| RAOF | mwhudson: You could add that amd64 as a foreign arch to dpkg? | 00:23 |
|---|---|---|
| RAOF | mwhudson: I think? | 00:24 |
| mwhudson | RAOF: how do i do that again? | 00:33 |
| mwhudson | oh dpkg add-architecture | 00:34 |
| mwhudson | but no | 00:34 |
| mwhudson | W: Failed to fetch http://www.apache.org/dist/cassandra/debian/dists/20x/InRelease Unable to find expected entry 'main/binary-arm64/Packages' in Release file (Wrong sources.list entry or malformed file) | 00:34 |
| tarpman | mwhudson: you can arch-qualify the sources.list entry... I think [amd64] is the syntax, forget where it goes :) | 00:40 |
| mwhudson | deb arch=amd64 i think maybe? | 00:41 |
| mwhudson | er | 00:42 |
| mwhudson | deb [arch=amd64] http://www.apache.org/dist/cassandra/debian 20x main | 00:43 |
| mwhudson | apparently | 00:43 |
| mwhudson | tarpman: thanks :) | 00:43 |
| === yuning is now known as yuning-lunch | ||
| === yuning-lunch is now known as yuning | ||
| pitti | Good morning | 05:41 |
| dholbach | good morning | 06:39 |
| mvo | hey dholbach | 06:42 |
| dholbach | hey mvo | 06:43 |
| michagogo | Hey, any SRU team members (other than cjwa tson) around? | 07:35 |
| === timrc-afk is now known as timrc | ||
| === dholbach_ is now known as dholbach | ||
| xnox | pitti: on http://dep.debian.net/deps/dep8/ "current specification" link is 404. | 10:37 |
| xnox | pitti: can you update it to point to the right place? And what is the right place these days? | 10:38 |
| pitti | xnox: indeed, should be http://anonscm.debian.org/gitweb/?p=autopkgtest/autopkgtest.git;a=blob_plain;f=doc/README.package-tests.rst;hb=HEAD | 10:38 |
| pitti | xnox: I renamed the files to *.rst | 10:38 |
| pitti | xnox: I can't update it myself, but I'll find out who can | 10:38 |
| xnox | pitti: ok. Are you setting up read-the-docs for autopkgtest? it could process rst to make it look all dandy and stuff. | 10:39 |
| pitti | xnox: the package builds nice *.html files from those now and ships them in /usr/share/doc/ | 10:39 |
| xnox | pitti: ah, cool. | 10:39 |
| pitti | xnox: I haven't felt a strong urge to put them elsewhere, but if there's demand why not | 10:39 |
| xnox | pitti: hm, i think dep8 website can parse RST as well, no? Would be nice if that was the thing directly. | 10:43 |
| pitti | oh, http://dep.debian.net/recentchanges/ looks like some svn | 10:43 |
| pitti | xnox: I'll check out http://dep.debian.net/depdn-howto/ after I'm done with my current multi-thread unwrangling (sorry, too much brain state) | 10:44 |
| xnox | =)))) | 10:45 |
| ogra_ | xnox, do you happen to know if anyone in foundations works on bug 1323732 (did you discuss it in a meeting perhaps) ? | 10:49 |
| ubottu | bug 1323732 in adduser (Ubuntu) "adduser should support managing additional password/shadow/group files from libnss-extrausers" [High,Confirmed] https://launchpad.net/bugs/1323732 | 10:49 |
| ogra_ | (see my last mail to ubuntu-phone) | 10:49 |
| ogra_ | steve asked me to initially assign it to hi so he could hand it to someone after malta ... looks a bit like it was forgotten | 10:50 |
| ogra_ | *him | 10:50 |
| xnox | ogra_: there is no confirmation that slangasek has recovered after 4th of july yet. Since it is still assigned to Steve, I believe you should be poking him. | 10:54 |
| xnox | ogra_: typically he changes assignee when he hands stuff over. | 10:54 |
| === MacSlow is now known as MacSlow|lunch | ||
| ogra_ | xnox, right, just wanted to know if it came up in some team discussion or so | 11:03 |
| ogra_ | thanks | 11:03 |
| pitti | xnox: so I committed http://lists.alioth.debian.org/pipermail/dep-commits/2014-July/000316.html but I guess it'll take a bit to propagate to the website | 12:20 |
| === MacSlow|lunch is now known as MacSlow | ||
| === _salem is now known as salem_ | ||
| === ubott2 is now known as ubottu | ||
| === Trevinho_ is now known as Trevinho | ||
| === Adri2000 is now known as Guest67185 | ||
| === ming is now known as Guest65048 | ||
| pitti | mvo: FYI, $USER is now set for root tests in CI | 12:51 |
| mvo | pitti: thanks ! | 12:53 |
| === iulian_ is now known as iulian | ||
| === Guest67185 is now known as Adri2000_ | ||
| mino_core | hello :) | 13:56 |
| mino_core | is there a way to install the grub deb in a none interactive way, he is askin "Continue without installing GRUB?" and i want to answer with yes | 13:57 |
| mlankhorst | setting question priority lower | 13:58 |
| mino_core | i need that for an automated build of ubuntu, but havent found yet a solution for it | 13:58 |
| mlankhorst | maybe apt-get -qq ? | 14:01 |
| geser | shouldn't setting the debconf frontend to non-interactive help? | 14:03 |
| mlankhorst | oh that one :-) | 14:03 |
| ogra_ | Laney, hmm, did you see my latest meta upload ? seems desktop-next inhertis some stuff from somewhere that touch doesnt have ... | 14:07 |
| ogra_ | (i added all the entries equally to touch and desktop ... but only tcptraceroute was pulled into desktop) | 14:07 |
| Laney | link? | 14:08 |
| ogra_ | Laney, https://launchpad.net/ubuntu/utopic/+source/ubuntu-touch-meta/1.162 | 14:09 |
| ogra_ | Laney, bah, ignore me ... i'm blind | 14:09 |
| Laney | right... was wondering :) | 14:09 |
| ogra_ | (somehow the evolution formatting made me miss "desktop" in all these lines) | 14:10 |
| === desrt_ is now known as desrt | ||
| === doko_ is now known as doko | ||
| === tarpman_ is now known as tarpman | ||
| slangasek | xnox: I suppose we /can/ keep startpar disabled, but is there a specific reason you want to? I hadn't heard about any problems in this regard | 15:05 |
| michagogo | slangasek: hey, you're SRU team, right? | 15:19 |
| michagogo | Just wanted to make sure you saw my email to the ubuntu-devel mailing list | 15:20 |
| michagogo | It would be very much appreciated if you could comment, do whatever is needed to move this along | 15:20 |
| xnox | slangasek: reasons to keep startpar disabled are as follows -> generally unreliable startpar-bridge integration. (a) task jobs hanging boot/shutdown (b) jobs set to manual (e.g. via override file) hanging boot/shutdown (c) little interim gain in resolution of a/b, taking away time to better support systemd (d) startpar is not used under systemd | 15:21 |
