launchpad-dev team mailing list archive

[Scott Kitterman <ubuntu@xxxxxxxxxxxxx>]

On Thursday, June 05, 2014 21:27:36 Colin Watson wrote:
> On Thu, Jun 05, 2014 at 12:00:23AM -0400, Scott Kitterman wrote:
> > Personally, I'm fine with it being in #ubuntu-release.  I think we're
> > already much too fragmented and people are too comfortable in their own
> > corner of the project.
> 
> Thanks for the feedback.  That was my inclination too, but I have a
> somewhat different perspective as I expect to be processing a bunch of
> the queue events regardless of where they end up, so didn't want to
> prejudge anyone else.
> 
> > As you know from previous mails, I'm very troubled by the current CI train
> > situation with respect to permissions.  I believe it is completely
> > inconsistent with our governance processes and represents, at best, an
> > unknown from a security perspective.  No worse than the situation today
> > is no comfort for me (and yes, I know it's the same either way, but I
> > think this is a critical infrastructure issue - the only reason this
> > isn't a Tech Board item right now is it's already on the way to being
> > resolved).
> 
> I generally agree with your concerns about making sure that the archive
> permission model actually means something.  For the time being I'm happy
> that a resolution is on its way, but I do intend to keep track of this.
> (I was glad to see one relevant upstream developer being prompted by the
> earlier conversation on ubuntu-devel into applying for PPU; that seems
> like something to encourage.)
> 
> Regardless of how important I think it is, though, I just don't think
> it's *relevant* to the RTM plans, as it's independent in a mathematical
> sense.  It makes no difference whether Ubuntu archive permissions are
> being worked around in the primary archive or exactly the same way in a
> derived archive with identical permissions, and so I would prefer not to
> complicate things by tying the two jobs together; they're each tractable
> in isolation, but I'd be concerned about the risk of requiring that we
> do both before the RTM date.

I agree.  I only mention it for completeness.  I only want it kept in mind 
that "no worse than we have now" is not a synonym for "OK".

Thanks,

Scott K