/srv/irclogs.ubuntu.com/2021/07/13/#ubuntu-meeting.txt

bittinhey14:00
bittincpaelzer: SRU/MRU meeting?14:29
cpaelzeryep14:29
cpaelzerhi bittin14:29
bittinhey cpaelzer14:29
cpaelzer#startmeeting Weekly Main Inclusion Requests status14:29
meetingologyMeeting started at 14:29:46 UTC.  The chair is cpaelzer.  Information about MeetBot at https://wiki.ubuntu.com/meetingology14:29
meetingologyAvailable commands: action, commands, idea, info, link, nick14:29
cpaelzerping sarnold jamespage ddstreet doko didrocks999 - MIR team meeting14:30
ddstreeto/14:30
didrocks999hey14:30
=== didrocks999 is now known as didrocks
sarnoldgood morning14:31
cpaelzerhello everyone, no previous action items so let us start with14:31
cpaelzer#topic current component mismatches14:31
cpaelzer#link https://people.canonical.com/~ubuntu-archive/component-mismatches-proposed.svg14:31
cpaelzer#link https://people.canonical.com/~ubuntu-archive/component-mismatches.svg14:31
cpaelzera lot of usual suspects (false positives and dormant seeds)14:31
cpaelzerwhat seems new to me is gnome-shell -> gtk4 -> fonts-cantarell14:31
cpaelzerdidrocks:  that sounds liek you might know something about it14:32
cpaelzerhi doko14:32
cpaelzerjust started component mismatches, gnome-shell ->... fonts-cantarell is the only new one14:32
dokoo/14:33
cpaelzerdidrocks: ? ^^14:33
didrockscpaelzer: I’ve already dealt with gtk4, doing the review, fonts-cantarell is only if we promote the -examples, which we won’t14:33
sarnoldwoot14:33
cpaelzerso you'll adda an extra exclude or something and this ill vanish?14:33
cpaelzerwill14:33
didrockscpaelzer: I think it’s because the source is not promoted yet, but I’ll do it and look back14:34
cpaelzerwell, ok14:34
cpaelzerthanks didrocks14:34
cpaelzerthe important bit here is that it is under control and needs no action :-)14:34
cpaelzer#topic New MIRs14:34
didrocksyep:)14:34
cpaelzer#link https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&assignee_option=none&field.assignee=&field.subscriber=ubuntu-mir14:34
cpaelzerempty \o/14:34
cpaelzer#topic Incomplete bugs / questions14:35
didrockshourra!14:35
cpaelzer#link https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&field.subscriber=ubuntu-mir14:35
cpaelzerfuse we mentioned last week - that now is a MIR project of foundations btw14:35
cpaelzerbugs against many packages that still have fuse2 are filed14:35
cpaelzeronce all are ready we will transition, but that might take a while14:35
cpaelzerafaik ginggs seems to lead that effort14:36
cpaelzernothing totally new in incomplete that we would not be aware of14:36
cpaelzerjamespage: I still consider the cherryp3 incomplete case on you btw14:36
cpaelzer#topic Any other business?14:36
sarnoldyeah..14:36
cpaelzerI wanted to ask everyone for their respective teams - are there more things coming for 21.10 MIRs?14:37
cpaelzerwe know we ahve a few blocked on the evey too busy security team14:37
cpaelzerbut further ones that will come into the MIR queue - are there more expected/planned ?14:37
sarnoldthere's a v4l2loopback package that a commercial support group in canonical is looking to support in focal, hirsute, impish, and forward14:37
didrocksthere is adsys coming (hopefully next week)14:37
cpaelzerours (server) are already open MIRs (on security atm)14:38
bittinthe security team is having a sprint next week i did hear in the latest https://ubuntusecuritypodcast.org/14:38
didrockswhich will probably need a security review (and it’s a go package, with vendored deps)14:38
sarnoldbittin: probably a company-wide roadmap review sprint14:38
bittinsarnold: might be14:38
dokowell, yes, my impression was that ginggs wanted some input from the package owners ...14:38
sarnoldthe nice folks working on v4l2loopback haven't done the 'usual mir' process; they've so far been doing everything via email14:39
cpaelzerdoko: on the few that I saw I was dealing with the cases14:39
dokook, is desktop doing the same?14:39
cpaelzerdoko: but surely there are more that I've not seen14:39
cpaelzersarnold: what does that mean - did they send a mail directly to -security ?14:39
sarnoldhas anyone else been doing similar work on the v4l2loopback package 'out of usual channels'?14:39
sarnoldcpaelzer: yes14:39