| Shock | pitti: hi, any idea of a time frame on LP: #1247584 ? | 16:43 |
| ubottu | Launchpad bug 1247584 in systemd (Ubuntu) "[keymap] Since upgrade to Ubuntu 13.10, udev doesn't map middle mouse button." [Undecided,In progress] https://launchpad.net/bugs/1247584 | 16:43 |
| Shock | I'm unable to find a branch in LP that contains the release of package systemd (204-5ubuntu20.3). Am I not searching where I should, or was that package generated outside of LP/bzr? | 16:46 |
| Shock | distro is trusty | 16:46 |
| doko | jamespage, is this server-team stuff? https://jenkins.qa.ubuntu.com/view/Utopic/view/AutoPkgTest/job/utopic-adt-mongodb/lastBuild/? blocks gcc-4-9, although it is not used | 17:46 |
| === alexisb is now known as alexisb_lunch | ||
| xnox | Shock: there is no branch for it, the upload is here however https://launchpad.net/ubuntu/+source/systemd/204-5ubuntu20.3 which also has links to build-records (and thus debs) and a diff against previous upload (20.2) | 18:27 |
| xnox | Shock: it's been released to updates pocket last thursday. | 18:27 |
| Shock | xnox: thanks, is there a way to create a daily build if there's no branch for it? | 18:35 |
| dobey | xnox, Shock: looks like there's a branch for it to me | 18:36 |
| Shock | dobey: how did you find the branch? | 18:36 |
| dobey | oh, i guess it didn't import | 18:38 |
| dobey | Shock: why would you want to create a daily build for a specific version anyway? | 18:38 |
| Shock | dobey: I want to build udev automatically (with a patch) whenever a new version is released | 18:39 |
| dobey | Shock: in general, or only to trusty-updates? | 18:40 |
| dobey | in general, i don't see why you wouldn't use lp:ubuntu/systemd to do that | 18:41 |
| Shock | dobey: I'm not sure what that means; I'm only interested in trusty atm | 18:41 |
| dobey | though i don't know how you plan on adding the additional patch exactly | 18:42 |
| Shock | dobey: I couldn't find the changes that were in https://launchpad.net/ubuntu/+source/systemd/204-5ubuntu20.3 in lp:ubuntu/systemd | 18:42 |
| Shock | dobey: I plan to use build recipes in launchpad | 18:42 |
| dobey | yeah i'm not sure why they aren't in utopic there | 18:42 |
| dobey | stgraber: ^^ why is that? :) | 18:42 |
| dobey | Shock: i don't see how you will add another patch though | 18:43 |
| Shock | dobey: merge from a personal branch? | 18:43 |
| dobey | Shock: you're going to have to manually resolve conflicts every time there's an update, most likely | 18:43 |
| stgraber | dobey: probably because the importer is broken somehow, that happens. | 18:44 |
| stgraber | dobey: IIRC the Ubuntu systemd packaging is maintained in a git branch on alioth, so I usually just upload to the archive and let pitti deal with the VCS | 18:44 |
| Shock | dobey: the only conflict would be in debian/patches/series | 18:44 |
| dobey | stgraber: i mean, why are those changes from the trusty update, not in utopic? | 18:44 |
| Shock | dobey: and I'm pretty sure I can avoid the conflict by putting my patch as the first line in the series | 18:45 |
| stgraber | dobey: they are in utopic | 18:45 |
| dobey | stgraber: hmm, Shock said he couldn't find them in the utopic package. | 18:46 |
| stgraber | those fixes were uploaded in 204-10ubuntu9 or earlier | 18:46 |
| dobey | ah ok | 18:46 |
| stgraber | the whole point of the SRU to trusty was to get all the fixes of utopic in there so the cgmanager integration patch is now identical in both | 18:47 |
| dobey | Shock: what does your additional patch do exactly, anyway? why not just get it into debian/ubuntu? | 18:47 |
| Shock | dobey: it makes my mouse work :). it's taking too long to get it in ubuntu/upstream LP: #1247584 | 18:48 |
| ubottu | Launchpad bug 1247584 in systemd (Ubuntu) "[keymap] Since upgrade to Ubuntu 13.10, udev doesn't map middle mouse button." [Undecided,In progress] https://launchpad.net/bugs/1247584 | 18:48 |
| dobey | pitti: ^^ get that in already. :) | 18:49 |
| Shock | dobey: in any case, knowing how to build a package with changes wrt official package would help me in other situations | 18:50 |
| Shock | dobey: I'd rather not go through the whole manual ordeal every time the package is updated in the oficial repos | 18:51 |
| dobey | Shock: i'd suggest doing it against trying to build against lp:ubuntu/systemd then | 18:51 |
| Shock | dobey: is there a way I can target the trusty version in a lp build recipe? | 18:52 |
| doko | directhex, mono ping | 18:52 |
| xnox | Shock: in the recipe config you specify target distributions to build against.... | 18:53 |
| dobey | Shock: you mean build it on trusty, or you mean patch against the trusty version? | 18:53 |
| xnox | Shock: hence yes, you control which distribution(s) a given recipe will be build. | 18:53 |
| Shock | dobey: patch against the trusty version | 18:53 |
| dobey | Shock: use the trusty branch, but i don't see why you need to use that specific branch, versus just using the actual newest version | 18:53 |
| dobey | unless the utopic version outright fails to build on trusty or causes it to explode or something | 18:54 |
| xnox | Shock: lp:ubuntu/* branches are never guaranteed to be up-to-date, as the archive is authoritative source, not the bzr branches. Thus e.g. kubuntu folks maintain automated rebuilds outside of bzr branches & recipes. | 18:54 |
| dobey | import failures are pretty common too | 18:55 |
| Shock | dobey: I had planned to build against lp:ubuntu/trusty/systemd but I couldn't find the latest changes in there | 18:55 |
| xnox | Shock: instead they automate $ pull-lp-sources; wget -O /tmp/my.patch ....; quilt import /tmp/my.patch; debuild -S; dput ppa:.... | 18:55 |
| dobey | Shock: no, they should appear in trusty-updates and trusty-proposed, once imported | 18:55 |
| dobey | assuming a successful import | 18:55 |
| xnox | Shock: once trusty is released, it's release pocket is frozen. Thus lp:ubuntu/trusty/systemd will never update. | 18:55 |
| Shock | xnox: hmm, that would work. thanks | 18:55 |
| xnox | Shock: the pockets which are updated are trusty-updates, trusty-proposed and trusty-security, iff the import succeeds. | 18:56 |
