65
Debian’s git transition plan (diziet.dreamwidth.org)
submitted 10 months ago by to c/linux@programming.dev
5 comments fedilink hide all child comments
 

tl;dr:

There is a Debian git transition plan. It’s going OK so far but we need help, especially with outreach and updating Debian’s documentation.

all 5 comments

sorted by: hot top controversial new old
[–] 8 points 10 months ago* (3 children)

Is this because of the xz utils thing? The backdoor was included into the tarball, but it wasn't in the git repo.

By switching away from tarballs they pribably hope to prevent that, although this article doesn't mention that. It's possible this shift has been happening since before the xz utils.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 5 points 10 months ago (2 children)

    Not really. If xz were the issue, Debian would have just switched to a different tarball format like lz4.

    This is more about Debian packaging conventions being very archaic and requiring a lot of futzing with upstream tarballs and patches.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 10 months ago (1 child)

    The backdoor of the xz utils program(s) was in the tarball release, but not the main source code:

    https://en.wikipedia.org/wiki/XZ_Utils_backdoor

    If debian had dodged the upstream tarball, then they wouldn't have been affected by this.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 10 months ago

    I mean, that's true, but that doesn't mean that's why Debian's doing it.

    If they were solving just that, then they would have just pushed for something like a reproducible tarball where you can point to a commit, branch, tag, etcetera from which that tarball can be reproduced and not bother migrating their package format.

    Debian has a serious ease-of-packaging issue that I've witnessed first-hand, and I think they've made it clear that it's moreso the ease factor they're focused on that the security factor.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 1 point 10 months ago

    Gives 403 forbidden

  • permalink
  • fedilink
  • source
    •