18:00:46 #startmeeting FESCO (2013-12-11) 18:00:46 Meeting started Wed Dec 11 18:00:46 2013 UTC. The chair is mattdm. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:00:46 Useful Commands: #action #agreed #halp #info #idea #link #topic. 18:00:50 #meetingname fesco 18:00:50 The meeting name has been set to 'fesco' 18:00:54 #chair abadger1999 mattdm mitr mmaslano notting nirik pjones t8m sgallagh 18:00:54 Current chairs: abadger1999 mattdm mitr mmaslano nirik notting pjones sgallagh t8m 18:00:59 #topic init process 18:01:00 * abadger1999 is here 18:01:03 hello! 18:01:04 hello 18:01:06 .hellomynameis sgallagh 18:01:08 sgallagh: sgallagh 'Stephen Gallagher' 18:01:13 * nirik is here, but also in the f20 blocker review meeting. 18:01:21 hi mattdm. did you add ticket 1201 to the agenda today? 18:01:28 hi 18:01:37 jwb yes i did 18:01:42 mattdm, ok, great 18:01:43 why, hello there. 18:02:02 jwb it's item #2 18:02:12 cool 18:02:31 * pknirsch lurking 18:02:43 Hello 18:03:29 okay that's almost everyone :) 18:04:17 * mattdm gives notting another 30 seconds 18:04:23 oh, sorry. yes, i'm here. 18:04:27 oh hi :) 18:04:33 #topic #1185 Enable "-Werror=format-security" by default 18:04:50 .fesco 1185 18:04:52 mattdm: #1185 (Enable "-Werror=format-security" by default) – FESCo - https://fedorahosted.org/fesco/ticket/1185 18:05:12 we actually also have another ticket on this 18:05:19 .fesco .1210 18:05:20 mattdm: An error has occurred and has been logged. Please contact this bot's administrator for more information. 18:05:29 .fesco 1210 18:05:30 mattdm: #1210 (F21 System Wide Change: Format Security - https://fedoraproject.org/wiki/Changes/FormatSecurity) – FESCo - https://fedorahosted.org/fesco/ticket/1210 18:06:07 the second one, as i understand it, just asking for a copy of of the final resolution of the first 18:06:13 jreznik is that right? 18:06:54 I think the second one is actually just following the process we should have been using from the start. 18:07:03 Since this is pretty clearly a System-Wide Change 18:07:21 the first one is reopened because people are asking us to not approve it by default. 18:07:27 okay, fair enough. 18:08:07 so what are the proposals here? 18:08:09 #proposal: Add the flag to rpm config only as -Wformat-security 18:08:26 (i. e.) not use -Werror=format-security 18:08:27 -1 18:08:27 -1 at this point. What data do we have? 18:08:57 I've seen at most 3 instances of correct code broken by the flag so far 18:09:13 -1 18:09:18 and about 3 (loud) people complaining 18:09:42 mitr: thank it's not working properly 18:09:42 to be clear, we are talking about F21, not something that will impact F20 at all. right? 18:09:48 t8m: +1 18:09:58 mmaslano: Sorry, I can't udnerstand 18:10:05 mattdm: correct, this is rawhide/f21 only 18:10:07 (and as a matter of philosophy, if we are ever going to move to more testing automation, as we IMHO absolutely must, then there will be more "you must fix this" bugs and it's OK to move in that direction) 18:10:13 I have to agree with the so called "loud people" that -Werror anything is not a good idea for general distribution build flags 18:10:17 mattdm: sorry, re-reading 18:10:25 mitr: maybe I misread you 18:10:41 about 30% of them are already fixed. 18:10:58 Just checking. in that case I am -1 to t8m 18:11:35 mattdm, sgallagh: yes, it's just to follow the process - copy resolution there and I'll be more than happy with it! 18:11:37 and some of the packages are being dropped as we speak (which is a good thing from security POV) 18:11:46 mmaslano: There is a lot of code (~400 packages) that is suspect. There may be quite a few actual security bugs. I've seen very few packages actually broken by the flag, and there are workaround possible (if nothing else, locally overriding the flag). So on balance, this seems worth it to me, given the limited information I've seen so far. 18:11:50 fixed = workarounded as correct code does not need fixes 18:11:53 halfie: dropped because of this??? 18:12:10 notting, no, in some cases the upstream went dead. 18:12:33 halfie: ok. seemed extreme to drop b/c of this 18:12:42 notting, heh, yeah :-) 18:12:55 mitr: are the three cases of correct code broken fixable? 