| Shock | xnox: the latest udev release was in the trusty pocket | 18:56 |
| xnox | Shock: it's been attempted to fully automate merging builds, but it ultimately fails. Just because your patch still applies, doesn't mean that it will build, or if it builds, it doesn't mean it will be operating correctly. | 18:57 |
| Shock | I also looked at lp:ubuntu/trusty-proposed/systemd | 18:57 |
| xnox | Shock: branches are not up to date.... | 18:57 |
| xnox | $ rmadison -S systemd | grep source | 18:57 |
| xnox | systemd | 204-0ubuntu18 | saucy | source | 18:57 |
| xnox | systemd | 204-0ubuntu19.2 | saucy-updates | source | 18:57 |
| xnox | systemd | 204-5ubuntu20 | trusty | source | 18:57 |
| xnox | systemd | 204-5ubuntu20.3 | trusty-updates | source | 18:57 |
| xnox | systemd | 204-12ubuntu1 | utopic | source, amd64, arm64, armhf, i386, powerpc, ppc64el | 18:57 |
| Shock | it seems I'm misunderstanding something :( | 18:57 |
| xnox | $ bzr branch lp:ubuntu/trusty-proposed/systemd | 18:59 |
| xnox | Most recent Ubuntu Utopic version: 204-12ubuntu1 | 18:59 |
| xnox | Packaging branch version: 204-10ubuntu1 | 18:59 |
| xnox | Packaging branch status: OUT-OF-DATE | 18:59 |
| Shock | are the packages in trusty generated from lp:ubuntu/systemd? it seems not | 19:00 |
| xnox | Shock: Manual source builds are uploaded and published into the archive, once published binaries are build, after that importer walks the archive trying to create bzr branches lp:ubuntu/* if it manages to sucseed. | 19:00 |
| xnox | Shock: no, ubuntu is not build from bzr branches. | 19:00 |
| Shock | xnox: ok, that clears up a lot | 19:00 |
| xnox | Shock: pull-lp-source systemd trusty -> will fetch the latest trusty sources (including security, updates and proposed-updates) | 19:01 |
| xnox | Shock: if you want at most security -> specify trusty-security; for at most released updates -> specify trusty-updates | 19:01 |
| hallyn | infinity: hey, we're having the grooviest of times looking at the SRU for docker.io. Looking at rmadison output for golang-context-dev, the source pkg version is older than the package version... i'm confused. | 19:01 |
| hallyn | xnox: ^ or you probably know offhand what's going on :) | 19:02 |
| xnox | hallyn: looking. infinity is on hooligans. | 19:03 |
| xnox | * holidays | 19:03 |
| Shock | xnox: ok, that helps. There's no equivalent for "pull-lp-source systemd trusty" in a build recipe, correct? | 19:03 |
| xnox | Shock: no | 19:03 |
| hallyn | xnox: ah, thanks :) | 19:03 |
| xnox | Shock: not, inside launchpad that is. | 19:03 |
| xnox | hallyn: yeah, that looks very very odd. | 19:04 |
| xnox | hallyn: i'm guessying there was a partial / timed-out copy, and or partial delete/removal. | 19:04 |
| * hallyn quickly checks the others i'll be depending on, | 19:05 | |
| directhex | doko, pong | 19:05 |
| xnox | hallyn: which release are you enquiring about? utopic? | 19:05 |
| hallyn | xnox: golang-pty-dev too | 19:05 |
| directhex | doko, although i'm about to go to the supermarket | 19:05 |
| hallyn | xnox: yeah, utopic, we'll need those SRUd to trusty <cringe> | 19:06 |
| doko | directhex, could you upload a mono version using my pretty printers patch? | 19:06 |
| xnox | hallyn: golang-context-dev in utopic looks insane. ditto golang-pyt-dev | 19:06 |
| hallyn | xnox: AND golang-mus-dev too | 19:06 |
| hallyn | golang-mux-dev that is | 19:06 |
| directhex | doko, where is that patch? LP? | 19:07 |
| hallyn | xnox: so what, we grab the .dsc from lp and re-push with a 'b1' version extension? | 19:08 |
| doko | directhex, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752661 | 19:08 |
| ubottu | Debian bug 752661 in src:mono "make the -gdb.py file compatible with python3" [Normal,Open] | 19:08 |
| Shock | xnox, dobey: thanks | 19:08 |
| directhex | oh fuck me, i totally forgot about that one | 19:08 |
| hallyn | changelog "rebulid bc solar flares" ? | 19:08 |
| directhex | doko, yes, totally will do that later today | 19:08 |
| doko | directhex, I would appreciate it if you could do a trusty SRU too | 19:08 |
| xnox | cjohnston: wgrant: slangasek: looking at $ rmadison -S golang-context-dev -> and then inspecting launchpad looks crazy inconsistent. http://archive.ubuntu.com/ubuntu/pool/universe/g/golang-context/golang-context-dev_0.0~git20140522.1.1f3e8a4-2_all.deb is Available to download, yet launchpad has no idea about such a source version number, nor binary version number. | 19:09 |
| xnox | cjwatson: ^ | 19:09 |
| doko | cjohnston seems to be a problem ;-P | 19:09 |
| xnox | hallyn: it looks beyond my powers. I believe you need people with powers as above, sans s/cjohnston/cjwatson/ (thanks doko ;-PPPPP it's not like i didn't notice ;-) ) | 19:10 |
| jdstrand | mdeslaur, pitti (and tyhicks): https://code.launchpad.net/~ubuntu-core-dev/apparmor/master being out of date is just an oversight | 19:10 |
| xnox | doko: or e.g. do you have special launchpad powers? | 19:10 |
| jdstrand | mdeslaur, pitti (and tyhicks): lp:~apparmor-dev/apparmor/apparmor-ubuntu-citrain is an experiment | 19:10 |
| mdeslaur | jdstrand: oh, hrm, ok | 19:11 |
| jdstrand | mdeslaur: we talked about this before with your last upload | 19:11 |
| hallyn | xnox: thanks :) | 19:11 |
| mdeslaur | well, my memory of that talk was that we were switching to the other one :P | 19:11 |
| jdstrand | we don't have a resolution yet cause we haven't done enough experimenting yet | 19:11 |
| xnox | hallyn: so the source and binary are in the archive, as seen here http://archive.ubuntu.com/ubuntu/pool/universe/g/golang-context/ yet launchpad has no recollection of building of publishing that. | 19:12 |
| jdstrand | my resolution was you said that you wanted to always use https://code.launchpad.net/~ubuntu-core-dev/apparmor/master | 19:12 |
| Shock | xnox: would pull-lp-source, patch locally then bzr push to personal branch that has build recipe work? | 19:12 |
| hallyn | xnox: and same with the other two i assume? | 19:12 |
| jdstrand | s/resolution/recollection/ | 19:12 |
| mdeslaur | jdstrand: heh :) | 19:12 |
