/srv/irclogs.ubuntu.com/2021/08/17/#ubuntu-meeting.txt

=== bigpod9 is now known as bigpod
=== doko_ is now known as doko
=== genii-core is now known as genii
cpaelzerhiho14:31
cpaelzerprepping the meeting ...14:31
ddstreeto/14:32
* ddstreet in other meeting as well, so only please ping me if needed14:32
cpaelzerno14:32
cpaelzernp14:32
cpaelzer#startmeeting Weekly Main Inclusion Requests status14:32
meetingologyMeeting started at 14:32:59 UTC.  The chair is cpaelzer.  Information about MeetBot at https://wiki.ubuntu.com/meetingology14:32
meetingologyAvailable commands: action, commands, idea, info, link, nick14:33
cpaelzerd_dstreet is here14:33
cpaelzeralso pinging sarnold doko didrocks jamespage14:33
cpaelzerwe know a few are unavailable this week14:33
cpaelzerso I'm almost expecting a status-monologue14:33
cpaelzer1. no previous actions14:33
cpaelzer#topic current component mismatches14:33
cpaelzer#link https://people.canonical.com/~ubuntu-archive/component-mismatches-proposed.svg14:33
cpaelzer#link https://people.canonical.com/~ubuntu-archive/component-mismatches.svg14:33
cpaelzernot seeing sarnold here :-/14:35
cpaelzerI wanted to ask about the timing of https://bugs.launchpad.net/ubuntu/+source/fence-agents/+bug/1927004 since we close in on feature freze14:35
ubottuLaunchpad bug 1927004 in fence-agents (Ubuntu) "[MIR] fence-agents" [Undecided, Confirmed]14:35
cpaelzerI'll ask in the seucrity channel instead14:35
cpaelzerdone14:36
dokoo/14:36
cpaelzerhi doko, nice to see you14:36
cpaelzereverything else in these lists is known or false-positives14:36
cpaelzer#topic New MIRs14:37
cpaelzer#link https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&assignee_option=none&field.assignee=&field.subscriber=ubuntu-mir14:37
cpaelzeregl-wayland is on ddstreet - he had requirements and we need to check if all are fulfilled14:37
ddstreetcpaelzer that's the one waiting on the q about missing tests14:37
cpaelzerone in particular is testing on special HW which we usually prohibit - ddstreet was so kind and suggested to put a formal "what if we need special HW for tests" in the MIR process14:38
cpaelzerI think we are not enough people to discuss that statement for our process14:38
cpaelzerbut doko if you and I could read the case for 3 min and ack/nack if that is ok14:38
cpaelzersee the ping above it is about us saying "missing tests" and the owning team saying "can't be done in build/autopkgtest"14:39
cpaelzergenerally I think that is ok14:39
* cpaelzer is reading14:39
dokois ubuntu-x-swat a team that we recognize?14:40
cpaelzerwe said no to that in the past14:40
cpaelzerddstreet: yeah this case has my ack in regard to the tests - here a build/autopkgtest (while nice) just isn't feasible14:40
cpaelzerwe said no to ubuntu-x-swat I mean14:40
dokoright, the hardware tests don't work. can we add a requirement that somebody has checked this locally?14:40
cpaelzerit needs to be a canonical-team as that is who offers the "support"14:40
cpaelzerdoko: excatly, in the past we had this on dpdk and there we (server team) confirmed that we have a machine with special HW and regularly doing tests14:41
cpaelzersomething like that I'd put into the formal MIR requirements14:41
dokosounds ok for me14:41
cpaelzerbut when we have more people here to vote14:41
cpaelzerdoko: does it have a real team subscriber as well or only ubuntu-x-swat14:42
dokowhich probably isn't going to work this week14:42
dokono other team subscriber14:42
cpaelzerI'm updating the case then14:43
ddstreetshould the case go back to owned by me, waiting on further discussion in later mir team mtg?14:43
cpaelzerddstreet: no it goes to seucrity IMHO14:45
cpaelzerthe subscription can be solved while waiting for them14:45
ddstreetack sounds good14:45
cpaelzerupdated14:46
cpaelzer#topic Incomplete bugs / questions14:46
cpaelzer#link https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&field.subscriber=ubuntu-mir14:46
cpaelzernothing since last week14:46
cpaelzerdoko: I fail to remember which one, but IIRC some case was assigned to you and still open14:46
cpaelzerdoko: are you aware which one or do I need to check logs?14:47
cpaelzerand if you are aware could you link it and estimate when it will be done (a MIR review IIRC) ?14:47
