path: root/meeting-logs/20051215.txt

Session Start: Thu Dec 15 13:20:24 2005
Session Ident: #gentoo-council
* Logging #gentoo-council to 'logs\#gentoo-council.log'
[13:20] <vapier> ...
[13:33] <SwifT> \\o
[13:33] <SwifT> \o/
[13:33] <SwifT> o//
[13:33] <SwifT> \o/
[13:33] <SwifT> and DANCE
[13:34] <solar> heh.
[13:34] * vapier stabs SwifT in the eye
[13:34] <solar> so topics for today include only us deciding on to enable SHA1 ?
[13:35] <solar> for portage. or was it all those hashing algos (like where he had 5 that overlapped) ?
[13:35] * SwifT needs to be informed again as to why we need to decide on that; isn't that Portage-specific?
[13:35] <SwifT> no, not the manifest2 one
[13:35] <vapier> i think he was looking for advice considering it isnt a trivial change
[13:35] <vapier> even though yes, it is pretty much a portage-only issue
[13:36] <vapier> infra OK-ed the extra temp overhead
[13:36] <solar> that and jstubbs votes for wait. genone votes for now.
[13:36] <solar> so portage team cant decide within itself
[13:36] <vapier> hmm, wasnt aware of that nuance
[13:36] <SwifT> whos portage lead?
[13:36] <solar> from what I gather
[13:36] <SwifT> ("who is the Portage lead" in correct English)
[13:37] <vapier> i dont think they have a real lead
[13:37] <vapier> they're a little commie group
[13:37] <solar> I dont think there is a 'lead' but jstubbs handles the portage releases.
[13:38] <SwifT> and he wants to wait...
[13:39] <solar> In his notes for 2.0.54 I know he expects that it will be SHA1+MD5
[13:40] <vapier> seems to me that the manifest2 thing will take sometime to implement while the SHA1+MD5 can be done now ?
[13:40] <SwifT> both take time to implement, but the sha1+md5 is less intrusive
[13:41] <vapier> the sha1+md5 is done afaik
[13:41] <vapier> genone just wanted some feedback as to whether to deploy it
[13:48] * Joins: marienz (i=marienz@gentoo/developer/marienz)
[13:55] * Joins: agriffis (n=agriffis@gentoo/developer/agriffis)
[13:55] * ChanServ sets mode: +o agriffis
[13:58] * Joins: jaervosz (n=jaervosz@gentoo/developer/jaervosz)
[14:00] * vapier sets mode: +o jaervosz
[14:00] <SwifT> *ding* *dong*
[14:00] <vapier> lets get this shindig going
[14:00] * Quits: Koon (n=koon@gentoo/developer/Koon) ("Leaving")
[14:01] <vapier> agriffis / seemant / solar / SwifT / vapier/ jaervosz ?
[14:01] <jaervosz> yeah, i'm here instead of koon who is taking care of his newborn
[14:01] <SwifT> yes
[14:02] <vapier> az for sure wont be here due to fuel crisis in south africa
[14:03] <vapier> but he has no proxy
[14:03] <vapier> seemant / solar / agriffis ?
[14:03] * agriffis is here
[14:04] <vapier> solar was active a min ago
[14:04] <solar> I owe him a proxy and todays meeting seems to be a brainstorming session
[14:04] * Joins: ciaranm (n=ciaranm@alpha.total-knowledge.com)
[14:04] <vapier> agenda today is Marius's request for decision on multihash support
[14:04] <vapier> http://article.gmane.org/gmane.linux.gentoo.devel/33434
[14:06] <vapier> for those who remember, infra a-ok-ed the additional overhead that any of the methods would require
[14:07] <seemant> hey guys sorry
[14:07] <seemant> I'm here
[14:07] <vapier> so that leaves us with 2.5 recommendation choices
[14:07] <vapier> (1) nothing should be done and we should wait for Manifest2 GLEP to be hammered out/approved/implemented
[14:08] <vapier> (2) the digests should be updated to start including/using SHA1 as well as MD5
[14:08] <vapier> (2.5) also include SHA256 and RMD160 hashes
[14:09] <vapier> the implementation for (2) is done, just not committed
[14:09] <seemant> 2.5 is my preference
[14:09] <SwifT> (2) is my preference with (1) being on the roadmap
[14:09] <vapier> (2.5) is a .5 because it adds overhead of requiring pycrypto
[14:10] <vapier> but pycrypto, being quite tiny and fast (i looked into it), isnt that big of deal imho
[14:10] <agriffis> vapier: from my reading of genone's message, it sounds like 2.5 and 2 are mostly the same thing, since 2.5 is optional and only happens if dev-python/pycrypto is installed.
[14:10] <seemant> that was my followup question
[14:10] <vapier> agriffis: hence the .5
[14:10] <SwifT> but I'm wondering why it wasn't added by the portage folks automatically... if they're afraid that the small overhead of the manifest files will hit them like thunderstorm and they want the council to take the heat, or if there's another reason
[14:11] <vapier> SwifT: there seems to be disagreement whether to go with (1) or (2) so they wish for outside advice
[14:11] <vapier> (1) seems to be going smoothly, it just looks like it'll take sometime for everything to fall into place
[14:11] <seemant> vapier: what are the rationales for disagreement
[14:11] <seemant> ?