| hallyn | Shock: no, pull-lp-source won't grab it | 19:12 |
| mdeslaur | jdstrand: I'll update it, thanks | 19:12 |
| jdstrand | and that I said, "well, it isn't important enough to be distracted by it now, so let's wait" | 19:12 |
| hallyn | (which was why i suggested dget on the .dsc) | 19:12 |
| jdstrand | s/that/then/ | 19:12 |
| Shock | hallyn: pull-lp-source to get archive version of package | 19:13 |
| hallyn | Shock: it will grab the old version | 19:13 |
| jdstrand | mdeslaur: you had reservations about all the apparmor devs having commit access. I think that is a valid concern worth discussing | 19:13 |
| desrt | jdstrand: mdeslaur, hallyn: now that i have you all in one place: libvirt + qemu + apparmor was giving me quite some grief yesterday | 19:13 |
| mdeslaur | desrt: how so? | 19:14 |
| desrt | it seems that adding custom commandline arguments to a libvirt vm config is a really great way of triggering apparmor violations | 19:14 |
| xnox | Shock: it may. pull-lp-source gives you an unpacked debian source package. It's not a branch. You can e.g. bzr init; bzr commit; bzr push as you wish, etc. | 19:14 |
| jdstrand | yes, I would think it would be | 19:14 |
| desrt | which i responded to in the usual way: uninstall apparmor | 19:14 |
| * jdstrand shakes head | 19:14 | |
| mdeslaur | desrt: yes, if you customize configs, you need to customize the profile | 19:14 |
| desrt | but once you do this, libvirt can no longer start qemu instances at all | 19:14 |
| jdstrand | why not just update the profile? | 19:14 |
| desrt | because i don't know how | 19:15 |
| jdstrand | so, you should be able to uninstall apparmor and have it work, but you need to restart it | 19:15 |
| mdeslaur | desrt: so you're looking for a link to the documentation? :) | 19:15 |
| desrt | uninstalling apparmor shouldn't cause libvirt to stop working in any case... | 19:15 |
| hallyn | desrt: if libvirt thinks it should be able to confine the vm and now it can't, it'd be unsafe for it to do so | 19:16 |
| desrt | jdstrand: restart libvirt? i did try that.... didn't help. | 19:16 |
| hallyn | desrt: but here, #ubuntu-hardened ,and #ubuntu-servrer are good places to ask how to update the profile :) do you have DENIED messages in syslog? | 19:16 |
| xnox | hallyn: how do you know about those uploads and binaries? and where are they actually coming from? Since those version numbers do not exist in debian and are mysteriously published | 19:16 |
| xnox | hallyn: who/where/what uploaded them? | 19:16 |
| hallyn | xnox: i looked at the dpkg-checkbuilddeps for docker.io | 19:16 |
| desrt | hallyn: yes. finally figured out why my disk image which was owned by the right person (and set 666 out of desperation) was getting me "Permission denied" errors when i checked dmesg | 19:16 |
| hallyn | xnox: i have no idea. lemme try one thing, | 19:16 |
| jdstrand | you can also adjust /etc/libvirt/qemu.conf to have: security_driver = "none" | 19:17 |
| desrt | after an hour and a half of wasting my time... | 19:17 |
| desrt | jdstrand: great advice. thanks! | 19:17 |
| xnox | hallyn: scary they happened on 13th of June. I'm not supersticious but still. | 19:17 |
| hallyn | sacre bleu! | 19:17 |
| * desrt will try that tonight once home again | 19:17 | |
| hallyn | xnox: wow, i see. i figured 'full publishing history' on lp would show the 2014 version | 19:18 |
| hallyn | xnox: do you know who synced docker.io? | 19:19 |
| hallyn | i would bet that person at least knows who did golang-context-dev | 19:19 |
| jdstrand | desrt: I maintain adjusting the policy is the safest option. also, libvirtd should be able to run with apparmor uninstalled. I can't really debug what happened over the weekend, but uninstalling apparmor may have left the profile loaded in the kernel. if you uninstalled and rebooted and it didn't start, then there is a bug (it used to work) | 19:19 |
| desrt | fwiw, i think i discovered a big part of what makes me hate on apparmor so much, and it would not be too hard to fix it: | 19:19 |
| desrt | returning EACCES on apparmor errors is extremely user-unfriendly | 19:20 |
| jdstrand | it is EACCES and not EPERM? | 19:20 |
| desrt | some new ESECURITY with corresponding "access denied by security framework" or so would mean i don't spend so long pulling my hair out | 19:21 |
| desrt | may have been EPERM. | 19:21 |
| jdstrand | that isn't how the kernel LSM works aiui. perhaps jjohansen could comment | 19:21 |
| xnox | hallyn: no. actually everything is fine. | 19:22 |
| desrt | no... it was EACCES -- "Permission denied" (i remember the error message) | 19:22 |
| desrt | EPERM would have been "Operation not permitted" | 19:22 |
| hallyn | xnox: oh? | 19:22 |
| xnox | hallyn: golang-context-dev source package got renamed to golang-context in utopic | 19:22 |
| xnox | hallyn: rmadison -S golang-context | 19:22 |
| xnox | hallyn: rmadison -S golang-context-dev | 19:22 |
| xnox | hallyn: and read sanity from that =) | 19:22 |
| hallyn | oh for pete's sake | 19:23 |
| jjohansen | jdstrand, desrt: yep mostly we return EACCES that is there error the security frame work is supposed to use | 19:23 |
| hallyn | so same with the others i assume; checking | 19:23 |
| jjohansen | yes | 19:23 |
| xnox | hallyn: yes. | 19:23 |
| desrt | seems weird to mix "error that happens under normal circumstances" with "error that should only fire if something very very bad has happened" | 19:23 |
| mdeslaur | desrt: yeah, more info would be nice...Dan Walsh wanted to do that at some point: http://thread.gmane.org/gmane.comp.lib.glibc.alpha/28239 | 19:24 |
| * desrt assumes apparmor is in place here to mitigate (for example) the VM guest attacking one of the device drivers in qemu and breaking out of isolation | 19:24 | |
| xnox | cjwatson: wgrant: slangasek: never mind. hallyn and I got confused about golang-*-dev source packages renamed to golang-* whilst keeping all binary names same. | 19:24 |
| hallyn | xnox: and yet not for golang-gocapability-dev :) | 19:24 |
| xnox | hallyn: for SRU, you'd need to rename them back I believe. as in golang-mux SRU will be for golang-mux-dev, cause it's insane to rename source packages in stable releases =) | 19:25 |