cpaelzerwhile we look for that we enter the next section14:47
cpaelzer#topic Any other business?14:47
dokourgh, don't remember which one14:47
dokowas this some fuse stuff?14:48
cpaelzerno, that was a different case14:48
cpaelzerlet me check14:48
cpaelzerdoko: https://bugs.launchpad.net/ubuntu/+source/adsys/+bug/1936907 ?14:50
ubottuLaunchpad bug 1936907 in adsys (Ubuntu) "[MIR] ADSys" [Undecided, New]14:50
cpaelzerI think that was what didrocks waited on14:50
cpaelzeranything else for today ?14:50
dokook14:51
cpaelzerddstreet: we will have to remember about adding a statement for the special-HW testing for when more MIR members are available14:51
cpaelzerok - if there is nothing else I'd close for today14:51
cpaelzerthanks doko and ddstreet for not letting me alone here :-)14:51
cpaelzer#endmeeting14:51
meetingologyMeeting ended at 14:51:53 UTC.  Minutes at https://new.ubottu.com/meetingology/logs/ubuntu-meeting/2021/ubuntu-meeting.2021-08-17-14.32.moin.txt14:51
=== bigpod9 is now known as bigpod
mdeslaur\o18:59
rbasako/19:01
* vorlon waves19:02
mdeslaurso, looks like we're july 27th and I'm chairing19:04
mdeslauris 3 quorum?19:04
cyphermoxo/19:05
vorlonwe've treated 3 as quorum in the past; but now we're 4 anyway :)19:05
mdeslaurhi cyphermox19:05
mdeslaurok. let's get this road on the show19:05
mdeslaur#startmeeting19:05
meetingologyMeeting started at 19:05:43 UTC.  The chair is mdeslaur.  Information about MeetBot at https://wiki.ubuntu.com/meetingology19:05
meetingologyAvailable commands: action, commands, idea, info, link, nick19:05
mdeslaur[topic] Apologies19:05
mdeslaurno apologies19:05
mdeslaur[topic] Action review19:06
mdeslaur"Wimpress To follow-up on-list with design review to address MATE Boutique security/consent concerns. "19:06
mdeslaurWimpy ^19:06
mdeslaurI'm trying to remember, didn't someone volunteer to get in touch with the mate team about that?19:07
rbasakI did manage to speak to Martin very briefly on IRC19:07
mdeslaurdid anything come out of it?19:08
* rbasak is looking for the log19:08
rbasakCan we come back to it in a moment?19:08
mdeslaursure, let's move on in the meantime19:09
mdeslaurorlon to circle around with store, snapcraft, et all, and revise the snap source revision policy to be more clear with regards to rebuildability and GPL compliance.19:09
mdeslaurwhoops19:09
mdeslaurs/orlon/vorlon/19:09
vorloncarry over19:09
mdeslaurand "vorlon to reply to seeded snap upload permissions question on list "19:09
vorlonfwiw there are some developments that suggest we might get some more work done on it soon, as firefox is moving to a snap19:09
mdeslaurok19:10
mdeslaur"sil2100 to start a draft summarizing the OEM archive portion of the meeting which xnox and TB will review, edit, and ratify before we move on to figuring out the next step "19:10
vorlonso I suspecct I will have fewer excuses for it not getting my attention19:10
mdeslaurhe's not here, so let's carry that one over19:10
cyphermoxvorlon: it's long carried over, will that move as well, pushed by firefox (rebuildability) ?19:10
vorloncyphermox: I think so19:11
cyphermoxack19:11
mdeslaur"rbasak to follow up regarding security-team's advice on the flatpak TB request "19:11
rbasakI did request the security team's input19:11
rbasakNot had a reply19:11
mdeslaurhrm, I think seth discussed it, but I don't think he officially answered...he's on vacation this week, so let's wait19:12
mdeslaur"Work on getting a set of requirements for Ubuntu packages that enable third party software repositiories by default - related to a ML entry "19:12
vorlonwas this a group action?19:13
vorlonI hadn't seen any mailing list replies after my belated one19:13
vorlonnot sure if I killed the mood by pointing out he's better off repackaging as a snap than waiting for a flatpak policy?19:14
rbasakIIRC, at a previous meeting we concluded that we (the TB) could come with a set of requirements and communicate it back19:14
rbasakAnd we started working on that on the pad19:14
vorlonah right19:14
mdeslaurI think vorlon captured the main criteria that really is the first step, which is "one thing we have been consistent about in19:15
mdeslaurthe past when enabling additional repositories by default in flavors has19:15
