• Streamlining d-i releases

    From Cyril Brulebois@21:1/5 to All on Wed Apr 5 23:20:01 2023
    XPost: linux.debian.maint.boot, linux.debian.devel.release

    Hi ftp team,

    As you know, publishing a Debian Installer release involves a bunch of
    steps across various parts of the infrastructure, spanning across many
    teams:
    - debian-boot (many udebs + src:debian-installer upload)
    - ftpmaster (dak copy-installer)
    - debian-release (udebs + src:debian-installer migration)
    - debian-cd (image builds)
    - debian-www (debian.org/devel/debian-installer)

    I'm able to prepare website updates via the webwml repository and to
    trigger a partial rebuild of the website to publish the announce (via
    an update-part sudo entry on wolkenstein).

    Via debian-release I'm also able to hint (via unblock, unblock-udeb,
    and urgent) udeb packages into testing, then block the migration of udeb-producing packages for a few hours or days, which lets me upload src:debian-installer on my own timing. I'm also able to hint it into
    testing once it's built everywhere.

    Since we have many moving parts, and since regressions or worries can
    come up at any time, I don't think we would be able to come up with
    some kind of schedule to coordinate with the ftp team, and I'm left
    with having to poke you folks without advance warning. I really don't
    like doing that, and depending on your availability, that might mean
    several hours (all fine) or sometimes several days until the dak
    copy-installer step happens. Once one factors in the other delays
    (britney runs for package migration, dinstall runs to make changes
    visible on mirrors, prior to the debian-installer upload, or after the
    dak copy-installer step), this means the release process takes a very
    while, including (sometimes very) long pauses…

    I'd like to see if we could shorten it by getting some extra autonomy,
    to shorten the udeb freeze (it affects a bunch of packages that aren't
    under the installer team's umbrella, and outside freeze stages it has
    already upset people enough to trigger an argument during what was
    supposed to be a nice evening at DebConf…) and to keep the release
    energy and motivation as high as possible.

    I realize that getting a sudo line on fasolo would mean increasing the
    security risks quite a bunch for a limited gain. Since we already have
    a mechanism to trigger changes in the archive via release team access,
    that is /srv/release.debian.org/www/proposed-updates/*_comments (which
    we can edit from coccia); maybe something similar could be done to
    trigger dak copy-installer?


    (The other side I usually entirely delegate is building images, and I sync/resync with Steve along the way, based on whether d-i looks good
    or whether I encounter and fix/workaround roadblocks, but I plan on
    learning that on my own as well to avoid putting pressure on Steve
    all the time — got the gid already, lacking know-how at the moment,
    and possibly access to secrets for the ultimate signing.)


    Cheers,
    --
    Cyril Brulebois (kibi@debian.org) <https://debamax.com/>
    D-I release manager -- Release team member -- Freelance Consultant

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEtg6/KYRFPHDXTPR4/5FK8MKzVSAFAmQt458ACgkQ/5FK8MKz VSArdg//fev9FBvKQqioSZimrH9yLo4Ho+2WSWxrSmD4/w+tM9MFz0eAYOv88elT IXLD9dRdrZmdWq6gbZn/iILFXvDDOoKO2a/bIXduOTZLOzThi8mw1Ms1Vc4BDkCs dEakxrwQoqdcI/7sYEdAokhbuyb1wn10CB9bCZ5MyrE/NJlXOVBADFlp8U9t6/U7 wKwb3bgHNmtaTvl4fH+6n30kKkSWsGjXWH4Bc0do8HMqW8K5+p6uAHiatIKVFueS sWcowJaaGfi40mp707dq2+ZxO1CcJuA1li3gnKMnDRLm2KyovI1rCC59lcc76JFg j8VWOLC1tovmlHNrqoe8auSWqnD+Whv53tSLBQ9VckSvAgvKedHSlUk6nb3FTfxA QsHB0WI2HT7QtKZBK9F7+3WrSU0VnvhLnd6RPP245q53ZSBa2sMUtw0Sr33xjmUX ZECIer/HvT1IZ1qQIPDdcB9JQxdc3VFeX2HH+HzytPKtDiEz/Msz3gSczyL0Jwz7 J2CJmYi8sIeLF+uYtbhjBIk/IcHPCuQODnHFTGjaWml5+8fyA8mwhyjNfrHxSvw8 gvrU0hjdyJ5YJGVDQTHCrkYfW1ReokrP2YndRLYG/9pz8l8tvF5I2JUYoIOpO9Mt ZCLRWDbiA2j3jpvX8LzlQNlVk+TQsqZHB4MbVuP138QUTWrdIjY=
    =Rvpd
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    *
  • From Joerg Jaspert@21:1/5 to Cyril Brulebois on Sun Apr 9 23:50:02 2023
    XPost: linux.debian.maint.boot, linux.debian.devel.release

    On 16824 March 1977, Cyril Brulebois wrote:

    I realize that getting a sudo line on fasolo would mean increasing the security risks quite a bunch for a limited gain. Since we already have
    a mechanism to trigger changes in the archive via release team access,
    that is /srv/release.debian.org/www/proposed-updates/*_comments (which
    we can edit from coccia); maybe something similar could be done to
    trigger dak copy-installer?