| hallyn | xnox: thanks :) | 19:25 |
| * xnox goes out for dinner | 19:25 | |
| desrt | mdeslaur: big +1 on this email from me.... | 19:25 |
| hallyn | xnox: that's gonna hurt - but thanks | 19:25 |
| jdstrand | desrt: it is about protecting vms from each other and vms having various resources on the host. it doesn't do anything for hypervisor (which are in kernel) | 19:26 |
| desrt | his words about "lucky enough or skilled enough to know where to look..." is completely true.... (not to mention adding on "connects the dots and remembers....") | 19:26 |
| desrt | jdstrand: ya... but the various device drivers are implemented in the qemu binary... if you figured out a way to buffer-overflow one of those (for example) then you could run code as the qemu binary | 19:27 |
| desrt | and for example, open files on the host and pass their contents into the guest... | 19:27 |
| mdeslaur | yes, the qemu device drivers are an attack vector | 19:27 |
| jdstrand | desrt: the qemu binary is run under confinement. what you describe is one thing apparmor protects | 19:28 |
| desrt | i've noticed that libvirt goes out of its way to pass most things into qemu via file descriptors.... that's nice. | 19:30 |
| jdstrand | yeah | 19:30 |
| desrt | seems like a good usecase for seccomp :) | 19:32 |
| mdeslaur | yep | 19:32 |
| tyhicks | that has been something qemu upstream has wanted for quite a while | 19:34 |
| === alexisb_lunch is now known as alexisb | ||
| tyhicks | looks like they do utilize seccomp nowadays, but the syscall whitelist is pretty large | 19:36 |
| * desrt waits until capsicum is completely reimplemented | 19:37 | |
| hallyn | package versioning question :) from trusty to utopic, source package was renamed from golang-pty-dev to golang-pty. | 19:39 |
| hallyn | to sru that back to trusty, we need to change the source name back. what to call the version number? | 19:39 |
| hallyn | in utopic, it's now 0.0~git20140315.1.67e2db2-1 | 19:39 |
| hallyn | should we call it 0.0~git20140315.1.67e2db2-1ubuntu1.14.04.1 ? | 19:39 |
| mdeslaur | hopefully someone will fix LSM stacking before capsicum gets implemented | 19:40 |
| hallyn | mdeslaur: har har | 19:40 |
| mdeslaur | yeah, exactly :) | 19:40 |
| === salem_ is now known as _salem | ||
| === mwhudson_ is now known as mwhudson | ||
| slangasek | michagogo: yes, I did see that mail and it's in my queue to answer | 20:45 |
| michagogo | slangasek: Great, thanks. | 20:46 |
| michagogo | (I just want to avoid it stagnating again) | 20:46 |
| slangasek | xnox: so if we don't enable startpar, what happens to an init script that has a dependency on a script that shadows an upstart job? Are we force-starting the upstart job from the init script hooks, ignoring the upstart job's own dependency declarations? Or are we letting the dependent init script start without its dependencies guaranteed to be satisfied? Or are we assuming this case is negligible? | 20:47 |
| xnox | slangasek: it must source /lib/lsb/init-functions and if there is matching /etc/init/foo.conf and we are running under upstart it gets short-cirtuited in favor of upstart. | 20:49 |
| slangasek | what does "short circuited" mean in this context? pass-through, or no-op? | 20:50 |
| xnox | (this is not present in debian, where instead startpar & startpar-bridge is envofrced) | 20:50 |
| slangasek | because both have implications for reverse-dep init scripts | 20:50 |
| xnox | slangasek: if called as /etc/rc?.d/[KS]??* -> no-op. If called as /etc/init.d/$foo -> pass through. | 20:50 |
| xnox | slangasek: imho we should be removing init.d scripts where both systemd unit & upstart jobs exist. | 20:51 |
| slangasek | xnox: "we" being Ubuntu, I guess, since that's a non-starter for Debian? That implies more divergence where we would like less | 20:52 |
| xnox | slangasek: and all "key dependency" init.d scripts -> are either no-op upstart jobs on some arbitrary events (always satisfied before going into a particular runlevel) or symlinked to /dev/null on systemd side. | 20:52 |
| xnox | slangasek: yes, "we" being Ubuntu. | 20:52 |
| slangasek | well, what's a key dependency here? | 20:52 |
| xnox | slangasek: non-LSB defined dependencies currently used by debian scripts. "umountroot checkfs unmountfs" etc. | 20:53 |
| xnox | mountall | 20:54 |
| xnox | slangasek: does startpar enforce dependencies? apart from ordering based on dependencies? | 20:54 |
| slangasek | xnox: what I mean is, have you reviewed all such dependencies provided by packages that also ship an upstart job and confirmed that only ones in /etc/rcS.d matter? | 20:54 |
| directhex | doko, building, for sid. SRU will take longer | 20:55 |
| xnox | slangasek: i have not. But isn't my fastest path to systemd by default to (a) write systemd units for packages that have upstart jobs only (b) keep init.d scripts as they are, or if they need event ordering replace them by systemd units | 20:57 |
| xnox | thus all non-trivial init.d scripts, and upstart-only should get systemd treatment and job's done. | 20:58 |
| xnox | non-trivial init.d scripts are those that e.g. currently depend on upstart-tasks. | 20:58 |
| xnox | or are in rcS etc. | 20:59 |
| xnox | slangasek: we have insserv enabled today, without startpar. And that's enough for correct behaviour under systemd, and is correct enough under upstart with our lsb-initfunctions.d hook. | 21:00 |
| slangasek | xnox: fastest path> we definitely have to have the boot working correctly for our users under either of upstart or systemd for 14.10; it sounds like you're proposing to sacrifice correctness under upstart in order to speed up the transition | 21:01 |
| slangasek | I'm not convinced of the "correct enough" without seeing the data to back this up | 21:02 |
| xnox | slangasek: enabling startpar will regress boot under upstart for user in 14.10. I would like to avoid regressions under upstart (e.g. boot hangs for whatever reason, and didn't previously) | 21:03 |
| slangasek | xnox: my doubt is whether reintroducing the init scripts (which were previously stripped from Ubuntu packages) is enough on its own to regress boot for some overlapping set of users | 21:04 |
