/srv/irclogs.ubuntu.com/2012/09/17/#ubuntu-meeting.txt

=== doko_ is now known as doko
=== mmrazik is now known as mmrazik|lunch
=== mmrazik|lunch is now known as mmrazik
=== hggdh_ is now known as hggdh
=== Ursinha` is now known as Ursinha
=== Ursinha is now known as Ursula
=== Ursula is now known as Guest90196
=== Guest90196 is now known as Ursinha
=== pleia2_ is now known as pleia2
jdstrandhi!18:12
jjohanseno/18:12
* sbeattie waves18:12
tyhicksHello18:12
mdeslauro/18:12
jdstrand#startmeeting18:12
meetingologyMeeting started Mon Sep 17 18:12:43 2012 UTC.  The chair is jdstrand. Information about MeetBot at http://wiki.ubuntu.com/meetingology.18:12
meetingologyAvailable commands: #accept #accepted #action #agree #agreed #chair #commands #endmeeting #endvote #halp #help #idea #info #link #lurk #meetingname #meetingtopic #nick #progress #rejected #replay #restrictlogs #save #startmeeting #subtopic #topic #unchair #undo #unlurk #vote #voters #votesrequired18:12
jdstrandThe meeting agenda can be found at:18:12
jdstrand[LINK] https://wiki.ubuntu.com/SecurityTeam/Meeting18:12
jdstrand[TOPIC] Announcements18:12
=== meetingology changed the topic of #ubuntu-meeting to: Announcements
* jdstrand is waiting for one more person18:15
sarnoldjdstrand: pong18:16
jdstrandsarnold: fyi, The meeting agenda can be found at: https://wiki.ubuntu.com/SecurityTeam/Meeting18:16
sarnold(sorry friends, I was unaware that #ubuntu-* was the shorthand for "find it on freendoe")18:17
jdstrandso, only announcement this week is welcoming sarnold to the ubuntu-security team :)18:17
mdeslaursarnold: welcome! (again!)18:17
jdstrandsarnold: welcome! :)18:17
jjohansenWelcome sarnold18:17
sarnoldthank you all :)18:17
jdstrand[TOPIC] Weekly stand-up report18:18
=== meetingology changed the topic of #ubuntu-meeting to: Weekly stand-up report
jdstrandI'll go first18:18
jdstrandI'm on triage this week and am also patch piloting. I am supposed to do that today, but may need to reschedule... we'll see18:19
jdstrandI've got quite a bit of backlog from last week that I need to get through18:19
jdstrandand also follow-ups surrounding the manager's sprint18:19
jdstrandI also figure I'll be helping sarnold come up to speed a bit18:20
jdstrandI've also got some audits to do, and hopefully get to some updates18:20
jdstrandmdeslaur: you're up18:20
mdeslaurI just published some updates18:21
mdeslaurand am working on testing dhcp and dbus updates18:21
mdeslaurI need to investigate some gpg key issues18:21
mdeslaurand then will pick something else from the list18:21
mdeslaurthat's it from me18:21
mdeslaursbeattie: you're up18:21
sbeattieI'm on community this week18:22
sbeattieI'm briefly looking at a regression fix for openjdk-7 for doko18:22
sbeattieI've also got glibc on my plate18:23
sbeattieI've still got the apparmor/dbus stuff to upload to a ppa18:23
sbeattieafter that, I'll try to pick up another update or two18:24
sbeattiethat's it for me.18:24
tyhicksI'm up since Micah is out today18:24
tyhicksI'm in the happy place again this week18:24
tyhicksI'll be submitting the fix for bug 1051892 to upstream OpenSSL today for their comments18:24
ubottuLaunchpad bug 1051892 in openssl (Ubuntu) "[Quantal] Regression in TLS 1.2 workarounds" [High,Triaged] https://launchpad.net/bugs/105189218:24
tyhicksThen I'll proceed with preparing updates for rubygems and ruby1.9.118:25
tyhicksWith the kernel merge window coming up soon, I need to get through all of my eCryptfs patch review backlog18:25
tyhicksI'm also in the process of getting the latest AppArmor introspection interface patches from jjohansen to start work on my related work items18:25
tyhicksjjohansen: You're up18:25
jjohansenI have an apparmor QRT failure happening on the QA machines but not locally to finish tracking down. The IMA config and YAMA upstream sync to finish up.18:25
jjohansenI still have to get together with sbeattie/tyhicks over apparmor dbus stuff18:25
jjohansenAnd then its back to apparmor labeling/stacking18:25
jjohansenthats it for me, jdstrand back to you18:26
jdstrandsarnold: you're up18:28
jdstrandjjohansen: jeez, already ignoring the new guy :P18:28
jjohansenoops18:28
sarnoldnew-employee handling; I think I've just about finished making launchpad happy18:28
sarnoldI downloaded the magic cve tool but I was a bit shocked at how many CVE entries from three years ago appear to still need work -- are those for real? :)18:29
jdstrandyes, they are18:29
