i dont know much about this course, whats the idea behind it? (: 18:20:00 danielsh: it's usually 20-ish students, in groups of 5, but probably we won't have *all* teams working on reprobuilds (depending on how they fare, and how good they are) 18:20:30 jwnx[m]: the idea of this course is to introduce secure application development concepts to students (mostly via depeloping/breaking applications) 18:20:35 sangy, ack 18:20:50 sangy: i'd say we'll be happy to try to help steering them, but its hard for us to commit, as we are mostly volunteers here 18:21:09 (but most likely they will find help here) 18:21:15 h01ger: yeah, I totally understand 18:21:38 we'll also happily take patches for our webpage (r-b.o) and they can edit the debian wiki pages as they see fit 18:21:57 sangy, if you have >1 team perhaps distribute team among various projects 18:22:09 so there isn't 2*5 students all asking questions on one IRC channel 18:22:19 OTOH if you guys want to arrange a q&a session at a specific time or something, i could probably find the time for that 18:22:33 danielsh: yeah. I was hoping maybe I could figure out the tasks with you guys and be the "first filter" 18:22:38 infinity0: good idea indeed, me too 18:22:49 h01ger, infinity0: sounds awesome! 18:23:21 sangy, yeah. We probably have a pretty good idea of how to prioritise the students' ideas 18:23:22 considering we have >10 topics today, do we have anything to add/discuss to this, or shall we move one and discuss more details later (if/when needed) 18:24:28 I think I just wanted to introduce this. We can probably follow up on the ML? 18:24:31 thanks! 18:24:32 wouldnt be better to discuss this on the ML? sounds lengthy 18:24:42 ML sounds good 18:24:47 we have 9 topics left, that's 3 minutes each 18:24:59 go go go 18:25:05 #topic SPI membership 18:25:22 we started 15min late, so we have more time.. also we can do overtime 18:25:28 re: SPI 18:26:03 i might be blurry on the exact reasoning, but iirc for the logo "campaign" brennan was planning it was useful to have a legal body 18:26:10 (people will probably leave on the hour, though) 18:26:24 to collect donations and pay a bounty or such for a logo and design 18:26:46 so i thought of becoming an SPI member 18:27:08 as i understand, this project isn't a legal entity at the moment 18:27:15 what does it mean to become an SPI member if we're not a legal entity? 18:27:17 anybody has any considerations or objections with that, or shall i approach the spi board and get this going? 18:27:41 infinity0: we'd become a legal entity by becoming a member. (or rather, SPI would be our legal entity then) 18:28:08 oh ok, sort of like the debian project itself i guess 18:28:09 I don't believe it is worth the admin overhead given my idea of how much donation we would/could receive, and we can find other/easier ways to fund one-off bounties like the logo. 18:28:12 http://spi-inc.org/projects/services/ 18:28:24 http://spi-inc.org/projects/relationship/ 18:28:32 and http://www.spi-inc.org/projects/associated-project-howto/ 18:28:34 http://spi-inc.org/projects/associated-project-howto/ 18:28:36 i'm not opposed to it if someone else "does the paperwork" but yes i am not sure i'd be prepared to do that myself, given what i imagine we'd gain 18:28:40 infinity0, see #4 there ^ 18:28:52 lamby: which easier ways to you have in mind? 18:29:17 i think becoming an SPI member would be better than eg doing this via debian 18:29:21 infinity0, we'd be able to accept donations, sign contracts, etc as a non-profit, not as bunch of persons 18:29:25 it would send a clear signal, that we are not debian :) 18:29:39 also an SPI board member is a team member of us ;) 18:29:44 * h01ger waves to spectranaut 18:29:45 that's right :) 18:29:51 h01ger: whats the downside on this? 18:30:06 < lamby> I don't believe it is worth the admin overhead 18:30:18 SPI might go crazy, too 18:30:22 how much admin overheard is there ? 18:30:30 overhead* 18:30:37 not much for you all 18:31:09 maybe we can have this explained to us elsewhere outside of the meeting? and/or post to the ML 18:31:22 you can see in the associated project how-to, linked by h01ger above! 18:31:45 ok, i'll read those as post-meeting homework 18:32:24 shall we move on then? there was no principal disagreement and if there is too much overhead or serious objections we can always abort or leave SPI 18:32:48 Sounds reasonable. 