mdeslaurbeen maintaining Canonical as a single root of trust"19:15
rbasakI've found the log about MATE/Boutique when we're ready19:16
rbasakI think it'd be helpful to enumerate the requirements still19:16
cyphermoxI will have an AOB item later19:16
mdeslaurI don't think there's any reason to work on more criteria if that first one can't be met by DisplayCal19:16
rbasakMaybe, as a compromise, we could summarise the other points raised, but make it clear that they aren't ratified? To provide an idea of what might be required, but to save us the effort of continuing if DisplayCal isn't going to meet them anyway.19:18
mdeslaurI'd be ok with that19:18
mdeslaurcyphermox, vorlon: thoughts?19:19
cyphermoxwell I agree on preparing a set of requirements ahead of time even if they're not firmed up19:21
cyphermoxbasically, getting the discussion rolling19:21
rbasakhttps://pad.ubuntu.com/third-party-repository-requirements is what we have right now19:21
cyphermoxyup19:21
rbasakI think a couple of those requirements aren't currently met for snaps19:21
rbasak"Proposed requirement: the package is maintained by someone with Ubuntu developer membership" - not a requirement for chromium snap maintenance I think?19:22
rbasakand "behaviour will remain "stable" for the lifetime of an Ubuntu release. It is not to be on a "rolling release" from the users perspective" contradicts a statement at https://wiki.ubuntu.com/UbuntuSeededSnaps19:22
mdeslaurwhich statement does that contradict?19:25
cyphermoxbehavior remaining stable; typically that meant no new features for debs19:27
rbasakThe Snap Store ecosystem empowers snap publishers to make their own  decisions about how and whether to backport security fixes to stable  releases vs. updating the package in the channel to a new upstream  version.  We accept this model as well for installed-by-default snaps,  with the understanding that the publisher of each of these snaps is  expected to deliver a good experience to their users."19:27
mdeslaurthat same page also says "Including software in the default install of Ubuntu implies a certain commitment to handle upgrades cleanly and to provide continuity of behavior across updates within the stable release."19:28
rbasakFWIW, that page isn't ratified either19:28
rbasak(AIUI)19:28
rbasakIt would be nice IMHO to get this all properly squared off.19:29
rbasakMore important now that community members might feel that they don't have agency in the project by being measured differently for what they want to achieve.19:29
rbasak(with a real world request, rather than a hypothetical)19:30
vorlonrbasak: "maintained by someone with Ubuntu developer membership" - yes, I don't think that had come up in those specific terms in the past when talking about snaps; we had talked about ensuring there was a path for the community to take over, but that where upstreams were maintaining app packages they should have autonomy19:31
mdeslaurmy thought there was that the package would be maintained by someone who has a vested interest in Ubuntu...if someone is maintaining a snap or a flatpak and doesn't care about testing it on Ubuntu, I don't see how we could possibly use it19:32
vorlonlikewise, regarding "stability": the vision here was that we enable easy and secure delivery of the upstream experience, even where that differs from traditional Ubuntu SRU standards19:32
mdeslaurrequiring developer membership seemed like an appropriate requirement to me19:32
mdeslaurso I think it's going to take a while to come up with requirements we all agree with...meanwhile, we have someone waiting for DisplayCal19:33
vorlonmdeslaur: if this is an upstream development team who maintains the package collectively, based on the view that snaps or flatpaks are a way to deliver their software to the entire Linux ecosystem without having to deal with individual distributions (which is basically the sales pitch for both of these packaging formats), what would be the expectation here? Ubuntu developer membership for each19:34
vorlonmember of the upstream team?19:34
mdeslaurI don't know19:35
vorlonok19:35
mdeslaurI don't think requiring ubuntu membership is reasonable for an upstream19:35
mdeslaurbut then again, I don't think having upstreams deliver their software directly to users is reasonable either, so what do I know :)19:35