dokoe.g. https://bugs.launchpad.net/ubuntu/+source/xdg-desktop-portal/+bug/193566814:40
ubottuLaunchpad bug 1935668 in xdg-desktop-portal (Ubuntu) "Please switch to fuse3" [Undecided, New]14:40
cpaelzerno I didn't see/get and v4l2loopback info14:40
cpaelzerthanks for the info on adsys didrocks14:40
cpaelzerdidrocks: that xdg / fuse question is for you I guess14:40
sarnoldcpaelzer: I know we've got a flood of packages with names I can't remember all doing some supported things without much input / involvement from us, and I was curious where / how those sorts of exceptions from usual process are documented, and if I need to be asking this team to move to a public MIR bug14:41
didrocksyeah, but I don’t know as I’m not doing GNOME work for some years now, I can be the man in the middle ofc and ask14:41
cpaelzersarnold: I'd answer to those mails pushing them to the official process - or do they have a good reason to go "secretly"14:41
cpaelzerthanks didrocks14:41
sarnoldcpaelzer: good question14:41
cpaelzersarnold: if the intended use case is NOT promotion in the acrhive they might "only ask you"14:42
didrocksbut right now, just reading the message looks like we should hold it: https://bugs.launchpad.net/ubuntu/+source/xdg-desktop-portal/+bug/1935668/comments/214:42
ubottuLaunchpad bug 1935668 in xdg-desktop-portal (Ubuntu) "Please switch to fuse3" [Undecided, New]14:42
cpaelzerand skip the normal MIR process14:42
didrocksunsure if this is what doko is referring to as giving the bug # here14:42
cpaelzerdidrocks: yeah it is about assessing the situation to be "ready to move"14:42
cpaelzerdidrocks: not about uploading a change now14:42
didrocksack14:43
dokoright, we don't want to have two versions of fuse in main, therefore coordinating the switch ...14:43
sarnoldcpaelzer: okay, cool, I can work with this; I'll re-read the emails and see if it's actual promotion in the archive or if it's something else that they're after, and ask them to use the public process if it's archive promotion. thanks :)14:43
cpaelzergreat sarnold14:43
cpaelzerI guess "that is it" for today then14:44
cpaelzerthanks for the sync @everony14:44
cpaelzersee you all next week14:45
bittincyas14:45
cpaelzer#endmeeting14:45
meetingologyMeeting ended at 14:45:14 UTC.  Minutes at https://new.ubottu.com/meetingology/logs/ubuntu-meeting/2021/ubuntu-meeting.2021-07-13-14.29.moin.txt14:45
sarnoldwoo, thanks cpaelzer, all :)14:45
didrocksthanks cpaelzer, everyone :)14:45
=== genii-core is now known as genii
mdeslaur\o18:59
sil2100o/18:59
rbasako/19:00
sil2100I think there's enough of us, right?19:01
sil2100Let's maybe start this meeting o/19:02
mdeslauryep!19:02
sil2100#startmeeting Ubuntu Technical Board19:02
meetingologyMeeting started at 19:02:22 UTC.  The chair is sil2100.  Information about MeetBot at https://wiki.ubuntu.com/meetingology19:02
meetingologyAvailable commands: action, commands, idea, info, link, nick19:02
sil2100#topic Apologies19:02
sil2100No apologies for today, but I would like to apologize for missing last meeting - that was quite unexpected from my side19:02
sil2100#topic Action review19:02
sil2100ACTION: Wimpress To follow-up on-list with design review to address MATE Boutique security/consent concerns.19:03
mdeslaurI was on vacation last time and forgot about the meeting :P19:03
sil2100I think there was some movement on that during the last meeting, right rbasak?19:03
rbasakI need to follow up with Martin again there I think.19:03
rbasakThere was movement, yes, but not since then.19:03
sil2100Ok, so should we leave it as-is until we know more?19:04
rbasakYes - carry the action for me, please.19:04
sil2100#action Wimpress To follow-up on-list with design review to address MATE Boutique security/consent concerns.19:04
meetingologyACTION: Wimpress To follow-up on-list with design review to address MATE Boutique security/consent concerns.19:04
sil2100The two next action items are on vorlon who doesn't seem to be around, so I'll carry them over19:05
sil2100#action formal ratification of third party seeded snap security policy, depends on:19:05
meetingologyACTION: formal ratification of third party seeded snap security policy, depends on:19:05