sarnoldoh. my.18:29
jdstrandCanonical-supported CVEs should not really be above 'low' though18:29
jdstrandcommunity supported packages are in various states of up-to-dateness18:30
sarnoldso, CVE-2008-2004 isn't 'low' but it does have a handful of 'needed'... is that waiting on upstream?18:30
ubottuThe drive_init function in QEMU 0.9.1 determines the format of a raw disk image based on the header, which allows local guest users to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted. (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2004)18:30
jdstrand(of course, we have some mediums to do, but you'll see more of that this week)18:30
jdstrandsarnold: without looking, xen-3.3 userspace is in universe and community supported18:31
sarnoldah!18:31
sarnoldso the situation is not as dire as it first looked. Thanks.18:32
sarnoldjdstrand: I think that covers me for now. :) Thanks.18:32
jdstrandwell, not for canonical supported stuff anyway :)18:32
jdstrandnp18:32
jdstrandwhich brings me to our next topic18:32
jdstrand[TOPIC] Highlighted packages18:32
=== meetingology changed the topic of #ubuntu-meeting to: Highlighted packages
jdstrandThe Ubuntu Security team will highlight some community-supported packages that might be good candidates for updating and or triaging. If you would like to help Ubuntu and not sure where to start, this is a great way to do so.18:32
jdstrandSee https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures for details and if you have any questions, feel free to ask in #ubuntu-security. To find out other ways of helping out, please see https://wiki.ubuntu.com/SecurityTeam/GettingInvolved.18:33
jdstrandhttp://people.canonical.com/~ubuntu-security/cve/pkg/sun-javadb.html18:33
jdstrandhttp://people.canonical.com/~ubuntu-security/cve/pkg/osc.html18:33
jdstrandhttp://people.canonical.com/~ubuntu-security/cve/pkg/ejabberd.html18:33
jdstrandhttp://people.canonical.com/~ubuntu-security/cve/pkg/pure-ftpd.html18:33
jdstrandhttp://people.canonical.com/~ubuntu-security/cve/pkg/libdbd-pg-perl.html18:33
jdstrand[TOPIC] Miscellaneous and Questions18:33
=== meetingology changed the topic of #ubuntu-meeting to: Miscellaneous and Questions
jdstrandThere are a lot of merge opportunities for packages listed in http://people.canonical.com/~ubuntu-security/d2u/. Performing these updates is a great way to help Ubuntu and bolster your developer application.18:33
jdstrandDoes anyone have any other questions or items to discuss?18:33
jdstrand#endmeeting18:37
=== meetingology changed the topic of #ubuntu-meeting to: Ubuntu Meeting Grounds | Calendar/Scheduled meetings: http://fridge.ubuntu.com/calendar | Logs: https://wiki.ubuntu.com/MeetingLogs | Meetingology documentation: https://wiki.ubuntu.com/meetingology
meetingologyMeeting ended Mon Sep 17 18:37:44 2012 UTC.18:37
meetingologyMinutes (wiki):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2012/ubuntu-meeting.2012-09-17-18.12.moin.txt18:37
meetingologyMinutes (html):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2012/ubuntu-meeting.2012-09-17-18.12.html18:37
mdeslaurthanks jdstrand!18:37
jdstrandmdeslaur, sbeattie, tyhicks, jjohansen, sarnold: thanks!18:37
jjohansenthanks jdstrand18:38
tyhicksthanks!18:38
sbeattiethanks jdstrand18:38
sarnoldjdstrand: btw, the /Meeting agenda page has two times listed for the meetings; both 1700 UTC and 1800 UTC. Is one more common than the other?18:39
jdstrandsarnold: no, that is an error18:39
* jdstrand adjusts18:39
jdstrandsarnold: fixed! it will always be 1800 UTC, DST or no18:40
sarnoldjdstrand: thanks18:41
jdstrandsarnold: nice eye :)18:41
=== billy_idle is now known as march
mdzcjwatson, TB today?20:00
* pitti waves20:00
mdzo/20:01
cjwatsonhi20:02
cjwatsonI think I was due to be chair last time but was absent20:02
cjwatsonor the meeting didn't happen or something20:02
cjwatsonwe do actually have an agenda this time20:02
cjwatsonkees,stgraber,soren_: around?20:03
stgraberyep20:04
stgraberI believe I (and maybe some others) missed last meeting because I was just getting back from Linux Plumbers and it was a public holiday in the US and Canada20:05
cjwatson#startmeeting20:08
meetingologyMeeting started Mon Sep 17 20:08:51 2012 UTC.  The chair is cjwatson. Information about MeetBot at http://wiki.ubuntu.com/meetingology.20:08