18:33:16 #topic logo 18:33:55 brennan asked me whether he could go on with his proposal of starting a design/logo contest/bounty & i told him he should 18:34:05 cant find the URL for his proposal atm though :/ 18:34:33 https://wiki.debian.org/ReproducibleBuilds/Logo is the logo page on the wiki 18:34:57 https://public.etherpad-mozilla.org/p/repro-builds-art 18:35:01 is the other page i believe 18:35:26 dat escher idea ++ 18:35:43 :) but lets not discuss logos now… 18:35:49 right, sorry. 18:35:52 np 18:36:20 not sure there is anything to add atm, we will need to decide how to decide on the logo eventually, but probably not know 18:36:22 now 18:36:50 move on? 18:36:58 hi brennan 18:37:06 brennan did an awesome work on this! very nice logos 18:37:06 hey h01ger, everyone :) 18:37:12 you've just got the backlog via jabber 18:37:13 https://piratenpad.de/p/repro-build-art 18:37:15 hey! 18:38:35 bnvk: so we are happy with you doing the work/lead on this, but we dont know (yet) how we will eventually decide on the logo… 18:39:22 bnvk: you agree we need to develop a plan/procedure for this, but rather not now. ? 18:39:27 cool 18:39:59 so, there's a few things about that- it's good to have some plan / way to reach consensus 18:40:05 i guess submit a bunch and if it's clear most of us like it we can adopt it, but i think there's no need to add too much process to decide between 49-51 type stuff 18:40:59 infinity0: we dont neccessarily need to define the process and the process can be lightweight for those who'll decide… but yeah, we should spend 100h on this 18:41:02 the proposal I drafted up to try and raise some funding and work on this for a good half month, along with another open source community designer 18:41:24 bnvk: but what happens if we dont like the work? 18:41:52 +anyhow, shall we move on (assuming bnvk will keep this going nicely…)? 18:42:02 i think it's fine if we don't like it but if we have say 5-10 reasonable options that are distinct from each other that's a good end result 18:42:09 yeah let's move on 18:42:33 * h01ger waits for bnvk ack 18:42:35 so ideally, we do a few directions, then do another round of feedback and changes 18:42:47 and then we end up with something that actually gets used 18:42:58 :) 18:43:09 funders generally like to see things they fund get used, and also, as designers so do we 18:43:17 :) 18:43:23 #topic .buildinfo files (and b.d.n) 18:43:32 sure but i also don't want to feel pressured to accept something "or else you don't get paid" :) 18:43:35 just one more comment - 18:43:41 ok 18:43:42 would be good to get some input on directions _before_ you start 18:43:43 . 18:43:49 i'm not suggesting some complex process- but agreeing to use a mechanism like a simple majorty vote has had good success before 18:44:18 infinity0: well, therein lies the conundrum 18:44:21 * h01ger somehow would like to be able to veto out things, but maybe thats just a fear too many 18:44:40 there are two steps: 1) generate alternatives 2) choose one 18:44:44 bnvk: would be nice to send updates on this through the ML, so we can discuss and give feedbacks 18:44:46 #topic logo 18:45:18 (though are we done with this topic now?) ;-p 18:45:22 (for now) 18:45:27 updates and feedback is part of a good design process 18:45:37 i'd prefer for the decision process to be decoupled from the payment, the deliverables can just be "5-10 options that we find reasonable" without pressure on us to pick a specific one 18:45:38 yep 18:45:44 infinity0: yes 18:45:50 and ofc we'll give feedback on what is "reasonable" but i'm happy to be very broad in that aspect 18:46:05 ok… lets move on then. i'm sure bnvk has heard us 18:46:09 #topic .buildinfo files (and b.d.n) 18:46:28 ok, maybe outline this more later then 18:46:30 StevenC99 is giving a talk about .buildinfo files here and i thought this was worth a small topic here 18:46:40 * StevenC99 wakes up 18:46:40 bnvk: yes please do! (and mail the list, please) 18:46:59 vagrant said it would be nice that we can turn a buildinfo into a chroot containing the listed build-deps... 18:47:13 doesnt sbuild do that? 18:47:21 i mean: cant sbuild do that? 18:47:23 so that is sort-of working now, and it allows to, for example, reproduce the buildinfos that ftpmaster has saved 18:47:37 cool 18:47:41 where is that tool? 18:47:49 h01ger: installing the specific-versions listed, I mean 18:47:58 h01ger: in my shell history 18:48:03 \o/ :-D 18:48:12 I'll share it around in the next days 18:48:12 StevenC99, and then it runs a build and confirms that it actually reproduced the binary artifacts? 