sil2100#action vorlon to circle around with store, snapcraft, et all, and revise the snap source revision policy to be more clear with regards to rebuildability and GPL compliance.19:05
meetingologyACTION: vorlon to circle around with store, snapcraft, et all, and revise the snap source revision policy to be more clear with regards to rebuildability and GPL compliance.19:05
sil2100Next one is from vorlon as well - did anyone hear any update on that?19:05
sil2100i.e. vorlon to reply to seeded snap upload permissions question on list19:05
sil2100If not, we'll carry it over19:06
sil2100...let's carry over!19:06
sil2100#action vorlon to reply to seeded snap upload permissions question on list19:06
meetingologyACTION: vorlon to reply to seeded snap upload permissions question on list19:06
sil2100And final one is on me, and sadly this is not done yet - but I have just started drafting a draft some time before the meeting19:07
sil2100So hopefully, pinky promise, there'll be something to review for the next meeting19:07
sil2100#action sil2100 to start a draft summarizing the OEM archive portion of the meeting which xnox and TB will review, edit, and ratify before we move on to figuring out the next step19:07
meetingologyACTION: sil2100 to start a draft summarizing the OEM archive portion of the meeting which xnox and TB will review, edit, and ratify before we move on to figuring out the next step19:07
sil2100#topic Scan the mailing list archive for anything we missed (standing item)19:07
sil2100There are two ML items from June from what I see19:08
rbasakThere's two Flatpak related requests19:08
sil2100Not sure if those got handled19:08
sil2100Yeah, let's start with this one: https://lists.ubuntu.com/archives/technical-board/2021-June/002560.html19:08
rbasakI'm tempted to delegate this decision to the security team19:09
rbasakAny reason we shouldn't?19:10
rbasaksarnold: FYI ^19:10
sil2100Sounds fair, I personally don't feel strongly about changing the current status-quo, especially that it's an universe package19:10
sil2100But if the security team feels that Ubuntu would benefit more if we'd change, I guess it's something up for discussion19:11
mdeslaurI think delegating to the security team is fine, unless there is controversy about the decision, in that case, the security team can bring it back to the tech board19:11
mdeslaursil2100: it's being promoted to main19:12
sarnoldthanks rbasak, reading..19:12
sil2100Ah, now I see mention of an MIR19:12
sil2100hm, I must say that for packages we consider 'main' I like the idea of consistency, but I think it's fair to leave the decision to the security team19:13
rbasakLet's ask the security team to provide an opinion in the first instance, at least.19:13
mdeslaurI think it should be consistent too19:13
sil2100Who wants to follow up on that e-mail? To get the security teams professional opinion?19:14
mdeslaurI'd prefer someone else do the follow up19:15
sil2100;)19:15
rbasakSure19:15
rbasakto ubuntu-hardened@l.u.c?19:15
sil2100Oh, I didn't even know about such list?19:16
* mdeslaur didn't either19:16
sil2100rbasak: do you volunteer, or should I take it?19:17
sarnoldthe one guy who used to use that list stopped writing us questions :(19:17
rbasakI'm volunteering :)19:17
sil2100\o/19:17
mdeslaurrbasak: cc the list, and cc security@u.c please19:17
sil2100#action rbasak to follow up regarding security-team's advice on the flatpak TB request19:17
meetingologyACTION: rbasak to follow up regarding security-team's advice on the flatpak TB request19:17
rbasakmdeslaur: by "the list", you mean ubuntu-hardened@?19:18
mdeslauryeah19:18
rbasakOK :)19:18
sarnoldthanks :)19:18
sil2100What about the other TB ML message from June? Re: https://lists.ubuntu.com/archives/technical-board/2021-June/002559.html19:19
sil2100I didn't read the thread, does it have anything actionable?19:20
rbasakSo Erich uploaded displaycal to Impish Unapproved, and it's been sitting there since.19:20
rbasakI don't know what the AAs are expecting - maybe the resolution of this thread?19:20
rbasak(FWIW, IMHO they're right to wait until the thread is resolved)19:21
rbasakI think this is a case where we just need to make a decision.19:21
rbasakEither us, or the AAs, or the release team. The appropriate team is unclear to me.19:21