18:13:31 notting, not that they aren't fixable but sometimes upstream wouldn't accept the "fix" of correct code 18:13:56 t8m: Then we carry patches 18:13:57 mitr: imho it's bad to force flag, which break some packages even few 18:14:01 notting: printf(x) => printf("%s", x) would work for all of them 18:14:13 mmaslano: 400 packages to benefit, _and all future packages_ 18:14:42 mitr, sometimes no benefit 18:14:48 mitr, just additional workarounding 18:14:54 and updates of current packages. 18:15:02 I don't think we need to discuss this further 18:15:08 I certainly don't 18:15:26 with all the other distros already doing this, I don't see upstreams rejecting fixes. 18:15:26 t8m, "unzip" upstream is one example. they wrote 50+ lines to explain why they won't fix it. in my opinion, they are being too stubborn about it. it never too late to learn "defensive" coding practices. the patch is around 8 lines IIRC and is trivial. 18:15:27 Ok, a simple vote then? Error vs Warning? 18:15:41 sgallagh, please 18:15:51 halfie: really? wow. 18:15:54 t8m: Suppose a provenpackager were to fix all packages where the maintainer hasn't done so; would it be acceptable to you? 18:16:00 halfie: people told me, they would like to see examples how to fix it. Preferebaly on feature page or in bugs 18:16:14 nirik, their forum post is actually pretty funny. will post a link later on. 18:16:21 mmaslano: there is a FAQ for C; not sure about C++ 18:16:23 halfie: sure, thanks. 18:16:27 mitr, I don't really care 18:16:27 Proposal: We add -Werror=format-security by default. (A -1 indicates that we will add -Wformat-security instead) 18:16:40 mmaslano, sure, I can work on it. I did add an example last week (about Qt related fixes). 18:16:40 +1 18:16:42 +1 18:16:44 +1 18:16:45 sgallagh, -1 just for record 18:16:45 mitr: if it was so obvious to get it, they wouldn't ask 18:16:46 +1 18:16:51 still -1 18:16:52 sgallagh: +1 18:16:57 #agreed We add -Werror=format-security by default. (A -1 indicates that we will add 18:17:00 #undo 18:17:00 Removing item from minutes: 18:17:01 +1 18:17:03 mmaslano: some of the maintainers really don't know the programming language AFAICT 18:17:15 sgallagh: +1 18:17:15 t8m: "we must keep all packages building as they are unchanged" would really be new. In some sense desirable, but really new. 18:17:29 #agreed We add -Werror=format-security by default. (A -1 indicates that we will add -Wformat-security instead) (+7,-2) 18:17:33 mitr: the complain wasn't from those who can't program ;-) 18:17:55 okay. dissent respectfully noted, vote made, moving on. :) 18:18:02 #topic #1201 Enabling third party repositories 18:18:18 ping jwb 18:18:24 .fesco 1201 18:18:25 mattdm: #1201 (Enabling third party repositories) – FESCo - https://fedorahosted.org/fesco/ticket/1201 18:19:15 abadger1999 do you want to lay out the current state here? 18:19:35 * jwb is here 18:19:55 jwb's comment is a good starting point to where we are: https://fedorahosted.org/fesco/ticket/1201#comment:28 18:20:26 I think 1. in abadger1999's last comment is worth bringing to a FESCo vote. 18:20:46 pasting: 18:20:48 The questions that remain are: 18:20:50 Y) Can COPRs be searched for packages without the .repo files being installed. Pending FESCo. 18:20:52 Z) Is there some FESCo jurisdiction required for item 3 above, or does that all fall directly to Fedora Legal and the entity requesting review? (E.g. if Legal approves flash-plugin based on a request from Workstation, Workstation can then include that/make it discoverable) 18:21:18 we should try to vote on Y today. 18:21:42 and for the sort of clarity my 7-year-old asks for, that's "may COPRs be searched", not the technical question of "can they" 18:21:59 correct 18:22:00 mattdm: Searched how? 18:22:14 To me that answer is clearly yes in the general sense. we let people search in firefox for whatever they want. 18:22:23 and it would be crazy to suggest otherwise. 18:22:39 and I don't see why we'd forbid people from searching in something that's part of the project 18:22:39 my problem with Y would still be some of the same infrastructural problems 18:22:47 (signing, deployment, etc.) 18:22:51 jwb: Does that question mean something more like "Can gnome-software query COPRs without copr .repo files installed?" 