Debian Traffic #17 For 5�Jan�2001

Editor: Zack Brown

By Peter Eckersley ,� Prashanth Mundkur �and� Zack Brown

Debian Home Page | Weekly News | Social Contract | Constitution | Policy Manual | Developer's Reference | Documentation Project | debian-devel Archives

Table Of Contents

• Printer-Friendly Format
• Text Format
• XML Source
• Introduction
• Mailing List Stats For This Week
• Threads Covered

  1.	14�Dec�2000�-�28�Dec�2000	(8 posts)	Adding A New Package Category: Education
  2.	23�Dec�2000�-�27�Dec�2000	(6 posts)	Group Policy
  3.	23�Dec�2000�-�31�Dec�2000	(52 posts)	Wishful Thinking About Package Management
  4.	25�Dec�2000�-�26�Dec�2000	(6 posts)	Cloning Debian Installs
  5.	27�Dec�2000�-�30�Dec�2000	(7 posts)	Tracking Changed Packages

Introduction

Want to help write KC Debian? See the KC Authorship page the KC Debian homepage, and the Thread Summary FAQ. Send any questions to the KCDevel mailing list.

Mailing List Stats For This Week

We looked at 383 posts in 1308K.

There were 163 different contributors. 73 posted more than once. 0 posted last week too.

The top posters of the week were:

• 20 posts in 70K by "Eray Ozkural (exa)" <erayo@cs.bilkent.edu.tr>
• 15 posts in 51K by Matt Zimmerman <mdz@debian.org>
• 14 posts in 44K by debian-devel.lists.debian.org@marc-haber.de (Marc Haber)
• 12 posts in 38K by Joey Hess <joeyh@debian.org>
• 11 posts in 34K by Hamish Moffatt <hamish@debian.org>
• Full Stats

1. Adding A New Package Category: Education

14�Dec�2000�-�28�Dec�2000 (8 posts) Archive Link: "menu-policy: education"

Summary By Zack Brown

People: Ben Armstrong,�Yann Dirson,�,�Erik Steffl,�Andreas Schuldei

Andreas Schuldei announced his work on packaging kvoctrain, a vocabulary trainer. The package didn't seem to fit into any existing category, so he suggested a new one - 'education'. Tom Cato Amundsen liked the idea, and pointed out that the solfege package would also fit nicely in that category. Ben Armstrong added:

There was no reply to this, but elsewhere, Yann Dirson also applauded the idea of an 'education' category, adding, "I suppose the place to discuss this is debian-policy, and the way of asking for this would be a bug on "debian-policy"." (Ben disagreed with this, though, and discussion continued on debian-devel) Yann went on to examine various categories under which 'education' could be grouped. Apps/Education he felt would get lost, as there were already a huge number of subsections under 'apps'. Games/Education he felt would be too restrictive. In the end, he supported putting 'education' on the top level, not as a subcategory. Erik Steffl suggested the existing Apps/Educational, where he'd already added the Arithmetic Quiz and Tipptrainer packages. But Ben agreed with Yann that a top-level placement would be fine. He suggested the following subcategories:

• Education/Early Skills
• Education/Typing
• Education/Math
• Education/Language
• Education/Science
• Education/Music
• Education/Computer
• Education/Admin

2. Group Policy

23�Dec�2000�-�27�Dec�2000 (6 posts) Archive Link: "Bug#80343: general: Lack of policy on which files should be owned by which user"

Summary By Prashanth Mundkur

People: KORN Andras,�Brian May,�Arthur Korn,�Hamish Moffatt,�,�Eray Ozkural

KORN Andras (Andrew) was a bit peeved about " a general confusion among some Debian developers as to what user ids such as 'nobody' should be used for. I suggest that the policy be updated with relevant advice." He explained that " As I see it, 'nobody' should be a user that owns no files and has no privileges; thus, if a service running as 'nobody' were to be compromised, the attacker wouldn't gain the ability to change any files." Along the same lines, if processes that ran as user 'daemon' (like portmap, the 'at' daemon, lprng and the distributed-net client) were compromised, signals could be sent to other 'daemon' processes and/or their files written to, possibly leading to privilege escalation. He suggested "Most packages that contain programs run 'at system level' ('daemons') should probably create their own user id that the program can run under (luckily, many packages already do this)."

Brian May expressed his dislike of the one UID per daemon idea: "as you end up having more UIDs for daemons then users" . He elaborated "it would be easy to hide back-door entry point in /etc/passwd if lots of entries exist (eg. missing password field)" , to which Arthur Korn responded that passwd file validation can be performed by a script.

To Brian's objection "As the number of entries grows, the chance that one/more entries will conflict with some NIS, openldap or remote NFS system increases. Especially since adduser, etc, do not support NIS or openldap. I am not sure of the details here - can adduser assign a local user a UID that conflicts with that from some other source?" , Arthur responded "Then we should fix adduser and libc(PAM/NSS)."

