=== nacc_ is now known as nacc === Guest86060 is now known as Laney === tinwood_ is now known as tinwood === inetpro_ is now known as inetpro === Kilos is now known as sal === sal is now known as Kilos === pleia2_ is now known as pleia2 === pavlushka_ is now known as pavlushka === nacc_ is now known as nacc === Kilos- is now known as Kilos [16:37] hello [16:37] hi [16:37] #startmeeting [16:37] Meeting started Mon Nov 6 16:37:27 2017 UTC. The chair is tyhicks. Information about MeetBot at http://wiki.ubuntu.com/meetingology. [16:37] Available commands: action commands idea info link nick [16:37] The meeting agenda can be found at: [16:37] [LINK] https://wiki.ubuntu.com/SecurityTeam/Meeting [16:37] [TOPIC] Announcements === meetingology changed the topic of #ubuntu-meeting to: Announcements [16:37] Lucas Kocia (lkocia) provided a debdiff for xenial for firewalld (LP: #1617617) [16:37] Launchpad bug 1617617 in firewalld (Ubuntu Xenial) "Firewall configuration can be modified by any logged in user" [Low,Fix released] https://launchpad.net/bugs/1617617 [16:37] Jeremy Bicha (jbicha) provided a debdiff for zesty for gdm3 (LP: #1729354) [16:37] Launchpad bug 1729354 in gdm3 (Ubuntu) "17.04: GDM lock screen can be circumvented when autologin is set" [High,Fix released] https://launchpad.net/bugs/1729354 [16:37] Thank you for your assistance in keeping Ubuntu users secure! :) [16:37] [TOPIC] Weekly stand-up report === meetingology changed the topic of #ubuntu-meeting to: Weekly stand-up report [16:37] jdstrand: you're up [16:38] \o [16:38] o/ [16:38] hello [16:38] Last week I focused primarily on the customer regression related to the expanded udev tagging work that landed in 2.28. This week I plan: [16:38] * finish up some new spread tests based for better high-level coverage of security backcends [16:38] * investigate the udev_enumerate regression ondra reported [16:38] * investigate the broadcom-asic-control interfacec bug [16:38] * snapd PR reviews [16:38] * continue uid/gid work for snap privilege dropping [16:38] s/based// [16:39] that's it from me. mdeslaur, you're up [16:39] I'm on bug triage this week [16:39] I'm currently testing openssl updates. chrisccoulson managed to figure out the regression on armhf caused by the newer gcc on artful+ with some pretty impressive debugging work [16:40] and I have a big imagemagick update to look at [16:40] that's pretty much it for me, sbeattie? [16:41] chrisccoulson: thanks for helping out with that openssl build failure [16:41] chrisccoulson: that was quite impressive work [16:41] no worries :) [16:41] I'll go and maybe Steve will be around later [16:42] I've got a couple more eCryptfs kernel patches to review and also need to prepare for the 4.15 merge window (only bug fixes to go up) [16:42] oh, I'm in the happy place this week [16:43] I have an embargoed issue [16:43] and then I'll start work on squashfs reproduceability [16:43] I got sidetracked last week as we were finalizing the apparmor move to gitlab and figuring out the new processes [16:43] that's it for me [16:43] chrisccoulson: btw, that was a pretty awesome debug :) [16:44] jjohansen isn't around [16:44] sarnold: you're up [16:44] re squashfs reproducability> \o/ [16:45] * tyhicks pokes sarnold again [16:45] I'm in the happy place this week; I'll be doing apparmor patch reviews as I can, and embargoed work [16:45] * mdeslaur hands tyhicks the memset magic wand [16:46] I think that should be it for me this week, chrisccoulson? [16:46] I've got a firefox update to prepare, although the update isn't until next week. It's a big one though, so I wouldn't mind people installing it [16:47] chrisccoulson: let us know when we can start using it [16:48] Then there's rust 1.21. There's still 2 builds that don't complete successfully, but the failures are completely random. I'm not too sure what to do with these yet, but I want to avoid losing another week to this [16:48] (I've just hit retry on one again actually whilst there's not a backlog of builds) [16:49] did we switch to using rust's llvm fork? [16:49] And then hopefully I will actually get time to start working on other things [16:49] sarnold, I've done that already. The only architecture it's caused a problem on is s390x (doesn't build there at all) [16:49] I think that's me done [16:49] argh :/ I was hoping for better than that :( [16:50] I'm hoping this works out better. The last rust update required around 6 patches backporting to llvm. This one intentionally broke a feature entirely with the system llvm. And the next release will require a whole new llvm version [16:51] I can't remember who's next. ratliff? [16:51] I'm in the happy place this week [16:51] I have another article to write [16:52] More work on kpis [16:52] on to you leosilva [16:52] I'm community this week [16:52] I just push an update early [16:52] I'll try to work on vim update (but I'm skeptical about if the patch fix the issue) [16:52] other than that I'll follow with the normal hunting. [16:53] that's all for me... tyhicks it's back to you [16:53] I can go. [16:53] I'm on cve triage this week [16:53] I have an openjdk-8 update to publish today [16:54] I have some kernel triage stuff to catch up