18:22:52 obviously people can search manually 18:22:56 sgallagh: For Y, last week you asked that we defer while rhughes and msuchy had talked about it. 18:23:21 I did, and that conversation had stalled while msuchy got out the new version of COPRs that launched today 18:23:22 sgallagh, s/gnome-software/an application 18:23:27 k 18:23:33 jwb: That was a representative example, not exclusive 18:23:39 mattdm, +1 I agree 18:24:29 I think that if the UI is like spot suggested (such searching tells user's explicitly when they are getting software from something that is not "Fedora") I'd be okay with this. 18:24:53 abadger1999: Care to phrase that as a proposal? I'd be in favor of that. 18:24:59 abadger1999 +1 18:25:00 if the searching was transparent then I'd agree with notting's view. 18:26:39 * mattdm waiting for proposal 18:26:46 i would really really like some sort of per-copr signing for any set of repos that we put search code for in fedora 18:26:55 Proposal: Copr repos may be searched for applications to install as long as the user is explicitly asked to enable the copr before installing packages from them (See https://fedorahosted.org/fesco/ticket/1201#comment:19 for details) 18:27:36 abadger1999: +1 18:27:36 notting: that btw only works if copr is served over https or the Fedora search code includes the public key (but copr signing is a research in progress, not to arrive in the next month AFAIK) 18:27:42 abadger1999, +1 18:28:16 I guess with what notting says, I'm, like, +0.75 for abadger1999's proposal. Warnings like "enabling this will make you insecure!" don't really help end users. 18:28:25 the asking there could include "are not signed, may go away, etc" I assume? 18:28:25 notting: That would be preferable, yes. I'm viewing it as an implementation detail, though 18:28:31 * abadger1999 notes that on the copr signing front, there is this infra thread: https://lists.fedoraproject.org/pipermail/infrastructure/2013-December/013741.html 18:28:51 there's apparently an obs signing thing. I don't know how it works off hand tho. 18:28:57 mattdm: a warning like "you are deciding to trust a different party now" IMHO do 18:29:03 Looks like a lot of work. Not something currently on the roadmap. 18:29:14 mitr: Right, which is no worse than how our competitors work. 18:29:21 I wouldn't hold copr searching for the signing to work 18:29:26 Usually they give you the option to trust once or always 18:29:36 nirik: I'm not really enthused about having to manage a third signing infrastructure... 18:29:48 yeah I guess I will round up to +1. but I *would* like to see signing accelerated as a priority if *this* is a priority 18:29:50 sgallagh: {once, limited time, forever} has been a pretty good model for su on my phone 18:30:01 pjones: Exactly 18:30:21 mattdm: yeah, likewise, +1 but I'd like to see signing escalated as a priority 18:30:21 Do we have _anybody_ plannign to point to coprs btw, or is this all about proprietary software hosted elsewhere? 18:30:22 abadger1999: me either. 18:30:42 #info FESCo would* like to see signing accelerated as a priority if searching COPRs is made a priority 18:30:51 #undo 18:30:51 Removing item from minutes: 18:30:53 sigul isn't really an option here either, IMHO 18:30:56 #info FESCo would like to see signing accelerated as a priority if searching COPRs is made a priority 18:31:08 sgallagh, priority or possibility? 18:31:16 because afaics, you're only deciding the latter 18:31:33 Semantics :-/ 18:32:10 I think it's a good clarification. 18:32:11 well, and 'would like to see' doesn't implement anything, but sure. ;) 18:32:26 sgallagh, not really. "priority" is nebulous. priority to whom? FESCo? the people writing search software? 18:32:41 are the latter going to even tell FESCo if this is permissible? 18:32:44 doubt it 18:32:55 abadger1999: 0 18:33:14 so I *think* we have +5 for and one 0. 18:33:19 * mattdm scrolls back to count more 18:33:30 #undo 18:33:30 Removing item from minutes: 18:33:30 sgallagh: I think s/priority/possibility would be a good clarification. 