Thanks Philipp. Following that result, please find a patch proposal:
--- a/policy/ch-source.rst
+++ b/policy/ch-source.rst
@@ -338,9 +338,9 @@
For example, the build target should pass ``--disable-silent-rules``
to any configure scripts. See also :ref:`s-binaries`.
-For packages in the main archive, required targets must not attempt
-network access, except, via the loopback interface, to services on the -build host that have been started by the build.
+Required targets must not attempt network access, except, via the
+loopback interface, to services on the build host that have been started
+by the build.
Required targets must not attempt to write outside of the unpacked
source package tree. There are two exceptions. Firstly, the binary
On 2024-04-02 09:21, Sean Whitton wrote:
Hello,
On Mon 01 Apr 2024 at 05:29pm +02, Aurelien Jarno wrote:
The debian policy, section 4.9, forbids network access for packages in the main archive, which implicitly means they are authorized for
packages in contrib and non-free (and non-free-firmware once #1029211 is fixed).
This gives constraints on the build daemons infrastructure and also brings some security concerns. Would it be possible to extend this restriction to all archives?
We need to know if this is going to break existing packages and allow
some input from their maintainers. Are you able to prepare a list of
the affected packages?
Fair enough. I can work on that, but help would be welcome as my
resources are limited.
On Mon, Apr 01, 2024 at 05:29:54PM +0200, Aurelien Jarno wrote:
This gives constraints on the build daemons infrastructure and also
brings some security concerns. Would it be possible to extend this restriction to all archives?
Does the build daemons actually build non-free ?
Tobias Frost <tobi@debian.org> writes:
On Wed, Apr 03, 2024 at 10:58:37PM +0200, Aurelien Jarno wrote:
Thanks Philipp. Following that result, please find a patch proposal:
--- a/policy/ch-source.rst
+++ b/policy/ch-source.rst
@@ -338,9 +338,9 @@
For example, the build target should pass ``--disable-silent-rules``
to any configure scripts. See also :ref:`s-binaries`.
-For packages in the main archive, required targets must not attempt
-network access, except, via the loopback interface, to services on the
-build host that have been started by the build.
+Required targets must not attempt network access, except, via the
+loopback interface, to services on the build host that have been started >> +by the build.
Required targets must not attempt to write outside of the unpacked
source package tree. There are two exceptions. Firstly, the binary
LGTM, Seconded.
Also looks good to me. Seconded.
Hi,
On 2024-04-03 12:37, Philipp Kern wrote:
Hi,
On Tue, Apr 02, 2024 at 06:58:35AM +0200, Aurelien Jarno wrote:
On 2024-04-02 09:21, Sean Whitton wrote:
Hello,
On Mon 01 Apr 2024 at 05:29pm +02, Aurelien Jarno wrote:
The debian policy, section 4.9, forbids network access for packages in
the main archive, which implicitly means they are authorized for packages in contrib and non-free (and non-free-firmware once #1029211 is
fixed).
This gives constraints on the build daemons infrastructure and also brings some security concerns. Would it be possible to extend this restriction to all archives?
We need to know if this is going to break existing packages and allow some input from their maintainers. Are you able to prepare a list of the affected packages?
Fair enough. I can work on that, but help would be welcome as my resources are limited.
I did a test rebuild of contrib, non-free and non-free-firmware packages
in sid with both stable sbuild schroot and unshare backends and could
not find a difference in build success (i.e. what failed failed in both, what succeeded succeeded in both).
Thanks Philipp. Following that result, please find a patch proposal:
--- a/policy/ch-source.rst
+++ b/policy/ch-source.rst
@@ -338,9 +338,9 @@
For example, the build target should pass ``--disable-silent-rules``
to any configure scripts. See also :ref:`s-binaries`.
-For packages in the main archive, required targets must not attempt
-network access, except, via the loopback interface, to services on the -build host that have been started by the build.
+Required targets must not attempt network access, except, via the
+loopback interface, to services on the build host that have been started
+by the build.
Required targets must not attempt to write outside of the unpacked
source package tree. There are two exceptions. Firstly, the binary
Regards
Aurelien
--
Aurelien Jarno GPG: 4096R/1DDD8C9B aurelien@aurel32.net http://aurel32.net
Package: debian-policy
Version: 4.6.2.1
Severity: normal
X-Debbugs-Cc: dsa@debian.org, wb-team@buildd.debian.org
Control: affects -1 buildd.debian.org
Hi,
The debian policy, section 4.9, forbids network access for packages in
the main archive, which implicitly means they are authorized for
packages in contrib and non-free (and non-free-firmware once #1029211 is fixed).