| xnox | introducing init.d scripts, as we have to this point, is also regressing boot under upstart. | 21:04 |
| xnox | true. | 21:04 |
| slangasek | yes | 21:04 |
| xnox | but we do want inserv support, given that there are packages in debian today that don't support non-inservv installation. | 21:05 |
| xnox | that's necessary. | 21:05 |
| slangasek | where insserv gives us the symlink ordering on disk, but does not do the dependency-based boot of init.d | 21:07 |
| xnox | so, if I do a diff of sid vs utopic: if an init.d script is missing in utopic, but present in sid, it must have both upstart+systemd jobs in utopic. | 21:07 |
| xnox | slangasek: well, insserv gives us on-disk correct ordering - same as we have to date with upstart, and it works well enough. (no regression) | 21:08 |
| slangasek | if we're not using startpar, and the initscript is a no-op at boot, I don't see any reason to remove the init script in Ubuntu | 21:08 |
| xnox | slangasek: and systemd parses lsb-headers itself and can do dependencies without startpar et.al. | 21:08 |
| xnox | slangasek: true. | 21:08 |
| xnox | slangasek: it's just we need to identify them correctly. | 21:09 |
| slangasek | identify them for what purpose? | 21:09 |
| xnox | for removal in ubuntu =) | 21:09 |
| xnox | we re-introduced a bunch of them by now. | 21:09 |
| xnox | *we have re-introduced a bunch of them by now. | 21:10 |
| slangasek | but removing them doesn't improve anything | 21:10 |
| slangasek | so we should just not remove them, in which case we also don't need to identify them | 21:10 |
| xnox | =)))) | 21:10 |
| slangasek | the one impact this *will* have is on boot speed under upstart | 21:11 |
| slangasek | which was part of what startpar was meant to address | 21:11 |
| slangasek | the fork+exec+source for each reinstated init script will be non-negligible | 21:11 |
| xnox | slangasek: true, boot speed will regress under upstart. And we will no longer have fair comparison against systemd to spot regressions. | 21:11 |
| xnox | slangasek: how do I make startpar bridge reliable for real? one suggestion, is to make upstart-startpar-bridge instances write out files in /run, which startpar can inspect to get complete cold-boot picture, in addition to interractive notifications. | 21:12 |
| xnox | (b) how to properly "pass" init.d scripts that bailed-out in pre-start | 21:13 |
| xnox | (c) how to properly "pass" init.d scripts for which upstart job got "manual"-ed | 21:13 |
| xnox | (a) above was, how to get correct state from before startpar is executed (i.e. catch tasks) | 21:14 |
| slangasek | xnox: "reliable for real"> so requiring all upstart jobs that map to existing init scripts be non-task non-instance jobs was insufficient to make it reliable? | 21:16 |
| slangasek | the /run trick wouldn't help for c) | 21:17 |
| xnox | slangasek: that resolves (a). It doesn't resolve (b) nor (c). And doesn't help to resolve (a) for sysadmin/3-rd party vendor installed system upstart job & init.d script (e.g. plex server) | 21:18 |
| xnox | i.e. making upstart jobs non-task/non-instance in distro, only resolves it in distro. | 21:18 |
| slangasek | xnox: plex server both has a task/instance upstart job, and reverse-dependencies of its init script? | 21:18 |
| slangasek | bearing in mind that otherwise, the failure scenario here should be "startpar never finishes", not "system hangs on boot" | 21:19 |
| xnox | slangasek: [and reverse-dependencies] is redundant. | 21:19 |
| slangasek | no | 21:19 |
| slangasek | because nothing else should care if startpar hangs waiting for a single job that will never finish | 21:19 |
| xnox | slangasek: starpar hangs on instance/tasks that are in TARGETS = without any reverse-depends. | 21:19 |
| slangasek | yes, but "startpar hangs" doesn't break the system, it just leaves an annoying startpar process running | 21:20 |
| === _salem is now known as salem_ | ||
| slangasek | unless this has changed? | 21:20 |
| xnox | hanging startpar => fail to reach runlevel 2 => fail to run tty1 => fail to start startpar for shutdown. | 21:20 |
| slangasek | no | 21:20 |
| slangasek | startpar is run twice, once for rcS and once for rc2 | 21:20 |
| xnox | that's what pitti and I have seen. | 21:20 |
| slangasek | we need startpar for rcS to be reliable, if it's used | 21:20 |
| slangasek | but there should be no third-party init scripts in rcS | 21:20 |
| xnox | ok. | 21:21 |
| slangasek | and for rc2, startpar is called *after* the runlevel event is emitted; and nothing else cares if startpar finishes | 21:21 |
| xnox | slangasek: i beg to differ. | 21:21 |
| slangasek | the 'rc' job will never finish, until another 'runlevel' event is sent | 21:21 |
| slangasek | xnox: for runlevel 2, the runlevel event is emitted by rc-sysinit; startpar is invoked from rc | 21:22 |
| xnox | slangasek: tty1.conf is start on stopped runlevel [2345], hanging rc runlevel 2 job, prevents tty1.conf from running. | 21:22 |
| xnox | sorry | 21:22 |
| xnox | tty1.conf is start on stopped *rc RUNLEVEL=[2345]* | 21:22 |
| slangasek | right, tty1 is a special case | 21:22 |
| slangasek | specifically because we want the prompt to wait until all our startup jobs have finished outputting | 21:22 |
| xnox | and not-starting tty1 imho is a critical regression. | 21:22 |
| slangasek | hmm, I don't agree | 21:23 |
| slangasek | anyone who cares about the prompt on tty1 should certainly also know how to switch VTs to log in on tty2 | 21:23 |
| slangasek | and everyone who doesn't care about the prompt on tty1 is looking at lightdm anyway, which has no such dependency | 21:23 |
| xnox | clouds don't know how to switch ttys =) | 21:23 |
| xnox | you just broke cloud-init | 21:23 |
| slangasek | the cloud's console isn't on tty1 either, is it? | 21:24 |
| xnox | some of them are | 21:24 |
| xnox | I have used crappy clouds though =) | 21:24 |
| slangasek | hmm | 21:24 |
| * xnox being Latvian and all that shady torrent-boxes of mine | 21:24 | |
| slangasek | I know there was talk about supporting consoles in the cloud images, but I thought they were serial console | 21:24 |