18:33:53 abadger1999: s/priority/possibility/g or just one of the two in that sentence? 18:33:55 mattdm: I think you're one short... 18:34:02 jwb I think it means we will nicely ask the people working on COPRs and mention that it's important. 18:34:29 mattdm, that's fine. then just say that if this is voted as permissible 18:34:37 I think I'm a +0.75 too. 18:34:47 sgallagh, I think that the second one should be changed only 18:34:47 you can round me up to +1 to make it +5 18:34:55 abadger1999 :) 18:35:37 any other votes? 18:36:03 votes for signing would be nice? 18:36:06 sure +1 18:36:31 sure, signing and unicorns for all. 18:36:32 mmaslano: Signing as mandatory or signing as nice-to-have? 18:36:32 jwb: Are there any plans about actually pointing to coprs? 18:36:52 nice-to-have... 18:36:59 #agreed Proposal: Copr repos may be searched for applications to install as long as the user is explicitly asked to enable the copr before installing packages from them (See https://fedorahosted.org/fesco/ticket/1201#comment:19 for details) (+6,-,0) 18:37:01 mitr, not to my knowledge. they came up as a weird case of 3rd party repo 18:37:01 nirik: given that the warning could be "by enabling this repo you are entrusting it with the full security of your machine and all its data" 18:37:05 #info signing and unicorns for all 18:37:15 mmaslano: I don't think anyone disagrees that signing would be nice. 18:37:22 Then I kind of don't see what the fuss is about... 18:37:50 mitr: The OpenShift (or was it OpenStack?) guys wanted that as an option 18:37:52 mitr whether it's _nice_ or _required_, I think. 18:37:52 notting: securly signing things is not an easy thing. ;) 18:38:15 mattdm: If it weren't used, then conditions on its implementation would be irrelevant 18:38:18 sgallagh: ah, ok 18:38:31 sgallagh: signing in an automated and sane fashion here is an issue. anyone can manually download their stuff from coprs and make a properly signed repo, of course 18:38:41 more on this or should we go on to the next sub-question? 18:38:46 darn you unattended processes 18:38:58 notting: I'm aware of the issues, but I think we should not try to engineer the solution in this meeting 18:39:12 sgallagh, +1 18:39:40 the next question, jwb's "Z" is broken down by abadger1999 thusly: 18:39:46 1, 2, 3, and Y seem accurate to me. Z seems accurate but incomplete. I think there's three questions: 18:39:48 (spot) Does FESCo/Board want us to be able to point to non-free, legally permisible repos? 18:39:50 (toshio) Do we want to further limit what repos are permissible over and above what's legal? 18:39:52 (jwb) Who decides what's permissible under #2? 18:40:07 so: first, "Zspot".... 18:40:14 i'll note question 1 is not quite accurate 18:40:30 jwb okay please rephrase 18:40:30 or that it should be further subquestioned 18:41:02 1) Does FESCo/Board want us to be able to point to legally permissible repos? 1b) legally permissiable repos containing non-free content? 18:41:25 it is certainly possible to have a specific 3rd party repo contiaining free software 18:41:29 so it should be considered in the question 18:41:38 jwb ah, yes. 18:42:12 though if you just remove non-free from the question as toshio posed it, his question 2 would likely cover it 18:42:16 At the risk of sounding pedantic, how are we definining "point to"? 18:42:17 * notting notes there is an alternate proposal in one of the WGs that explicitly bans 1b) 18:42:34 sgallagh, discoverable/searchable. in the same manner you just decided for coprs 18:42:44 notting, there is? 18:42:55 notting, which WG and does that WG override other WGs? 18:43:13 I think I'm +1/+1 here. 18:43:27 0 this is a Board matter IMHO 18:43:32 This is a place where Ubuntu users have been able to tweak our noses for far too long 18:43:52 I can be +1, +1 as well although it looks to me like questions for Board 18:44:11 +1/+1 18:44:14 jwb: ". Fedora will not include any non-free software by default, host any non-free software in our repositories or link to third-party repositories containing non-free software." <- from mjg's proposal 18:44:15 For 1a (legally approved third-party free software), I think it's roughly the same as COPRs, although a little more out of our control. I'm okay with it with the same kind of warnings as with COPRs. 