This gives constraints on the build daemons infrastructure and also
brings some security concerns. Would it be possible to extend this restriction to all archives?
Hi,
On 04.04.24 20:51, Bill Allombert wrote:
I still think we should allow Autobuild: no as an escape hatch.
If we want to require non-free package to be autobuildable, we should
be more explicit about it (and probably require more feedback from debian-devel).
There is no requirement for non-free to be autobuildable today. This change also does not introduce this, except for everything that is to be built on official builders to not require network access.
I'm not sure what I think about that. We have a general escape hatch
already for non-free packages in Policy 2.2.3 that says they may not fully comply with Policy, which may be sufficient.
Hi,
On Tue, Apr 02, 2024 at 06:58:35AM +0200, Aurelien Jarno wrote:
On 2024-04-02 09:21, Sean Whitton wrote:
Hello,
On Mon 01 Apr 2024 at 05:29pm +02, Aurelien Jarno wrote:
The debian policy, section 4.9, forbids network access for packages in the main archive, which implicitly means they are authorized for packages in contrib and non-free (and non-free-firmware once #1029211 is
fixed).
This gives constraints on the build daemons infrastructure and also brings some security concerns. Would it be possible to extend this restriction to all archives?
We need to know if this is going to break existing packages and allow some input from their maintainers. Are you able to prepare a list of
the affected packages?
Fair enough. I can work on that, but help would be welcome as my
resources are limited.
I did a test rebuild of contrib, non-free and non-free-firmware packages
in sid with both stable sbuild schroot and unshare backends and could
not find a difference in build success (i.e. what failed failed in both,
what succeeded succeeded in both).
On Thu, Apr 04, 2024 at 01:22:19PM -0700, Russ Allbery wrote:
I'm not sure what I think about that. We have a general escape hatch already for non-free packages in Policy 2.2.3 that says they may not fully comply with Policy, which may be sufficient.
But precisely, we _do_ want non-free packages that are built on the autobuilders
to comply with this requirement. So we do not want 2.2.3 to apply in that specific case. It seems cleaner to say that the requirement only apply if Autobuild: yes is declared.
Hello,
On Mon 01 Apr 2024 at 05:29pm +02, Aurelien Jarno wrote:
Package: debian-policy
Version: 4.6.2.1
Severity: normal
X-Debbugs-Cc: dsa@debian.org, wb-team@buildd.debian.org
Control: affects -1 buildd.debian.org
Hi,
The debian policy, section 4.9, forbids network access for packages in
the main archive, which implicitly means they are authorized for
packages in contrib and non-free (and non-free-firmware once #1029211 is fixed).
This gives constraints on the build daemons infrastructure and also
brings some security concerns. Would it be possible to extend this restriction to all archives?
We need to know if this is going to break existing packages and allow
some input from their maintainers. Are you able to prepare a list of
the affected packages?
On Wed, Apr 03, 2024 at 10:58:37PM +0200, Aurelien Jarno wrote:
Thanks Philipp. Following that result, please find a patch proposal:
--- a/policy/ch-source.rst
+++ b/policy/ch-source.rst
@@ -338,9 +338,9 @@
For example, the build target should pass ``--disable-silent-rules``
to any configure scripts. See also :ref:`s-binaries`.
-For packages in the main archive, required targets must not attempt
-network access, except, via the loopback interface, to services on the
-build host that have been started by the build.
+Required targets must not attempt network access, except, via the
+loopback interface, to services on the build host that have been started
+by the build.
Required targets must not attempt to write outside of the unpacked
source package tree. There are two exceptions. Firstly, the binary
LGTM, Seconded.
Hello,
On Mon 01 Apr 2024 at 05:29pm +02, Aurelien Jarno wrote:
Package: debian-policy
Version: 4.6.2.1
Severity: normal
X-Debbugs-Cc: dsa@debian.org, wb-team@buildd.debian.org
Control: affects -1 buildd.debian.org
Hi,
The debian policy, section 4.9, forbids network access for packages in
the main archive, which implicitly means they are authorized for
packages in contrib and non-free (and non-free-firmware once #1029211 is fixed).
This gives constraints on the build daemons infrastructure and also
brings some security concerns. Would it be possible to extend this restriction to all archives?
We need to know if this is going to break existing packages and allow
some input from their maintainers. Are you able to prepare a list of
the affected packages?
"Aurelien" == Aurelien Jarno <aurel32@debian.org> writes:
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 429 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 113:38:36 |
| Calls: | 9,055 |
| Calls today: | 2 |
| Files: | 13,395 |
| Messages: | 6,016,252 |