[Pkg-shadow-devel] should src:adduser, src:shadow and src:base-passwd work together?

[Marc Haber]

Hi,

On Tue, Oct 29, 2024 at 05:17:32PM +0100, Chris Hofstaedtler wrote:
> * Marc Haber <mh+pkg-shadow-devel at zugschlus.de> [241029 11:15]:
> > Giving the face that shadow already has its own mailing list, it would probably
> > make most sense to unite under the roof of the shadow package.
> 
> Agreed.

Good! Then we have consensus here.

> > Since shadow, adduser and base-passwd are exposed security-wise as well, it
> > would probably make sense to move the three source packages from the Debian
> > project to its own Salsa project, probably best called shadow-team.
> 
> I can kinda see that, but I don't want to do this for util-linux,
> and then I'm not seeing the extra value.

Util-linux is not part of this effort from my side.

> In general for Debian I'd like to see more things move into the
> debian/ namespace. If people introduce crap -because- of that, then
> so be it. They can already (NM)U the packages anyway. I'd rather
> take the extra drive-by help.

I can understand that for shadow and adduser, but is it wise to have
base-passwd in the Debian namespace? An NMU will raise more concerns
than a random commit.

Drive by help via merge requests works quite as well.

Are you (a) opposed or (b) indifferent to the three projects moving to
their own salsa team?

> > We can then decide together whether to move the Maintainer field of base-passwd
> > and adduser to pkg-shadow-devel at l.a.d.o as well. Adduser has its Maintainer set
> > to adduser at p.d.o, so interested parties can subscribe via the tracker, and
> > shadow has its Maintainer set to the mailing list. This leaves base-passwd
> > where there currently is no possibility to see maintainer mail like support
> > requests, bug reports and other issues.
> 
> Using the mailing list would seem like it makes the most sense?

Yes. I agree. Could the mailing list description then be "pkg-shadow,
base-passwd and adduser maintainance" or something along this line?

> Teams on tracker.d.o are a bit meh at the moment, given tracker
> still uses sso.d.o for managing them.
> I have no clue how to reconcile the mailing list and the
> <package>@packages.d.o alias however. Open to ideas.

Theoretically it should be possible for a mailing list admin to allow
the sender that the tracker uses to post to the list and then subscribe
the list to the tracker. I have seen other packages do this.

The tracker uses something like
bounces+20241029-mh+2Bdebian+2Dtracker=zugschlus.de at tracker.debian.org
as envelope sender, so /bounces+.*@tracker\.debian\.org/ should do it if
the mailing list software allows regexes in that place. Who has the
admin password for the mailing list?

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421