18:48:22 Neat. 18:48:26 danielsh: not yet, but that's where it's going 18:48:30 StevenC99: are you also working on finding packages which were build in unclean environments? 18:48:54 h01ger: not that I remember, but I could look into that... 18:49:09 :-)! 18:49:11 i'm sure there are some RC bugs to find there 18:49:23 okay 18:49:41 cool! 18:49:44 hmmm, wouldn't this tool play well/replace reprotest? 18:50:07 sangy: it would be nice to combine these somehow 18:50:08 coudlnt this tool be debootstrap? 18:50:25 combining sounds good yes. what's the current form technically atm? (language, libraries it uses etc) 18:50:27 shall we move on? 18:50:33 infinity0: perl and shell... 18:50:44 h01ger: yes, I'll show more on this in a few days 18:50:48 StevenC99: that's what I'm thinkng. We can probably followup later/ on the ml 18:50:48 in the next days* 18:50:54 sangy: ok! 18:50:56 #topic talks at debconf17 18:51:06 so we have StevenC99's talk about .buildinfo files 18:51:15 vagrant will also talk about? 18:51:22 and we have the general reproducible talk 18:51:49 lamby asked to prepare the later after monday next week 18:52:09 there's also an in-toto talk on debconf. It'd be nice to have you guys around. I can't be there bc of visa issues tho ;[ 18:52:13 and I'd like to ask everyone present here to consider joining us giving that talk, even if only for a "small" 5min talk 18:52:17 its more fun to present as a team 18:52:21 sangy: right! 18:52:39 sangy: oh, pity! 18:52:41 cool! sad about visa :( 18:53:00 justin giving that one or someone else? 18:53:05 I know, but my coworker lukas will be there. I hope you guys can meet him and probably brainstorm about it 18:53:13 ah, vagrants talk is about "installing debian" and his experiences doing this with various armboards 18:53:27 sangy: we'll definitly meet lucas. is he here on irc too? 18:53:43 nope, I should've told him to join this meeting 18:53:53 (Please do start preparing the talks before Monday, I just will have no bandwidth until then to join the effort.) 18:54:08 I'll probably ask him to look for you guys 18:54:18 lamby: right! 18:54:47 next topic, which is somewhat related anyway?! 18:55:26 #topic rl meeting at dc17 18:55:26 probably a dumb question: what is RL in this context? 18:55:27 cause we'll need to prepare these talks as we move along to+through debconf anyway… 18:55:32 "real life"? 18:55:33 #topic face-to-face meeting at dc17 18:55:40 #topic RL meeting at dc17 18:55:46 (or at debcamp) 18:55:55 (which is the week before debconf proper, aka now) 18:55:58 ah, I was trying to fill in with "Reproducible ______" 18:56:05 sangy: hehe 18:56:18 +1 but also not sure what needs to be talked about here, we can Just Do It :) 18:56:27 reproducible life? 18:56:33 i'm not sure when, and if its sensible, given we can do lots of in person workmeetings and discussions and have irc too 18:56:54 so, we know who we are and we just meet+tweet? 18:57:01 sgtm 18:57:24 +if someone desires a RL meeting, we can still do one 18:57:34 #topic patched packages in our repo 18:57:36 I'm not at debconf so I cant be there ): 18:58:05 jwnx[m]: which is sad! try to come to taiwan next year! 18:58:15 currently we have 4 patched packages in our repo 18:58:17 a gcc reviewer says he wants to reject my patch but the conversation is ongoing and i don't know what the final result will be 18:58:22 dpkg, gcc6, r-base and go-lang 18:58:23 h01ger: will do! (: 18:58:58 infinity0: as said earlier, i think he just rejects the implementation but not the idea/goal 18:59:03 which is good 18:59:09 what about dpkg and r-base? 18:59:17 he's rejecting the idea of environment variables, which i think is the main important part of the patch 18:59:21 go-lang should land in sid any time now 18:59:30 dpkg's maintainer is happy to accept it, but wanted to wait for gcc to accept my patch first 18:59:45 i need to follow up on r-base 18:59:53 and tweak it a bit 19:00:42 the main issue here is gcc, if they reject it we will basically have a crap ton of more work to do which i think is totally pointless 19:01:04 infinity0: did you ask doko for help? 19:01:05 "crap ton of more work" ? 19:01:07 or Dhole? 