    I put SSH trigger into the room, instead of sudo. You supply the version
    on the ssh cmdline, and if that exists in unstable, a copy-installer is
    run with that version. Could even be extended to have source and target
    suite selectable too.

    --
    bye, Joerg

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Cyril Brulebois@21:1/5 to All on Mon Apr 10 01:40:01 2023
    XPost: linux.debian.maint.boot, linux.debian.devel.release

    Joerg Jaspert <joerg@debian.org> (2023-04-09):
    I realize that getting a sudo line on fasolo would mean increasing the security risks quite a bunch for a limited gain. Since we already have
    a mechanism to trigger changes in the archive via release team access,
    that is /srv/release.debian.org/www/proposed-updates/*_comments (which
    we can edit from coccia); maybe something similar could be done to
    trigger dak copy-installer?

    I put SSH trigger into the room, instead of sudo. You supply the version
    on the ssh cmdline, and if that exists in unstable, a copy-installer is
    run with that version.

    That looks very good to me, thanks!

    Could even be extended to have source and target suite selectable too.

    I think we only released the installer via tpu once, at least that I
    could confirm by checking my sent box:

    dak copy-installer 20220917 -s bookworm-proposed-updates

    but it could indeed be nice to be able to specify at least the source
    suite, just in case we encounter some blocking bug in unstable again in
    the future.


    Cheers,
    --
    Cyril Brulebois (kibi@debian.org) <https://debamax.com/>
    D-I release manager -- Release team member -- Freelance Consultant

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEtg6/KYRFPHDXTPR4/5FK8MKzVSAFAmQzSpYACgkQ/5FK8MKz VSA6rxAAlVjl+T9SzOvntmRf464B7Srt3B3btQYx0XraK5GlxE8uqAAldYxmtBqn vuNCrQsMIIuAaAAYKmGzJEkvJhwIMxlg2REARxwFllPUMWIyhnZRg2xBf6GXZjAL /D7u0wRFLqNXVcruVutCoaDUqLbB95ZFYQDtgAXpn/aPEEpU8ewrg8wQQfhQzuZw a2XigyP3PurHkXfJNK9y9dOssE1utHJifzPUAZ4LtWCsmTYfmXPRrasbf5mp+9xB cgPMGHwvuU7tH3L3LDX7aAeR3AFwMWzz5DhpPjZCTejB/jl2bz1+Y1toaPXeKJxm gUctPbv6VxBUFVS1YTC0AcKC3W0qFkeCB7J8Ga1zWqiO1RNXW9DyTVlg+JIUtmMH bGwKKzjGGwsBxbKwBmr/KmdVNiV88Uvan4tGEAzFiWOvy0Vjt89hZDbww6mjbweC FJDZpfa69ZYvMVDW8deLcxVc4xPPg/y4W21rVpy3914lfUvYJ4NqtP/HAw3aGgDf 4YmwGeGTPNQJdA62l6ZftriKOhSHfayL7RtSqxv9/JmE+Jf6wAli9fmdA7eLBu4Y 402z7gw38qQJc1kBwvxfUgniEE3fgpIB5Y3c+u7I/w5a6GB4h8dB2omvQQ5jbVTD EnTjLNtvaztTA2Zui6dsoaD0MP5Y+8S+SXHvmYKiISMdltMnv40=
    =v4fZ
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    *
  • From Joerg Jaspert@21:1/5 to Cyril Brulebois on Mon Apr 10 23:20:01 2023
    XPost: linux.debian.maint.boot, linux.debian.devel.release

    On 16829 March 1977, Cyril Brulebois wrote:

    I put SSH trigger into the room, instead of sudo. You supply the
    version
    on the ssh cmdline, and if that exists in unstable, a copy-installer
    is
    run with that version.
    That looks very good to me, thanks!
    Could even be extended to have source and target suite selectable
    too.
    I think we only released the installer via tpu once, at least that I
    could confirm by checking my sent box:

    I prepared a little script. Now need a SSH key to allow.
    Usage is simple, you MUST supply a version, you CAN supply a source and
    a dest suite. Space seperated.
    It checks amd64s installer in that suite, and if the version directory
    exists, it calls dak copy-installer on it.

    --
    bye, Joerg

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)