Other discussion focused on the merits of having a seperate group for every user. When Eray Ozkural asked for the reason for this policy, Hamish Moffat provided a free tutorial:

3. Wishful Thinking About Package Management

23�Dec�2000�-�31�Dec�2000 (52 posts) Archive Link: "What do you wish for in an package manager?"

Summary By Peter Eckersley

People: Dwayne C. Litzenberger,�Joseph Carter,�Adam Heath,�Matthijs Melchior,�Wichert Akkerman,�Ben Collins,�Brian May,�Eray Ozkural,�Richard Atterer,�,�Andreas Fuchs

Dwayne C. Litzenberger started a lively conversation by saying "I'm starting work on a new linux package manager. The idea is to be able to replace rpm, dpkg, apt, dselect (backend) with one,written mostly from scratch and designed to be as simple (code, not features) and clean as possible." . He then asked for feature suggestions.

Despite some skepticism about the necessity of such a project, many interesting hypothetical package management features were discussed.

Joseph Carter said "I think if dpkg used some sort of hashed database index it would be a hell of a lot nicer to people's CPUs and memory." Adam Heath replied "This is perfectly doable, and on my todo for dpkg 1.9." There was some brief controversy over the use of binary package databases.

John Hasler and Matthijs Melchior simultaneously suggested a rollback command "to undo the installation of a package and revert to the version that was installed previously, without having the original .deb available." . Wichert Akkerman commented "dpkg will support rollback at some point, when reiserfs supports transactions." There was some confusion about why filesystem level transactions would be required for this, until Ben Collins pointed out "the old package does not understand that the new package possibly setup some things (configuration settings, diversions, symlinks, removal of cruft, alternatives) that it cannot recover from." Andreas Fuchs added that multiple filesystems make the task non-trivial even with transaction support.

Richard Atterer suggested "An installer that is smart enough to realize that it is about to overflow the disc, so it deletes any .deb files that have been downloaded and already installed."

Numerous other possibilities were raised and considered briefly. Some, such as using bzip2 (instead of gzip) for compression, allowing users to install .debs in their home directories, and coping with non-standard situations (such as read-only shared NFS directories), have been extensively discussed on the list before. There was also a rambling debate on the necessity and feasibility of installing several versions of the same package simultaneously.

4. Cloning Debian Installs

25�Dec�2000�-�26�Dec�2000 (6 posts) Archive Link: "Need to clone machines efficiently - help?"

Summary By Prashanth Mundkur

People: Aaron Lehmann,�Peter Eckersley,�Frank Copeland,�,�Aaron Lehmann

Erik Winn, a volunteer with a Portland group that "recycles used technology and provides computers, education and access to the internet in exchange for comunity service", wrote in to ask for help in cloning hundreds of machines over the local network.

Aaron Lehmann provided a link to System Imager from VA Linux, http://systemimager.org, adding "It requires the hardware to be basically identical across machines. Once you set up the server, which is a significant task, cloning the master client onto the other clients is a cinch, involving putting the automatically-generated floppy disk into the disk drive and turning on the computer."

Mircea Luca and Frank Copeland provided a link to the FAI project: http://www.informatik.uni-koeln.de/fai/.

Peter Eckersley contributed the experiences of a similar project called Computerbank in Australia that seeks "to supply free GNU/Linux systems to low income individuals, community groups and disadvantaged schools":

Peter thought an international affiliation between Free Geek and Computer Bank may be advantageous.

Frank supplied the task packages used by Computerbank:

5. Tracking Changed Packages

27�Dec�2000�-�30�Dec�2000 (7 posts) Archive Link: "How to get changelog file for a given _binary_ package?"

Summary By Zack Brown

People: Marc Haber,�Matt Zimmerman,�Ingo Saitz,�

Marc Haber said, "we use a number of backported potato packages and I am working on a script that sends me e-mail when a new version of these packages appears in woody." He wanted to have the script simply periodically pull the changelogs of those packages off of the Debian site via the http://cgi.debian.org/cgi-bin/get-changelog?package=$package URL, where $package stood for the name of the package in question. But for certain packages, such as libdb2-util, the URL would only say, "No such changelog file".

Matt Zimmerman replied, "The get-changelog CGI doesn't seem to have worked for quite some time now. I don't think the problem is necessarily with multiple binary packages, but that a lot of data is missing. I am working on a replacement that uses a database backend, but it would need to be hooked into dinstall/da-katie/whatever in order to be most effective, and I don't expect that to happen anytime soon."

Rick Younie suggested something like "lynx�-dump�http://packages.debian.org/libdb2-util", or adding Woody to the sources.list and parsing the Package files locally. And Ingo Saitz suggested simply, "subscribe to debian-devel-changes@lists.debian.org to get an email whenever a package in unstable is changed. Just filter for the packages that you have modified by parsing the subject should be sufficient :)"

�

�

�

�

�

�

Sharon And Joy