18:44:43 notting, that proposal is just that. a proposal 18:44:49 for 1b, I have serious reservations. I don't think it's really in line with Fedora's mission. 18:46:03 Since I think this is probably a lot about kernel drivers, I'd also like to hear with kernel team / jwb thinks from a purely technical point of view. 18:46:31 mattdm: At the end of the day, is it our mission to leave our users to fend for themselves for common needs, though? 18:46:31 mattdm: i suspect it's 1) kernel drivers (inc. nvidia) 2) chrome 3) steam 18:46:32 mattdm: I'll note that such drivers only qualify under 1b under a ... highly questionable interpretation. 18:47:01 notting, 4) matlab 5) lotus notes 6) 18:47:07 7) Flash... 18:47:11 mattdm: Purely technically we are not responsible for the user's machine working if we are not the only software there, and as for preventing the user from installing other software, "plenty of rope" I suppose 18:47:17 A point of clarity, I'd change "want" in all of the various versions of question (1) to "wish to allow". But I think we're all on the same page there. 18:47:21 these are all just examples of a specific 3rd party repo, yes 18:47:22 jwb: heee. fedora matlab repo. 18:49:18 i'm happy to discuss technical relevance of kernel drivers elsewhere, but this question is not limited to that and my opinion from a kernel perspective should not be under consideration for a general question 18:49:34 +1 to (1a). I'll push for limiting it in answering (2). 18:49:35 given jwb's questions, i would be +1 to 1) and -1 to 1b) 18:49:37 Every time a user hears "We don't ship that because it's not Free", they usually translate it to "We don't offer you what you need, so you should go elsewhere" 18:50:04 I'd also be +1 to 1) and -1 to 1b) 18:50:05 * nirik is also +1 / -1 18:50:06 sgallagh, we still aren't shipping it :) 18:50:16 jwb okay fair enough. But *if* we were to accept this I want to make sure technical concerns get a voice as well as the legal (and moral) ones. 18:50:23 jwb: Poor phrasing, but you took my meaning 18:50:27 mattdm, entirely fair 18:50:34 mattdm: ack 18:50:38 I'm really unsure what I want to vote on 1b. 18:50:44 sgallagh: that's one hell of a shitty reason for abandoning our principles. 18:50:44 sgallagh, i did. just making sure people don't suddenly think we're shipping things here 18:50:56 i can see the value in making it easier for users to get third-party software that can work on fedora, but i don't think fedora shipping repo links to third party repos is it 18:51:07 notting +1 18:51:20 notting: yeah, I think that might be fair. 18:51:39 pjones: There's an old question: "Is it more important to be correct... or loved?" 18:51:43 pjones: I don't think the Free Software principles are not supposed to be good Just Because; they are supposed to be good as a _means_ to benefit actual people as they exist in the real world. 18:51:54 notting: note -- afaiui, this is also about the search tool rather than a direct repo link. But that might be splitting hairs. 18:52:02 abadger1999, correct 18:52:17 since the search tool will hide that distinction a bit. 18:52:20 need to be careful with what "repo link" means i guess. it is not installing a disabled .repo file 18:52:24 mitr: There are certainly people who would disagree with that assertion, but I am not one of them 18:52:25 For 1b, I think this is very much about Fedora's identity and mission. That can be reshaped, but I think this has to be -1 unless it *is* reshaped as part of a bigger conversation. 18:52:47 I'm not afraid of the bigger conversation, but this isn't the way to do it. 18:52:55 mattdm: Okay, I can agree with that -- so would that then become definite Board territory? 18:52:56 mattdm: Flock session? 