mdeslaurI just don't want us to seed something that the packager is going to respond "I don't care about ubuntu" to any issue that comes up19:36
rbasakThat seems reasonable.19:38
mdeslaurIn this particular case, unless I'm mistaken, the person requesting that DisplayCal be seeded isn't the packager, so how do we make sure the packager there is even interested in making sure Ubuntu is a first-class citizen19:39
rbasakTo make progress, I wonder if we can split the proposed requirements into a few categories.19:39
rbasakSome we might agree unanimously19:39
vorlonwell, from my perspective flathub as a whole is a non-starter, so then what19:40
rbasakSome I think contradict UbuntuSeededSnaps, and so I think are either invalid or need adjusting or UbuntuSeededSnaps, so whichever way cannot be ratified by us right now19:40
rbasakSome I think we don't necessarily agree on ourselves19:40
cyphermoxwhy does it need to be seeded in the first place? what does it solve that can't work by someone installing it on their own if it's available?19:40
rbasakvorlon: I don't think that we can use your statement as-is. Is it worth going through five whys, or not?19:41
rbasakcyphermox: I think Eickmeyer's position is that it's important that it's there on Ubuntu Studio by dfeault19:41
vorlonrbasak: which statement? the one on the mailing list?19:41
mdeslaurI think one of the categories can be "Default repositories"19:41
rbasakvorlon: "from my perspective flathub as a whole is a non-starter"19:42
vorlonrbasak: because it's an additional root of trust19:42
rbasakmdeslaur: I think that's a second dimension19:42
Eickmeyerrbasak: It would be nice (recently had an inquery about it), and I'm running into roadblox with making a snap.19:42
Eickmeyer*roadblocks19:42
rbasakvorlon: oh, OK. So you have a separate requirement there I think. "Canonical must be the root of trust"19:42
rbasakI'll add that.19:42
rbasakThough it sort of overlaps with "must be built on infrastructure we trust"19:43
rbasakLet me label them19:43
cyphermoxrbasak: I guess, but seeded packages/snap are basically a showcase of what's nice, or things that are absolutely required for systems to work. DisplayCAL is nice, but it's not necessarily useful to the vast majority of users (ie. it's good for graphics, it's not really useful if you're trying to make sound effects, music, etc.)19:43
mdeslaurroot of trust of distribution isn't the same as where it was built19:43
mdeslaurthose are two separate things, but related19:44
rbasakcyphermox: I think that's for the flavor leads to decide though. It's not really for the TB. But what we need to do is enable (by setting the expectations and requirements) flavors to be able to seed what they think is appropriate.19:45
vorlonrbasak: +119:45
cyphermoxrbasak: oh, for sure, but I mean if you're trying to decide seeding in general vs. the case19:45
vorlon(that it's the flavor leads' decision)19:45
mdeslaurI agree with rbasak, not our decision19:45
cyphermoxand if the publisher doesn't appear to care about Ubuntu, why should Ubuntu care about the publisher?19:46
cyphermoxI'm not saying otherwise, I liked displaycal :P19:46
rbasakI think this is a pretty nuanced question.19:46
rbasakFor example we ship calibre as a deb, contrary to upstream's desire there.19:46
vorloncyphermox: I'm not sure the point you're making regaring caring19:46
cyphermoxbut calibre has Ubuntu developers preparing the package19:47
rbasakWe presumably think it's OK because it's permitted by the licensing and we're in control of its distribution when users consume it from us19:47
cyphermoxvorlon: I'm trying to paint the picture of having a committed maintainer for something19:47
mdeslaurThe scenario we don,t want is to seed something and for it to stop working because the packager doesn't care about Ubuntu19:48
cyphermoxyep19:48
rbasakSo what I'm saying is that it meets proposed requirement B.19:48
rbasakBut some snaps also meet proposed requirement B, and if a DisplayCal flatpak can be made to meet that requirement too, then that might be OK.19:48
cyphermoxyes19:48
rbasakThis might mean that it can't be shipped via Flathub19:48
rbasakBut I don't want to dictate that. I want to specify what we need, which I think is better stated in B19:49