on [16:54] I'll be looking at identifying needed snap updates [16:54] And I have some background tasks to work on post the apparmor move to gitlab. [16:54] That'll likely consume my week. [16:55] tyhicks: back to you. [16:55] thanks! [16:55] [TOPIC] Highlighted packages === meetingology changed the topic of #ubuntu-meeting to: Highlighted packages [16:55] The Ubuntu Security team will highlight some community-supported packages that might be good candidates for updating and or triaging. If you would like to help Ubuntu and not sure where to start, this is a great way to do so. [16:55] See https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures for details and if you have any questions, feel free to ask in #ubuntu-security. To find out other ways of helping out, please see https://wiki.ubuntu.com/SecurityTeam/GettingInvolved. [16:55] https://people.canonical.com/~ubuntu-security/cve/pkg/udfclient.html [16:55] https://people.canonical.com/~ubuntu-security/cve/pkg/pidgin.html [16:55] https://people.canonical.com/~ubuntu-security/cve/pkg/firebird2.5.html [16:55] https://people.canonical.com/~ubuntu-security/cve/pkg/tcptrack.html [16:55] https://people.canonical.com/~ubuntu-security/cve/pkg/git-annex.html [16:55] [TOPIC] Miscellaneous and Questions === meetingology changed the topic of #ubuntu-meeting to: Miscellaneous and Questions [16:55] Does anyone have any other questions or items to discuss? [17:00] jdstrand, mdeslaur, sbeattie, jjohansen, sarnold, ChrisCoulson, ratliff, leosilva: Thanks! [17:00] #endmeeting === meetingology changed the topic of #ubuntu-meeting to: Ubuntu Meeting Grounds: Please leave swords by the door | Calendar/Scheduled meetings: http://fridge.ubuntu.com/calendars | Logs: https://wiki.ubuntu.com/MeetingLogs | Meetingology documentation: https://wiki.ubuntu.com/meetingology [17:00] Meeting ended Mon Nov 6 17:00:10 2017 UTC. [17:00] Minutes: http://ubottu.com/meetingology/logs/ubuntu-meeting/2017/ubuntu-meeting.2017-11-06-16.37.moin.txt [17:00] thanks, tyhicks [17:00] thanks tyhicks! [17:00] tks tyhicks ! [17:01] tyhicks: thanks! [17:02] thanks tyhicks :) [17:04] thanks tyhicks! [18:59] o/ [18:59] o/ [19:02] hi [19:03] We don't have much on the agenda, but I'd like to use the occasion to discuss Balint's case and the Budgie packageset [19:11] But I guess we don't have quorum today anyway [19:12] jbicha, bdmurray: should we continue to handle Balint's application through e-mail? [19:13] I think the relevant context is there so that or wrap the existing thread [19:13] I think the problem is rbalint might not have a strong enough application for core dev right now [19:14] I think he would have a stronger motu application so maybe we should encourage him to switch to that? [19:15] Isn't he also a DD and could get PPU rights for those packages? [19:16] yes, that's part of why his motu application would be stronger, in my opinion [19:19] Well, regardless I think he deserves a response regarding his application as it stands [19:20] I can follow up to ask him if he wants to apply for motu instead, is that ok? [19:21] I think it's better if we first have a vote formally made [19:21] Since recommending motu before actually knowing if the board is willing to approve of his application would be a bit rude [19:22] Right we are making an asasumption it wouldn't pass [19:22] If it fails I'd say we then recommend him MOTU [19:22] fair enough [19:22] I already talked with him and he said he'd be fine, although of course core-dev is his aim [19:25] Lets try to bring it to a vote then [19:27] bdmurray: we have quorum now, right? so we do we want to start the vote here and continue on the list if we need more votes? [19:28] I think there are only three of us here [19:28] I'm here as well [19:30] Unless the vote is unamious we'd have to go to the list and I don't think that's likely. [19:30] would it speed up the list voting to have people vote here now? [19:32] I think I'd need to reread the correspondence to vote [19:32] so would prefer to do it on the list [19:33] It look like Robie owes Balint a reply too regarding his expectations. [19:33] fwiw, rbalint did raise a question that he didn't know what was expected of him on his application. That's a fair question that merits a clarification, as it seems we haven't always held people to the same standards [19:33] yes, that ^ [19:34] Okay, I think enough of us are in agreement that we should look at the email thread again and continue the conversation / start voting if you are ready. [19:36] +1 [19:37] We're really bad at e-mail application handling, would be nice if everyone could take a look at it in the nearest 24 hours [19:38] that kind of has to do with going to email threads quickly; that goes as an extension to the IRC that doesn't tend to end [19:42] sil2100: Did you want to talk about something else or are we good for the not meeting. [19:43] I guess we're good, we can discuss the Budgie thing next time, no urgency [19:43] Since fossfreedom now has the powers he needs [19:43] Okay, I'm gonna make some coffee [19:43] who's going to be responsible for looking at what a Budgie packageset would look like? [19:45] probably depends what's in the seed, but I