18:54:11 I'm not saying FESCo shouldn't participate and have a voice, but I think it's bigger than a FESCo technical vote. 18:54:28 FESCo is always free to push up to the Board and submit a recommendation at the same time 18:54:32 if gnome-software (or fedora, via gnome-software) hosts a program where third-party vendors can submit their own repos to be registered in some online registry/app store that's maintained and curated, and fedora tools can call out to search it, that seems more workable. but it involves essentially an ISV program, security contacts, etc. etc. 18:54:59 After the F20 release, we have a lot of Fedora.next to talk about, and I'm entirely happy to include this as part of that. 18:55:22 is there something about the F20 release gating you from talking about it now? 18:55:37 notting: I could be okay with that implementation -- but I think it would be an additional idea separate from deciding on this question. 18:56:08 notting: re: security contacts, AFAICT we have a lot of choice in what do we promise to deliver. Historically Fedora has been a "one stop shop for all your security guarantees" but that's not strictly speaking something we are unavoidably required to do for others 18:56:10 abadger1999: yes. just trying to describe, since i'm -1 to 1b) as stated, something i could potentially be in favor of that serves that purpose 18:56:12 jwb business? 18:56:14 18:56:19 busyness I mean :) 18:56:33 I mean, not just me, but everyone. 18:56:54 * mattdm is counting votes 18:57:42 * jwb doesn't think people will be less busy after the F20 release, but ok 18:59:25 notting, were you +1 to 1a? 18:59:56 mattdm: yes 19:00:44 mitr are you 0 on both? 19:01:01 mattdm: 0 "please ask the board", yes. I would vote if this were a +4/-4 situation 19:02:34 mattdm: I'll vote +0 on 1b as well to make your numbers come out 19:02:38 that leaves us at +8/_/1 for 1a) and +3/-4/2 for 1b) 19:03:33 which would seem to mean 1a passes and 1b does not 19:03:40 yep. 19:04:12 and should someone disagree with this, they can escalate to the Board? or is FESCo sending this to the Board as a recommendation? 19:04:59 I think we should send 1b to the Board w/ a recommendation. 19:04:59 jwb: sure! 19:05:04 abadger1999: +1 19:05:04 jwb, I think we're saying it, and the board would be the natural escalation point. 19:05:10 I like mattdm's statement of the problem. 19:05:39 * mattdm is trying to write this up in agreed form but keeps getting distracted. :) 19:05:43 mattdm, so the ruling is official unless the board disagrees? i'm asking for clarification 19:05:55 well... okay -- I'm not sure if we can agree on a recommendation as well -- but i think that mattdm's phrasing of the problem is what we want to send to the Board. 19:06:09 apparently i'm not the only one that needs clarification 19:06:13 jwb: Yes, I think that would be accurate. 19:06:24 okay yes let's have some clarification :) 19:06:27 jwb: aren't all fesco rulings official until the board disagrees? 19:06:38 notting, except the ones FESCo punts 19:06:43 notting, which is at time, unclear 19:07:10 so i'm asking if this is a ruling or recommendation i guess 19:07:36 how about we do it this way -- we'll assume the "0" votes are basically "punt" 19:07:38 I think I'd say status quo is that no non-free repos are pointed to and we have not changed that. 19:07:56 does anyone want to change their + or - vote to a 0? 19:08:53 mattdm: I don't think that will get us to 5 votes for any of the alternatives 19:09:19 mitr yeah but you don't need 5 votes to not pass :) 19:09:54 mattdm: => adopting this procedure implies being silent on the issue, doesn't it? 19:10:03 I'm going to do an agreed for the first part. 19:11:38 #agreed FESCo is okay with pointing to legally-permitted free software repositories (+8/-0/1) 19:11:45 (is that correct?) 19:12:12 might want to clarify they need to be approved by Fedora Legal 19:12:34 so we don't get arm-chair lawyers declaring something legally permissible 19:12:36 #undo 19:12:36 Removing item from minutes: 19:12:50 #agreed FESCo is okay with pointing to free software repositories approved by Fedora Legal (+8/-0/1) 19:13:22 mattdm: Also -- "in the same way as copr repos" 19:13:30 sure 19:13:32 #undo 19:13:32 Removing item from minutes: 19:13:53 #agreed FESCo is okay with pointing to free software repositories approved by Fedora Legal in the same way as COPR repos (+8/-0/1) 19:14:39 for the second part, since we didn't have enough votes for a clear statement either way, maybe vote on a statement to send to the board? 