meetingologyAvailable commands: #accept #accepted #action #agree #agreed #chair #commands #endmeeting #endvote #halp #help #idea #info #link #lurk #meetingname #meetingtopic #nick #progress #rejected #replay #restrictlogs #save #startmeeting #subtopic #topic #unchair #undo #unlurk #vote #voters #votesrequired20:08
cjwatsonI guess we have quorum20:08
cjwatson#topic action review20:09
=== meetingology changed the topic of #ubuntu-meeting to: action review
cjwatsonThe last minutes I see are ancient: https://lists.ubuntu.com/archives/ubuntu-devel-announce/2012-May/000958.html20:09
cjwatsonSo I'm going to assume that we've just been quiet for that long and have no actions to review at this point; shout if that's untrue20:09
cjwatson#topic nvidia/fglrx expedited SRUs (bryce)20:10
=== meetingology changed the topic of #ubuntu-meeting to: nvidia/fglrx expedited SRUs (bryce)
pittididn't we have some brainstorm review pending?20:10
cjwatsonI'll have a look and get back to that later, then20:10
cjwatson#topic action review20:11
=== meetingology changed the topic of #ubuntu-meeting to: action review
cjwatson<stgraber> #action stgraber to try and find all the places to update the TB meeting time to 20:00 UTC20:11
cjwatsonnow that I found the IRC logs20:11
cjwatsonstgraber: did that happen?20:11
stgraberyep, fridge was updated and wiki too, not aware of any other place to change20:11
cjwatsonOK20:12
cjwatsonsoren_: so, this brainstorm review ...20:12
cjwatson(async ping as he doesn't seem to be here)20:12
cjwatson#topic nvidia/fglrx expedited SRUs (bryce)20:13
=== meetingology changed the topic of #ubuntu-meeting to: nvidia/fglrx expedited SRUs (bryce)
cjwatsonbryceh: would you like to hash this out any more here?  we don't seem to have consensus yet on the issue of unsubstantiated regressions20:14
pittithis was discussed on the ML for a bit already, but the fundamental stability vs. fast turnaround conflict remains20:14
brycehhi20:14
cjwatsonI'm not sure I see that as the principal conflict :)20:14
pittibut I think the whole point of this request was to get leniency on stability there, so I guess we should rather discuss how to get back to the "normal" driver as quickly as possible?20:14
brycehcjwatson, yeah I was distracted writing a reply to that email20:14
cjwatsonwell, I did only send my reply earlier today20:14
cjwatsonin general I'm supportive of being able to be a bit more relaxed about -updates SRUs, but I want to ensure that we aren't causing problems by doing o20:15
cjwatson*so20:15
* bryceh nods20:15
mdzyes, I understood the goal to be to offer an alternative update stream which users could opt in to, with a greater tolerance for possible regressions in favor of compatibility with newer apps20:15
cjwatsonright, *if* users understand that that's what they're opting into20:16
mdzyes20:16
mdza warning would be appropriate20:16
cjwatsonmy concern is that if nvidia-current is busted for a user and nvidia-current-updates works, then their perception will be "this is the one that works" and will be discombobulated when it breaks20:16
pittiat the time when they need it, they probably won't have much incentive to not use it20:16
cjwatsonthis would be a lot easier if we could start things off this way as of (say) quantal, with update-manager having reset people to non-updates on upgrade20:17
cjwatsonis that a feasible thing to do, or do we really really need this for precise?20:17
pittibryceh: I did understand that for -experimental we do want to get back to the "regular" driver on every dist-upgrade; is that planned for -updates as well?20:17
brycehmdz, we are adding a warning for the nvidia-experimental package; currently there is no warning on nvidia-current-updates, although I think we could use the same mechanism to add one.20:17
pittiwell, I do think that regression reports for -updates should at least hold the line, as usual for SRUs; for -experimental, being quick is the very point of the exercise, so that's where the leniency comes in, no?20:18
brycehpitti, right, plan is that we're doing that for -experimental.  Whether to do that for -updates is open for discussion.20:19
cjwatsonI'm not sure I see how the mechanism pitti proposes will achieve this20:19
cjwatsonthe proposal is that, at release time, -experimental is an empty transitional package depending on nvidia-current20:19
pitticjwatson: I'm mostly concerned about enabling this for your favorite game of the day, and then forgetting about it, so that you keep having the risk for all eternity20:19
cjwatsonand that later -experimental becomes a real package and drops the Depends20:20
