[Popcon-developers] popcon & derivatives

[Bill Allombert]

On Thu, Jan 23, 2014 at 06:25:57PM +0800, Paul Wise wrote:
> On Tue, Jan 21, 2014 at 2:09 AM, Bill Allombert wrote:
> 
> > Until this raises to the level of a practical issue (instead of concerning
> > half a dozen submission as of now) there is no need to do anything.
> 
> Clearly (from the Ubuntu situation) it will become an issue if
> derivatives like Ubuntu that don't yet submit to popcon.d.o start
> doing so.

The Ubuntu issue was special, in that it was not intentionnal. Thus it was breaching the privacy of the
Ubuntu users, so I discarded them.
Is that the kind of issues you are concerned about ? This is a valid concern.

> > Are you interested by some particular statistics ?
> 
> I've seen the stats you have posted, I'm mainly interested in two things:
> 
> What I should recommend to linGobEx developers re enabling popcon submissions:
> 
> https://lists.debian.org/debian-derivatives/2014/01/msg00004.html

My position is that if you change the popularity-contest package,
then you have to change the version.

Does linGobEx set the Vendor field ?

> How to update the popcon section of the derivatives guidelines:
> 
> https://wiki.debian.org/Derivatives/Guidelines#Popularity_Contest

The use of public key cryptography is an issue.
One proposal was for derivatives to add a package popularity-contest-foo
that adds their public keys and drop a file in /etc/popularity-contest.d which
make popcon to report to their own server in addition to the Debian server 
encrypted with both keys.

Cheers,
Bill.