think he'd have to apply for a flavor packageset as that's not what was voted on [19:46] we've done similar things for ubuntustudio in the past where PPU was sought for core packages for the flavor, but not the full flavor packageset [19:47] setting up the flavor seed is trivial, I can get the output for that it would be [19:47] well my impression was he did originally apply for a flavor packageset but let's see what the diff would be first [19:48] jbicha: there are two different things [19:49] jbicha: fossfree.dom applied to be able to upload stuff for budgie, he was deemed not ready for having upload rights for a flavor seed, so we sugested PPU for some packages [19:49] (based on a list he already had) [19:49] I think the biggest part of him "not being ready" was that we didn't create the flavor packageset [19:49] having a flavour packageset is something that needs to happen anyway, since eventually there should be some dev who uploads to budgie in general [19:50] jbicha: no [19:50] I'm just particularly frustrated about fossfreedom's case, it's part of why I applied to DMB actually [19:50] creating the packageset is a job of two minutes, it's not blocking much by any means [19:50] I don't like how much time we've spent of his asking him to come back and how much time we've kept him waiting for upload rights [19:51] the question is "Given flavour X's packageset, is the applicant ready to upload to any of the N packages in there" [19:51] anyway, please provide us the output of the packageset so that we can actually decide if there's a big enough difference there to ask him to come back [19:51] neither am I, but creating packagesets is a question orthogonal to whether someone is ready to have that ACL added. [19:51] and whether that difference is big enough for him to want to [19:52] we have a few flavors with no flavor packageset uploaders [19:53] you can look at the ubuntu-mate seed already, it will be a reasonable approximation of what you might find on the budgie packageset. [19:53] (but I'll have packageset-report spit out the result, it just takes a while) [19:54] would it be fine to post that to the list and we can discuss the specifics next meeting? [19:54] micahg: sure, but there's no cost to having the packageset created, and we then know what it entails if someone asks "I want to upload for $cUbuntu [19:54] cyphermox: I'm all for having it ready for people to apply for, just not to grant it willy nilly to people [19:54] micahg: there wasn't a question of that [19:55] we're in full agreement [19:55] we are :) [19:55] (sorry to repeat myself), but that is what fossfreedom asked for and we told him no without having a formal vote and without even having the specifics of what it was we were deciding on [19:55] jbicha: did you read the thread? because that's not /quite/ what happened as I recall. [19:56] that's what's on the wiki, but not what happened in the meeting as I recall [19:56] I followed the thread actively at the time, I even attended DMB meetings to urge you to take action since his application was delayed for too long [19:56] I think it's a semantic question [19:56] *question of semantics [19:56] he asked for specific packages [19:56] jbicha: there are a couple of things at play: there's not much use in creating the packageset if there's nobody to add to it, but there's also no cost in having the set exist. [19:57] jbicha: the content of a packageset is not quite so much the key to whether someone is ready to upload $flavour [19:57] I was one who was quite happy to have the packageset generated anyway [20:04] cyphermox: https://lists.ubuntu.com/archives/devel-permissions/2017-April/001084.html [20:04] he is clearly asking for packageset rights and we apparently have clearly told him no, largely based on the packageset not existing [20:05] he asked for specific packages as a packageset, not flavor packageset [20:05] that's not what that email says? [20:05] > Please can a packageset be officially defined for Ubuntu Budgie? [20:06] https://lists.ubuntu.com/archives/technical-board/2017-March/002295.html [20:06] > I recently requested package-set maintainership for our (Ubuntu Budgie) packages via the DMB. [20:06] jbicha: yes, as I mentioned earlier: deferred because there is no reason to create it now when there is nobody who has access to it === fginther` is now known as fginther [20:07] that's a chicken-and-egg game that was unfair to fossfreedom [20:07] no [20:07] http://people.canonical.com/~ubuntu-archive/packagesets/artful/personal-fossfreedom exists [20:07] packageset != flavor packageset. [20:08] we're going around in circles here and I don't want to extend this meeting [20:08] there is no question that upload rights were fine for the packages in that list, otherwise they would not be. [20:08] is anyone waiting for the room? [20:08] but please send us the packageset you generate and we can discuss what to do next instead of what went wrong [20:09] what needs to happen next is the same as usually happens when someone is not approved for upload rights: reapply. [20:09] (or well, extend a voting thread by email indefinitely, whatever) === JanC is now known as Guest24940 === JanC_ is now known as JanC