rbasakSo therefore maybe this is a case where the TB should just decide.19:21
rbasakIMHO, the biggest issue is the UX where users usually expect stuff installed by default to remain stable for the lifetime of the release.19:22
sil2100I don't think I have enough context right now, would have to read the whole thread first19:22
rbasakAnd that expectation would be broken here I think.19:22
rbasakchromium is an exception in this matter, but I don't think DisplayCAL qualifies.19:23
sil2100Ah, so this is the case of a new dummy package but with flatpak as the real source, right?19:23
rbasakRight19:23
mdeslauryeah, plus it adds a new flatpak repo19:23
rbasakEickmeyer: o/ ^19:23
mdeslaurwhich is the thing that I personally don't like and is akin to adding PPAs19:24
rbasakThere are lots of open questions here, such as a flavour adding a third party software source by default, etc.19:24
sil2100Yeah, tricky19:24
mdeslaurdoing that is the very reason we want mate to change how their store works19:24
rbasakEickmeyer points out that installing snaps by default, and the chromium deb that installs a snap, is also equivalent to "adding a third party software source".19:25
rbasakHowever I don't think they're really the same, as I explained in the thread. Lots of differences that impact UX.19:25
mdeslaurwe ship with the snap repo preconfigured19:25
mdeslaurthe other one is adding a new one, contrary to user expectations19:25
sil2100I mean, the difference is also that we make sure that the snaps that we do preinstall follow a certain level of 'stability', as rbasak already mentioned19:26
sil2100Which I don't think we have the guarantee of with the case of the added flathub.org flatpak repository?19:26
rbasakmdeslaur: I don't see the distinction you're describing. AIUI, Eickmeyer wants to ship with a Flatpak repo enabled by default, and a Flatpak installed, just as Ubuntu ships with the Snap Store enabled by default, and some snaps installed.19:27
rbasakI do agree with what sil2100 just said though.19:27
mdeslaurrbasak: he wants the deb package to enable a new flatpak repo19:27
mdeslauror am I misunderstanding19:27
sil2100I mean, I would be fine if we just had the guarantee of stability with the new software they install - in one way or another19:27
rbasakmdeslaur: that's just the mechanism. The snapd deb package enables the Snap Store :)19:28
rbasakThere's also questions over things like where the package is built, and the ability for Ubuntu developers to be able to override/patch what ships if required.19:28
rbasakeg. if there's a security vulnerability and the upstream Flatpak repo maintainer is absent, then what happens?19:29
mdeslaurIs the producer of the flatpak going to support it on ubuntu for the lifetime of the release?19:29
rbasakIn the Snap case, I believe there are arrangements to do with tracks and channels to support that situation.19:29
rbasakmdeslaur: that's another difference. That isn't currently part of the proposal.19:29
sil2100Yeah, so in my opinion it's not a matter of technology here, but a matter of arrangements with the people responsible19:29
mdeslaurrbasak: (re: mechanism): one is installing the snapd software itself, the other is installing an random piece of software (displaycal) and getting a repo added19:30
sil2100So it's not a problem that it's flatpak and from flathub.org, but more like a problem that we don't have arrangements with the people responsible, making sure that the flatpak remains stable and up-to-date with fixes19:31
sil2100Since sure, we don't always have up-to-date universe packages, but Ubuntu developers have the powers to update them if needed19:31
sil2100But here we need to have something arranged so that this still happens19:31
rbasakRight - but also, that the package installed isn't a rolling release.19:31
rbasakThat's not what users expect from the average app that ships with Ubuntu by default.19:31
mdeslaurand will that rolling release still support a 5 year old version of ubuntu in 5 years...19:32
rbasakI think we basically have a fairly extensive list of "properties" of the system here, that we think users expect, but just adding this Flatpak will not deliver.19:32