cjwatsonBut that doesn't help, because everyone who had -experimental installed earlier still has it installed, transitional package or not20:20
cjwatsonSo the upgrade will turn it from transitional to real and we have the same problem20:20
pittithat would only work for dist-upgrades until there is a newer -experimental in the newer release, yes20:20
pittiso that does need u-m support20:20
cjwatsonThe only way I can see this working properly is bryceh's suggestion of changing package names for each nvidia series20:21
cjwatsonWhich is somewhat inelegant, but perhaps the best we can do?20:21
brycehcjwatson, to your earlier question, yes it's strongly wanted for the LTS20:21
pittiwe did have that in the past, and for some reason that was changed to the -current name; but yes, -NNN would ceratainly make these upgrades work with pure apt20:21
cjwatson-current makes more sense for "the one we want most people to use"20:22
brycehyep20:22
brycehone question I don't have a good opinion on, so would like advice:20:23
cjwatsonso yes - if we can start from a clean slate, and ensure that anyone who installs the given package has seen a warning (or had to go to effort to preseed it away), then I'm moderately sanguine about some reasonable approach to handle regressions that we can't substantiate with reasonable effort20:23
brycehonce the beta is done and an official version is released by NVIDIA, should we update nvidia-experimental to the release version or leave it at whatever old beta driver it was on?20:24
cjwatsonnvidia-NNN-experimental, no?20:24
cjwatson(or similar naming)20:24
brycehor nvidia-experimental-NNN20:24
cjwatsonthere doesn't seem much point in leaving it at a beta version for the sake of it, really20:25
cjwatsonassuming that in general official > earlier-versioned-beta ...20:25
pittiwhy do we need both "-experimental" and "-NNN"? I thought -NNN would suffice?20:26
brycehcjwatson, so like if we have nvidia-experimental-123, and 123.11, 123.22, 123.33 are the beta version, with 123.44 being the official release, should we leave it to 123.33 or go to 123.44 (which would also presumably appear in nvidia-current-updates at some point)20:26
cjwatsonis there a reason why people might want 123.33 not 123.44?20:26
pittiI think we should update betas to finals20:26
pittichances are that some games need the fixes anyway?20:27
brycehyeah that's what I'm thinking...20:27
ScottKMake nvidia-experimental-123 transitional and have it depend on nvidia-current-updates once the release is done.20:27
pittiand if we don't release beta->final to experimental due to caution, why would we do that for -updates?20:27
cjwatsonright, I have trouble thinking of a reason why we wouldn't; although I wonder whether that should be done by depending on nvidia-current-updates (thus making it mean ">= 123") or freezing it at a particular 123 subversion20:27
cjwatsonIYSWIM20:27
brycehok great20:27
pittiso why do we need the "-experimental" suffix if we already have a -NNN? am I missing something?20:28
pittiI think we do need the -NNN for ensuring that upgrades always reset to the stable one20:28
* bryceh ponders20:28
cjwatsonI'm not fussed about -experimental if there's a warning saying as much20:29
brycehthere is some messaging value to -experimental, for people who might not read the warning but would see the package name, however technically I don't see any reason to favor that over just -NNN20:29
brycehif it is -NNN then people may expect us to update it with post-release updates of the driver20:30
brycehwhereas I'd sort of prefer to be done with the package once the beta is over20:30
cjwatsoncompare gcc-snapshot20:30
cjwatsondifferent audience there of course20:31
pittiok, if it's just for the warning effect (not for some dependency magic), I'm fine with that20:31
brycehpitti, fine with that being to keep -experimental or exclude it?20:33
pittibryceh: with either really; I was mostly curious for what exactly we need the -experimental suffix20:33
pittiactually20:33
pittiit's helpful to have it for ubuntu-drivers-common20:34
brycehok20:34
pittiit currently filters "experimental" on the package name to sort it last in the "recommended version" list20:34
brycehaha, good.20:34
cjwatsonso, is there any remaining dissent here which we need to vote on, or do you think we're good to go on this?20:34
pittiso that it only ever installs that if no other version supports your card20:34