19:15:13 i'd be ok with a simpler "No. If you think policy should change here, talk to the board." 19:15:18 but that may not pass either 19:15:26 I'd be for that. 19:16:25 I'd be as well 19:16:27 okay in order to get things moving let's vote on that. 19:16:32 notting: I'd be okay with that -- and then we could be CC'd to the Board ticket/discussion to clarify what we would like addressed at the Board level (if it goes there) 19:16:38 +1 19:16:44 +1 19:16:48 * nirik is also ok with that. 19:17:37 that's 6? 19:17:59 wording: For non-free sofware repositories, FESCo is not changing exisiting policy. If you think the policy should change, talk to the board. 19:18:05 any other votes? 19:18:12 +1 19:18:16 +1 19:18:28 (though notting already counted me in his six) 19:18:37 +1 19:18:43 +1 19:18:52 +1 for clarification 19:18:58 * notting was implying +1 for himself 19:19:06 #agreed For non-free sofware repositories, FESCo is not changing exisiting policy. If you think the policy should change, talk to the board. (+9,-0,0) 19:19:14 lookit all that agreement 19:19:37 thank you all for your time and consideration. this ticket has been rather involved. 19:19:47 there are some further subquestions too.... 19:20:01 I think this has sort of decided some of them implicitly 19:20:27 it has 19:20:27 I think at this point if there are subquestions, maybe they should be rephrased with our decisions today in mind. 19:20:39 And if somebody wants to do that, then we'll consider them. 19:20:58 yeah, i consider the two decisions here basically covering the other 2 subquestions. partially because i rephrased the original question 19:21:01 Yeah okay unless anyone objects I'm going to info that and move on. 19:21:07 mattdm: Please do 19:21:10 The subquestions are: can non-legal reasons be used to evaluate other third party repositories? 19:21:19 Who does the evaluation? 19:21:30 I kinda object... 19:21:38 okay holding off. 19:21:46 I don't think we've got a firm policy until those are answered. 19:22:14 I think the answers are 1) Yes. and 2) FESCo, or working group as delegated by FESCo. 19:22:23 mattdm: i'm +1 to that 19:22:29 i think the answers are Yes and Fedora Legal 19:22:29 1) +1 19:22:47 there were no qualifications given on 1a other than "approved by Legal" 19:22:47 2) Fesco and Fedora Legal. 19:23:09 if you want to make this simple, say FESCo and Fedora legal to 1a 19:23:31 Well, I did write: +1 to (1a). I'll push for limiting it in answering (2). 19:23:50 which is backwards 19:23:58 because now you have to change your answer to 1a 19:24:11 jwb abadger1999 ooh. I see the ambiguity now. :) 19:24:26 jwb: well, not really -- 1a was "Do we wish to allow other repos of free software" 19:24:31 seriously, make this simple for yourselves. revote that the qualifications on 1a are "approved by FESCo and Fedora Legal" 19:24:42 this is answering the question of "which repos of free software" 19:25:13 * nirik is +1 with jwb. 19:25:45 jwb: +1 19:25:56 Proposal: Repos must be approved by FESCo and Fedora Legal. Currently, FESCo and Fedora Legal are not limited in the criteria that they can choose to apply. 19:26:00 I'm good with either because I think the end result is the same. this will make the meeting minutes confusing though :) 19:26:26 abadger1999: I don't really see this as different from what we said earlier, but ok. +1 19:26:36 mattdm, the minutes are less important than the actual decisions (that should be) documented on the wiki 19:26:53 sgallagh, earlier you just said Legal had to approve. not even brough to fesco 19:26:59 jwb agreed 19:27:04 abadger1999: reasonable. +1 19:27:10 sgallagh: well... I guess it could just be a clarification... the thing is that many times when we say "Fedora Legal" we mean "is it legal?" and in this case I want to be clear that we mean more than that. 19:27:11 +1 19:27:12 I don't really see the need for FESCo approval 19:27:34 If anything problematic appears we can explicitly reject it 19:27:43 so +0 19:28:00 t8m: I could be okay with that too. Whichever will get the voting done with least objections. 19:28:19 +1 to any of these too 19:28:31 I'm seeing +4 for abadger1999's proposal 19:28:44 I kind of hate this 19:28:51