| slangasek | smoser: ^^ can you set me straight here? | 21:25 |
| utlemming | slangasek: it depends on the cloud. There are clouds with all sorts of console. OpenStack clouds tend to offer consoles. | 21:25 |
| slangasek | utlemming: a console in the form of tty1 with no VT switching? | 21:26 |
| xnox | slangasek: easier than that. "cloud-final is start on (stopped rc RUNLEVEL=[2345] and stopped cloud-config) | 21:26 |
| xnox | " | 21:26 |
| slangasek | man | 21:26 |
| xnox | slangasek: thus without a complete rc, we don't have complete cloud-init, thus all instances stuck in initialising states. | 21:26 |
| utlemming | slangasek: yeah, you don't get a VT to switch between | 21:26 |
| xnox | slangasek: which kind of brings us to another point. How do I see us supporting systemd for cloud images? Install systemd & reboot? publish a (limited) image flavour which boots with systemd? | 21:28 |
| xnox | slangasek: hanging rc, means hanging startpar, and two startpars don't like to run in-parallel to each other. Which is what pitti found out, but i didn't reproduce/investigate yet. | 21:28 |
| slangasek | xnox: so that brings us back to /run; that addresses your a), but doesn't seem to address either b) or c). But the alternative to making startpar reliable is just to not enable it at all | 21:29 |
| slangasek | "don't like to run in parallel" - doesn't the previous one die when the rc job dies on 'stop on runlevel [!$RUNLEVEL]'? | 21:29 |
| xnox | slangasek: it should. Hence I say, didn't investigate yet. | 21:30 |
| slangasek | ok | 21:30 |
| xnox | slangasek: would you agree, that things that have no reverse depends in .depends.* files, and are listed in TARGETS, should be simply skipped without any notifications from starting, if they happen to have an equivalent upstart job? | 21:31 |
| smoser | xnox, for 15.04, or whenver we fully cut over | 21:31 |
| smoser | it will just be /sbin/init and work as expected | 21:31 |
| smoser | prior to that, my goal was to create a cloud-config syntax that cloud-init would see | 21:31 |
| xnox | smoser: ok. and before that, we test/develop it however we need/like/can. | 21:31 |
| smoser | and then would change the init system of the image and reboot | 21:32 |
| xnox | smoser: ack. | 21:32 |
| smoser | thats why I asked about dpkg-divert | 21:32 |
| xnox | smoser: i'm sure slangasek would cringe over dpkg-diverting /sbin/init =))) | 21:32 |
| smoser | it is orders of magnitude easier if i can switch the init system by simply replacing /sbin/init | 21:32 |
| slangasek | wut | 21:33 |
| slangasek | you do not need to dpkg-divert anything. You install systemd-sysv and remove upstart. | 21:33 |
| slangasek | if you need to tinker locally prior to that, you can either pass init=/lib/systemd/systemd on the kernel commandline, or you can dpkg-divert *locally*; but please don't distribute images that use dpkg-divert | 21:34 |
| smoser | it would be locally. | 21:34 |
| smoser | we're not distributing different images. | 21:34 |
| slangasek | ok | 21:35 |
| smoser | i'm fairly adverse to that. | 21:35 |
| slangasek | then that's fine, feel free to trash your local filesystem any which way ;) | 21:35 |
| xnox | slangasek: $ apt-cache show systemd-sysv | 21:35 |
| xnox | NikTh: Can't select versions from package 'systemd-sysv' as it is purely virtual | 21:35 |
| xnox | hm...? | 21:35 |
| smoser | what i was saying was that you create an lxc cloud iamge container or cloud image via kvm | 21:35 |
| smoser | by passing cloud-config like: | 21:35 |
| smoser | http://paste.ubuntu.com/7762188/ | 21:35 |
| xnox | NikTh: unping -> stupid xchat expanding "N:" in the paste. | 21:35 |
| smoser | the init system that is already present (upstart) would run to the point where cloud-init got that data. | 21:36 |
| NikTh | haha, no worries xnox :) | 21:36 |
| smoser | cloud-init would replace init (however that is supposed to happen) and reboot | 21:36 |
| slangasek | xnox: yes, until that package is introduced in Ubuntu, nobody should be building any images defaulting to systemd ;) | 21:36 |
| smoser | and replacing init via: | 21:36 |
| smoser | dpkg --divert ... i dont remember syntax /sbin/init /lib/system/systemd | 21:36 |
| smoser | is much easier than | 21:36 |
| smoser | sed /etc/grub/ && update-grub | 21:37 |
| slangasek | smoser: maybe you just want 'cp -a /lib/systemd/systemd /sbin/init' | 21:37 |
| smoser | (which wouldn't work on lxc anyway) | 21:37 |
| smoser | i'm not opposed to that. | 21:37 |
| slangasek | since, ah, you would need to do that part *anyway* in addition to the dpkg-divert | 21:37 |
| slangasek | (all the dpkg-divert does is let the change persist across upgrades of the upstart package) | 21:37 |
| xnox | slangasek: what do you think about https://code.launchpad.net/~xnox/ubuntu-seeds/platform-init/+merge/225850 ? cause currently systemd is not available everywhere. | 21:38 |
| slangasek | xnox: why does it need to be available everywhere? People can apt-get install it for experimentation, and the thing we ultimately want seeded is systemd-sysv in place of upstart | 21:39 |
| xnox | slangasek: ok. | 21:39 |
| xnox | slangasek: can we go ahead and merge new sysvinit with split startpar, at this current state of affairs? | 21:40 |
| xnox | slangasek: (aka pitti's prepared merge of doom) | 21:40 |
| slangasek | xnox: hum. I had asked to review that merge before it was uploaded, and I haven't seen an MP or anything for this yet? | 21:42 |
| xnox | slangasek: it has not been uploaded. I thought there is an MP for it. Let me check. | 21:43 |
| xnox | slangasek: thought it would be in https://launchpad.net/~pitti/+archive/systemd, but it isn't. | 21:44 |
| smoser | slangasek, why would i need that part too ? | 21:44 |
| xnox | slangasek: will poke pitti tomorrow. | 21:44 |
| slangasek | xnox: yes please :) | 21:44 |
| smoser | oh. i see. yeah, i was going to just link it. | 21:44 |
| slangasek | smoser: yeah, you would need cp or ln, the dpkg-divert is only relevant for the upgrades and is probably not worth futzing with here :) | 21:45 |
| slangasek | xnox: there's a lot of history in the terribleness of the Debian sysvinit package, it's really best if I review this before it gets uploaded | 21:45 |