pittido we have consent on the SRU verification? cjwatson's last mail sums it up pretty well IMHO20:35
cjwatsonScottK: does this discussion meet the concerns you expressed on the list - that is, weaken handling of hard-to-substantiate regressions (but don't ignore them entirely) for nvidia/fglrx packages where users have previously been warned about potential instability?20:38
cjwatson(which is about the best one-sentence summary I can come up with)20:38
ScottKcjwatson: I'm concerned that if we make a special rule for unsubstantiated regressions for one package, it'll spread.20:39
ScottKI'd much rather say for this one package, a certain degree of regression is OK.20:39
ScottKIt's a binary blob video driver, so we can't fix it anyway, it's optional, and video drivers very rarely are 100% improvement for alll hardware.20:40
cjwatsonSo you'd rather not include a rationale with the policy in case it's taken as a general example, basically?20:41
cjwatsonI can live with that.20:41
pittiyeah, fine for me as well; if we say "this package will always be the latest beta driver", this states it's very reason of existance, and implicitly contains that it won't stop upgrading20:42
cjwatsonOr "the latest beta driver in series NNN" or whatever.20:43
cjwatsonI think I'm happy to leave that part up to the teams dealing with it.20:43
brycehthis all sounds great :-)20:44
cjwatsonOK, let's move on20:48
cjwatson#topic Scan the mailing list archive for anything we missed20:48
=== meetingology changed the topic of #ubuntu-meeting to: Scan the mailing list archive for anything we missed
cjwatsonEdubuntu Sponsorship Process20:49
cjwatsonHas a couple of +1s although I concur with Mark's comment that this is more a matter for trademark@20:49
cjwatsonhighvoltage: ^- if you feel this needs more, please follow up20:50
cjwatsonExtension of term lengths - done20:50
cjwatsonAnd I don't see anything else of any note20:50
pittineither do I20:50
pittithe rest was handled by mail20:50
Laneytransferring the kernel packageset20:51
LaneyI didn't see any comment on that in my mail20:51
Laneyadmittedly it was tacked on to the end20:51
cjwatsoncommunity bugs, just the usual takes-ages-to-resolve20:51
cjwatsonLaney: URL?20:51
highvoltagecjwatson: ah, it's been handled by mail, thanks20:51
Laneyhttp://mid.gmane.org/20120827200048.GB14343@orangesquash.org.uk20:51
Laneyif that works20:51
highvoltage(at least, I believe so)20:51
stgraberLaney: well, we first need a way of actually doing that ;)20:52
Laneythat'll be landed soon20:52
Laneyif changing owner is a part of that branch20:52
stgrabernot sure what's in the branch, ideally we'd need to have the delete function mapped and make all the attributes read/write20:53
Laneyso, if you could agree it then someone can JFDI when it becomes possible20:53
Laneyif this is in that branch then great, otherwise SMOP20:53
cjwatsonMakes sense to me for DMB to own the kernel set20:55
cjwatsonOnce possible20:56
cjwatsonIf it's urgent for some reason we could try to arrange for manual SQL, but I'd really rather not20:56
stgrabernah, not urgent. I'll do any update the DMB needs to do to it as I have both DMB and TB hats.20:56
cjwatsonOK20:56
cjwatson#topic AOB20:56
=== meetingology changed the topic of #ubuntu-meeting to: AOB
cjwatsonanything else?  we have three minutes20:57
brycehcjwatson, regarding the nvidia proposals, did the discussion above qualify as a vote or does a formal vote still need to be held?20:57
cjwatsonAFAICT there was consensus and therefore no need for a vote20:58
brycehawesome, thanks.20:58
pitti*agree*20:58
cjwatson#endmeeting21:00
=== meetingology changed the topic of #ubuntu-meeting to: Ubuntu Meeting Grounds | Calendar/Scheduled meetings: http://fridge.ubuntu.com/calendar | Logs: https://wiki.ubuntu.com/MeetingLogs | Meetingology documentation: https://wiki.ubuntu.com/meetingology
meetingologyMeeting ended Mon Sep 17 21:00:50 2012 UTC.21:00
meetingologyMinutes (wiki):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2012/ubuntu-meeting.2012-09-17-20.08.moin.txt21:00
meetingologyMinutes (html):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2012/ubuntu-meeting.2012-09-17-20.08.html21:00
cjwatsonThanks all21:00
pittithanks everyone!21:01
pittiand good night21:01
cjwatsonI'll sort out minutes in a bit21:01
cjwatsonIn a shocking departure from routine21:01
stgraberthanks21:04
=== bulldog98_ is now known as bulldog98

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!