19:01:10 i'll need to see how the conversation goes in the next few days though. i don't know if another reviewer can jump in ahead and accept it despite the negative comments 19:01:37 h01ger: yes i talked to doko already, he said to ask them to explain their reasoning (i did that) and we're waiting onthat 19:01:44 (doko is the debian gcc maintainer) 19:01:51 cool 19:02:04 so next topic i gues 19:02:04 s 19:02:15 "crap ton of more work" = patching 1800 debian packages to pass CLI flags to GCC and/or to strip those specific flags out from build output 19:02:46 infinity0: i think the alternative rather should be another patch for gcc than patching 1800 packages (in debian alone) 19:03:23 that's true, i'll thinking if that is possible. envvar is "the obvious way" of doing that and i don't know of suitable alternatives, but i'll have a think 19:03:32 (thanks!) 19:03:54 #topic further work on tests.r-b.o 19:04:34 "sadly" (nah, debconf is too much fun and productive in many ways…) i think wont be able to get much work done on tests.r-b.o here 19:04:45 but i will be very happy to mentor and merge 19:04:54 IMO there are two main areas to tackle: 19:05:08 1. rebuilding and comparing against what was uploaded to ftp.debian.org 19:05:49 2. putting existing json (suse, guix, fdroid) into the db (or putting it in the db in the first place, lede, free+netbsd) and rendering html pages as we do for debian 19:05:50 infinity0, ask him what option he imagined should be added 19:06:06 danielsh: after the meeting, plesase… 19:06:11 yes sir 19:06:55 anybody got anything else to add about tests.r-b.o? 19:07:05 iframes? 19:07:26 sorry everyone. I have to step out. I think the only thing I can comment on is the github issue, for which I have no personal attachment(?) with. I can work on any platform you guys would like (sorry for jumping forward). 19:07:32 1. is what I was trying to work toward with my buildinfo tool 19:07:35 lamby: i think those are well in spectranaut's hands 19:07:51 oops was kicked on internet 19:07:58 yeah I'll remove iframes! 19:08:01 sangy: no worries! thanksfor joining! i'll get around to your commits soon 19:08:03 righte now 19:08:09 sangy: i think we are very fine taking patches from github. just primairly hosting our stuff on github i dont like 19:08:25 StevenC99: awesome 19:08:32 very much so 19:09:57 #topic github 19:10:07 infinity0: ? 19:10:29 i wasn't suggesting that we move to github, only that if we decided to do so then it should be consistent everywhere 19:10:44 why move to github? 19:10:52 We aren't planning on moving to github… 19:11:04 next topic then ? 19:11:10 jwnx[m]: I imagine because contributors need to register with debian alioth currently, for commit access to our repos 19:11:17 for the time being it might be good to disable issues / pull requests on the mirrors in case it confuses people 19:11:29 we should mirror to github, probably, for even easier forking 19:11:38 infinity0: can you do that? 19:11:42 not sure about disabling PRs, we just need to respond to them 19:11:43 github would be more distro-agnostic but there are alternatives and we can discuss that a separate time 19:11:46 h01ger: We do that already. 19:12:03 StevenC99: thats a good reason (: would this work with gitlab? 19:12:05 I have another project that has github PR's open... we just respond saying "Please send this to [link]" and that works 19:12:16 lower barrier to participate 19:12:17 lamby: automatically? 19:12:25 h01ger: any idea which is the right channel for problems regarding pbuilder? 19:12:36 h01ger: Yes, since January. 19:12:45 No, Feb 19:12:50 lynxis: #debian-qa 19:12:52 lamby: ah, ok 19:12:59 could also put the information in the README ("please don't submit PRs here, send them to the ML") 19:13:04 for all repos? jenkins is not among them 19:13:18 but cool 19:13:20 (Can't disable PRs, I disabled everything else however) 19:13:23 #topic any other business 19:14:28 h01ger: (I didn't mirror jenkins.debian.net by default as it's under QA umbrella. Happy to start, let me know.) 19:14:35 lamby: please do 19:15:04 +if there is nothing else… (will give it two more minutes or so…) 19:15:09 #action mirror jenkins.debian.net by default as it's under QA umbrella (lamby) 19:16:09 RWS3? 19:16:31 StevenC99: right. i guess i need to reply to mails in my inbox 19:16:34 thanks for the reminder 19:17:08 +if there is nothing else… (will give it another minute or so…) 19:18:22 thank you all for joining this & all the rest! 19:18:25 #endmeeting