sil2100So personally I wouldn't straight away say 'no' to this proposal, but maybe before saying 'yes' try to get the discussion started on how to handle the maintenance situation from the Ubuntu perspective19:32
rbasakAgreed19:33
rbasakI think we need to enumerate the list.19:33
sil2100If Eickmeyer finds a good way to solve this, we can say 'yes' no problem - I personally, right now, have no such good idea, but maybe Eickmeyer has a better concept!19:33
rbasakAnd then see what Eickmeyer can come up with to meet those requirements (or negotiate them).19:33
sil2100Ok, do you want to follow up, or maybe you want someone other from the TB to follow up instead?19:34
sil2100(since I completely missed this thread)19:34
rbasakI'm happy to do it, if others feel I'm the best person to tackle a reply!19:35
mdeslaurcan we work on that list of requirements?19:35
mdeslaurI mean, can we collaborate on it before it is submitted?19:36
rbasakHow should we do that?19:36
rbasakOne way might be to do it on-list, making it clear that it's discussion towards a list of requirements rather than a final version? Or would you like to do this somewhere else?19:37
sil2100Makes sense, but I'm not sure if we'd be able to discuss it fully during this meeting19:37
mdeslaurrbasak: perhaps we can discuss it as a side-topic on the tech-board list and once we have a list of requirements we can submit them to the main topic?19:38
sil2100On list is possible, there's also this uh, ugly way of using some shared document first? I know google docs isn't ideal, but maybe there are better technologies (more open)19:38
rbasakEtherpad?19:38
sarnoldhey looks like ubuntu's instance is still live :)19:39
rbasakI'm happy whichever way :)19:39
sil2100Oh, etherpad! Been a while since I last used that - maybe that's a good idea?19:39
sil2100Since it's good if each of us has time to think it through and leave some comments19:40
rbasakhttps://pad.ubuntu.com/third-party-repository-requirements19:40
sil2100Thanks for creating it! Let me add an action item for this for the next meeting19:41
sil2100#action Work on getting a set of requirements for Ubuntu packages that enable third party software repositiories by default - related to a ML entry19:42
meetingologyACTION: Work on getting a set of requirements for Ubuntu packages that enable third party software repositiories by default - related to a ML entry19:42
sil2100Whoops, let me add the link there19:42
sil2100#action ^ https://pad.ubuntu.com/third-party-repository-requirements19:42
meetingologyACTION: ^ https://pad.ubuntu.com/third-party-repository-requirements19:42
sil2100Ok, in the meantime, let us move on19:43
rbasakApparently it doesn't support apostrophes :-/19:43
sil2100#topic Check up on community bugs (standing item)19:43
sil2100I didn't see any open bugs, so let's move on19:43
sil2100#topic Select a chair for the next meeting (next from https://launchpad.net/~techboard/+members)19:43
sil2100#info The next chair is mdeslaur, with cyphermox as backup19:44
mdeslaurack19:44
sil2100Thanks!19:44
sil2100#topic AOB19:44
sil2100...anything we need to talk about?19:44
sil2100If not, then let us finish up and start working on those requirements, I see rbasak already proposed some!19:45
sil2100So be sure to take a look and write your thoughts/comments19:45
sil2100#endmeeting19:45
meetingologyMeeting ended at 19:45:36 UTC.  Minutes at https://new.ubottu.com/meetingology/logs/ubuntu-meeting/2021/ubuntu-meeting.2021-07-13-19.02.moin.txt19:45
mdeslauryeah, I'll take a look tomorrow19:45
sil2100Thank you everyone!19:45
sil2100I think this was quite productive19:45
sil2100o/19:45
mdeslaurrbasak: sil2100 perhaps we should split "adding a default repo" and "installing a third party package" into two distinct things?19:46
rbasakmdeslaur: sure - please go ahead and edit19:46
sil2100mdeslaur: hm, might be an idea19:46
mdeslaurok will do first thing tomorrow, gotta run19:46
rbasakI'm not sure how to split the requirements.19:46
rbasakBut we can figure that out19:46
sil2100mdeslaur: could you write that up on the doc!19:46
sil2100Thanks!19:46
sil2100Ok, I disappear into the few final hours of my holidays19:46
sil2100o/19:46
* sil2100 edits the agenda and goes19:47
mdeslaurthanks sil2100! thanks rbasak19:47

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!