| * xnox goes for a cup of tea and biscuits. | 21:51 | |
| jtaylor | doko: you merged blt to utopic will you also take care of its now broken rdepends? | 22:42 |
| === salem_ is now known as _salem | ||
| slangasek | mterry: I'm puzzled by your response on ubuntu-phone | 23:32 |
| mterry | slangasek, oh how? | 23:32 |
| slangasek | mterry: specifically: why should the lock screen behavior be tied to whether the user account has a password set? | 23:32 |
| mterry | slangasek, why wouldn't it be? Would you use nopasswdlogin group membership to determing swiping of lock screen, or would you use an out-of-PAM method of storing the lock screen passphrase? | 23:34 |
| slangasek | mterry: the choice of authentication method is a separate thing from whether the user has a password | 23:35 |
| slangasek | mterry: as in my example, I want to require a password for risky things like getting root privs over adb, but that doesn't mean I want to be typing a password on an OSK every time I unlock my phone | 23:35 |
| mterry | slangasek, design doesn't want to have a user set 'just swipe to unlock' and then also have to remember a password | 23:35 |
| slangasek | why does this hypothetical user have to remember a password at all? | 23:36 |
| mterry | At least that's how mpt designed it | 23:36 |
| mterry | slangasek, well who is setting the root privs password then? | 23:36 |
| slangasek | erm | 23:37 |
| slangasek | the user | 23:37 |
| slangasek | I understood that you wouldn't have sudo *unless* you set a password | 23:37 |
| mterry | slangasek, so he does have to remember a password | 23:37 |
| slangasek | only the user who wants to allow sudo access over adb! | 23:37 |
| sarnold | .. or the local Terminal app, right? | 23:37 |
| mterry | sarnold, right | 23:38 |
| slangasek | ok, and? | 23:38 |
| slangasek | a normal user doesn't need root privs at all | 23:38 |
| slangasek | this is a developer-only feature | 23:38 |
| mterry | slangasek, so you want to set a password in the UI. Then also say only swipe? And have it remember the password you entered before? | 23:39 |
| mterry | The UI doesn't allow that, which is by design | 23:39 |
| slangasek | if I don't set a password, what happens when I type 'sudo -s'? | 23:39 |
| slangasek | if I do set a password, what happens when I lock my phone and then want to unlock it? | 23:40 |
| slangasek | if the answer is that I have to type a password on the OSK each time, there's some table-flippin' on the horizon | 23:40 |
| mterry | slangasek, if you don't set a password, sudo only authenticates you if your tty is listed in /etc/securetty | 23:40 |
| slangasek | and which ttys are we listing there? | 23:40 |
| mterry | slangasek, if you do set a password, you enter your password on the OSK | 23:40 |
| mterry | slangasek, Touch doesn't customize it. But nothing with pts/* is in it (i.e. nothing remote, nothing in X/Mir) | 23:41 |
| slangasek | and the security team was happy with this design? | 23:41 |
| mterry | This is long-standing behavior | 23:41 |
| slangasek | the long-standing behavior is broken, we're supposed to be making adb secure :) | 23:42 |
| slangasek | but it also needs to remain usable | 23:42 |
| mterry | those two are always at odds :) | 23:42 |
| slangasek | no, they aren't | 23:42 |
| sarnold | slangasek: working with mterry on a reasonable sudo strategy in the face of no pin is on my todo for this week :) | 23:43 |
| slangasek | design may have said to do it this way, but I don't understand why the security team would have signed off on a design that gives people a false dichotomy between "always type a password everywhere" and "no sudo for you" | 23:43 |
| slangasek | sarnold: ok | 23:43 |
| sarnold | I don't immediately see any problems with allowing a blank passwd at sudo if that was configured for login, too | 23:43 |
| sarnold | it could be that the securetty PAM module we're using needs to be extended or replaced to allow local logins via Mir-originated applications, or something similar | 23:44 |
| sarnold | slangasek: what's the goal with "make adb secure"? | 23:45 |
| slangasek | I'm not sure "let Mir apps get in without a password" is an interesting security model | 23:46 |
| slangasek | sarnold: AIUI the goal is to not let a rogue USB host adb in and screw around with things without the user's awareness - which I think implies: "non-root by default", "no adb when screen is locked", "adb disabled by default" | 23:47 |
| mterry | slangasek, do you envision an exception for terminal-app or just not allowing sudo in Terminal? | 23:47 |
| mterry | But you do want to make an exception for adb | 23:47 |
| slangasek | sarnold: however, I'm not driving this - I thought this was all mdeslaur's design, which is why my question on the list was addressed to him :) | 23:47 |
| slangasek | mterry: I think we're talking past each other here | 23:48 |
| slangasek | mterry: passwordless sudo is uninteresting to me as a dogfooding developer; I prefer that root access come with a password prompt | 23:48 |
| slangasek | mterry: but I do not want "require password for root access" to translate to "require password to unlock my phone" | 23:48 |
| slangasek | because I expect the security requirements for a password that gives you root access to dramatically differ from the security requirements for an unlock "password" that I will use on a routine basis | 23:50 |
| slangasek | (PIN vs. password) | 23:50 |
| mterry | slangasek, my apologies, right. Well for that, I can only say that the last time I spoke to mpt about it, he didn't want a separate password beyond the one set in the UI for locking the screen | 23:52 |
| === Ursinha is now known as Ursinha-afk | ||
| slangasek | ok, so who's the security team's stakeholder for this design :-) | 23:52 |
| slangasek | I'll route through them | 23:52 |
| sarnold | slangasek: probably mdeslaur would be best. I had hoped to handle this one myself but I'm obviously missing too much context to provide reasonable answers :) | 23:53 |
| slangasek | ok :) | 23:54 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!