mdeslaurrequirement B is the fail-safe, I want a requirement where the developer is involved and agrees that their package is going to be seeded19:49
rbasakmdeslaur: but we don't do that with any other deb package in the archive19:49
rbasak(eg. calibre)19:50
mdeslaursure we do, the ubuntu developers group19:50
mdeslaurthe debs in the archive are there because ubuntu developers agree that they should be19:50
rbasakOK, so if Ubuntu Studio "fork" the Flatpak package, and ship it still as a Flatpak but from somewhere else, and agree that this fork is going to be seeded, would you be happy with that?19:51
=== Droid is now known as Mekaneck
mdeslauroh sorry, I just noticed I said "developer" when I meant "packager"19:51
cyphermoxhow do you ensure the builds happen on trusted infrastructure?19:52
mdeslaurIf the ubuntu studio team is taking over packaging, then yes, I'd be ok with that19:52
mdeslaur(assuming we had a canonical-controlled flatpak repo and build system)19:52
rbasakmdeslaur: define "taking over". We don't do that for packages we autosync from Debian19:52
cyphermoxfork19:52
rbasakcyphermox: builds happening on trusted infrastructure is requirement F19:53
cyphermoxrbasak: yes, I know19:53
mdeslaurrbasak: we "take over" packages we sync from debian19:53
mdeslaurrbasak: debian no longer maintains the packages in ubuntu19:53
rbasakI think that's a technicality19:53
cyphermoxrbasak: I was basically saying the same as mdeslaur, "assuming canonical-controlled flatpak repo and build system")19:53
vorlonrbasak: fork and ship elsewhere> in principle yes, but that means getting a separate flatpak store signed by Canonical, which realistically isn't going to happen for one package, so what's the point in the end?19:54
rbasakWhat matters is that someone is committed to be able to intervene on behalf of users, without users needing to take action themselves.19:54
rbasakWhich is requirement B, and not a separate thing19:54
rbasakvorlon: I'm just saying that between B and F I think we have this subthread covered19:54
vorlonit's good to know what our principles are, but at some point we're spending times on unrealistic generalized hypotheticals19:54
mdeslaurso if the packager won't fix an ubuntu-specific bug, we override the repo?19:54
rbasakmdeslaur: I propose that it be a requirement that this is something the Ubuntu project be in a position to do19:55
mdeslaurI have a hard-stop in 5 minutes, unfortunately19:55
rbasakWhether it happens or not is a separate matter19:55
mdeslaurI don't think that's enough. I think it's important that the publisher agrees that their package is seeded in Ubuntu.19:56
rbasakAFAICT, Ubuntu Studio would effectively be the "publisher", and so that requirement is met by default.19:56
rbasakThere is no technical difference between that, and a fork.19:57
vorloncan we agree next steps?19:57
rbasakBecause if requirement B is met, Ubuntu Studio can take over at any time, just like any deb package in universe.19:57
mdeslaurok, I don't see us resolving this any time soon, each of these points is going to require discussion.19:57
vorlonit's a good discussion, but we're obviously not converging in 3 minutes19:57
mdeslaurthe only thing I think we can agree to is requirement H19:57
vorlon(and there was an AOB item?)19:57
cyphermoxyes, it's actually quite simple19:57
mdeslaurunless someone objects to H19:58
rbasakNo objection, but I think H needs a clearer definition19:58
rbasak(and therefore I'm not sure about it pending that definition)19:58
cyphermoxcould we possibly put all the different threads of discussion in bugs or something so it's easier to get back state on everything here, and see progress between meetings, rather than having to re-read ML threads, find links again from IRC logs, etc.?19:58
cyphermoxit's an idea, not necessarily the exact solution19:59
mdeslaurok, so we can't respond to the DisplayCAL issue today then.19:59
rbasakI was hoping people would use the pad for discussion19:59
cyphermoxnot just this particular discussion19:59
mdeslaurso let's continue working on the pad19:59
rbasak(though FWIW the pad is awful and doesn't let me punctuate)19:59
vorlon:)19:59
rbasakI'd like to give others a task please. If you don't support a particular proposed requirement, please comment and explain why, to help start the discussion there20:00
vorlon+120:00
cyphermoxaye20:00
mdeslaureveryone must spend some time in the pad this week20:00
mdeslaurok, let's move on20:01
mdeslaur[topic] Mailing list archive20:01
mdeslaurthere's the sunset backports thread, but it looks like some folks stepped up20:02
mdeslaur(I think that's what I read this week)20:02
rbasakI don't think any action is needed on that right now. It seems to be proceeding well without TB intervention and nobody has requested TB intervention to the current course of action AFAICT.20:02
mdeslaurok20:02
mdeslaurthere's rbasak's post about inconsistent password prompts in update-manager20:03
mdeslaurperhaps that should be a bug assigned to the security team?20:03
rbasakI did get the owner of ~ubuntu-backports changed to ~techboard. I assume that's uncontroversial20:03
rbasakIs it a bug?20:03
rbasakI was asking the question20:03
mdeslaurit's not a bug, that's the way it was designed20:03
mdeslaurbut perhaps it should be revisited now that there are a lot more kernel updates20:04
rbasakI mean: is it something we need to change?20:04
mdeslaurwhen it was done that way, there were fewer kernel updates, so most updates never asked for a password20:04
mdeslaurI do agree that it's weird and should probably be changed20:04
mdeslauror at least discussed again20:05
rbasakOK I can happily file a bug then20:05
mdeslaurIIRC, the original design was a compromise between the security team and the design team20:05
mdeslaurand there were technical limitations that prevented it from being smarter20:06
mdeslaurbut perhaps it can be fixed or rethought20:06
mdeslaurI don't see anything else on the mailing list20:06
mdeslaur[topic] Community bugs20:07
mdeslaurnone20:07
mdeslaur[topic] AOB20:07
mdeslaurcyphermox: wake up20:07
cyphermox""could we possibly put all the different threads of discussion in bugs or something so it's easier to get back state on everything here, and see progress between meetings, rather than having to re-read ML threads, find links again from IRC logs, etc.?""20:07
cyphermoxfor action items and such20:07
rbasakThat sounds like a lot of admin. Are you volunteering? :)20:08
cyphermoxnot really, but it would be good to have things in a central location20:08
rbasakIOW, I have no objection to tracking things in bugs, but wouldn't that just be another place you need to read to catch up?20:08
cyphermoxand the wiki agenda has this lack of context20:08
mdeslaurI thought the agenda was the central location20:08
rbasakMaybe discourse posts?20:08
cyphermoxthat may work too20:09
rbasakMore editable, wiki posts are possible, etc.20:09
mdeslaurfeel free to create discourse posts and link them in the agenda20:09
vorlonI don't see the point of discourse instead of bug reports20:09
* mdeslaur needs to remember where the discourse is20:09
rbasakcyphermox: honestly, I'm not sure I really understand what you're asking me to do.20:10
rbasakIf you want to do something to help track things better, then I have no objection. But I assume you want me to then do something differently? What?20:10
mdeslaurI really need to leave now, so let's finish this up and cyphermox can let us know what he wants?20:11
cyphermoxwell, to me either we keep clearer action items so we remember from one time to the other what something was about, or people spend time to update them done as soon as they are, which I feel bugs would make quick -- if it's inprogress it's a carry over, otehrwise it's maybe done, etc.20:11
mdeslaur[topic] Next chair20:11
mdeslaurnext chair cyphermox, backup rbasak20:11
cyphermoxyup20:12
mdeslaurcyphermox: did you have another AOB, or was that what you were referring to earlier?20:12
cyphermoxno, that's what I was referring to20:12
mdeslaurok, cool20:12
mdeslaur#endmeeting20:12
meetingologyMeeting ended at 20:12:52 UTC.  Minutes at https://new.ubottu.com/meetingology/logs/ubuntu-meeting/2021/ubuntu-meeting.2021-08-17-19.05.moin.txt20:12
mdeslaurthanks everyone, apologies for having to leave20:13
mdeslaurI'll update the agenda tomorrow morning20:13
* vorlon waves20:13
vorlonthanks20:13
rbasakThank you!20:14

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!