[14:11] <vapier> you'd have to ask jstubbs and genone, neither of which seem to be here atm
[14:11] <vapier> mayhap solar knows
[14:12] <solar> Without genone here I would not feel right about trying to approve/disapprove anything on this topic.
[14:12] <agriffis> what's the reason for going with 2 or 2.5, btw, instead of waiting for the full Manifest2 GLEP?  My understanding is that it's very hard to compromise MD5, even with the recent discoveries.  So is the point of 2/2.5 to ward off people that are unhappy with portage depending on MD5?
[14:13] <agriffis> Is genone aware the meeting is happening now?
[14:13] <vapier> we've tried pinging him via e-mail/irc, but no luck
[14:13] <vapier> (2) can be done right now, no sweat
[14:14] <vapier> (1) will take time
[14:14] <SwifT> does (2) bring additional work on the ebuild maintainer's heads?
[14:14] <SwifT> not really does it?
[14:14] <vapier> no
[14:14] <vapier> repoman does it
[14:14] <SwifT> oh, I thought ebuild did that
[14:14] <vapier> agriffis: generating a collision with md5 is not hard
[14:14] <SwifT> does (2) bring additional work on the portage developers's heads?
[14:15] <vapier> no, (2) is done
[14:15] <vapier> genone has posted the patch which implements it
[14:15] <agriffis> okay, so g2boojum tells me that it's mostly a PR thing, because we've been advertising multi-digest for a long time but don't have it yet.  (2) gives it quickly, satisfying many people and letting the portage devs concentrate on Manifest2 without the additional pressure.
[14:15] <agriffis> (g2boojum didn't say all that, I added interpretation, etc)
[14:16] <SwifT> I mean for (1)
[14:16] <vapier> SwifT: yes, it's all in the GLEP
[14:16] <vapier> Manifest2 eats Manifest and digest files
[14:16] <SwifT> as far as I'm concerned, I only hear good things about the proposal (2), I honestly don't know why we need to approve anything on it
[14:16] <SwifT> so, I'm in favor of the proposal
[14:16] <vapier> SwifT: we're not approving, we're recommending
[14:16] <SwifT> oh ic
[14:16] <SwifT> :)
[14:17] <agriffis> SwifT: I don't think any of it, 1 2 or 2.5 is harder for devs.  Probably all devs will need to install the additional module to generate the SHA256 and RMD160 sums though, so that makes 2.5 a little harder to implement than 2.
[14:17] <vapier> yes, but we could just add pycrypto as a DEPEND to newer portage
[14:17] <vapier> as i mentioned, the overhead of the package is trivial, ignoring the fact that it's python
[14:17] <agriffis> vapier: so everybody would need it then?  any issue with export restrictions, etc?
[14:17] <solar> if it's going to generate SHA256 is there really any point in waisting the space in the tree with SHA1 ?
[14:17] <vapier> the more the merrier
[14:18] <vapier> we could ask for a 2.5.1: add SHA256/RMD160
[14:18] <vapier> agriffis: i do not know
[14:18] <agriffis> no, not true.  solar is right, there's no point putting in both SHA1 and SHA256, that's just extra lines in every manifest
[14:18] <vapier> i stay ignorant of export restrictions as i hate them
[14:18] <solar> he also includes metadata.xml
[14:19] <solar> that is also pointless. A while ago metadata.xml and ChangeLog were removbed from files that were supposed to be digested
[14:19] <vapier> first off, is everyone comfortable with making a recommendation ?  or would we want to get genone/jstubbs here
[14:20] <agriffis> vapier: I think we have enough questions that we're not able to recommend between the given options.
[14:20] <agriffis> (just stating my humble opinion, not speaking for everybody)
[14:20] <SwifT> I'd recommend that the Portage team can do whatever they want on the subject
[14:21] <vapier> i'm all for 2.5 followed by 1
[14:21] <vapier> seemant: how about yourself ?
[14:22] <agriffis> g2boojum would like to say something, is that ok?
[14:22] * solar sets mode: +v g2boojum
[14:22] * agriffis realizes he is a council member
[14:22] <vapier> g2boojum's always welcome to say something
[14:22] <agriffis> g2boojum: speak, man :-)
[14:23] <g2boojum> My read, from http://thread.gmane.org/gmane.linux.gentoo.devel/33434, is that the issue is about the relative merits of bloating the tree (temporarily), or waiting an unspecified amount of time for multi-digest to go in.  http://thread.gmane.org/gmane.linux.gentoo.devel/33434
[14:23] <g2boojum> Arghh.  Sorry about the double link.
[14:23] <g2boojum> The technical issues are already handled, except for the differences between (2) and (2.5), and I don't think the portage team cares all that much there.
[14:24] <jaervosz> is there any significant need for (2.5) over (2)?
[14:24] <agriffis> jaervosz: my question too
[14:24] <vapier> the hashes provided by 2.5 are thus far not "cracked"
[14:25] <vapier> the hashes provided by 2 are all "crackable"
[14:25] <jaervosz> why not take the simplest satisfactory solution until manifest2 is in place?
[14:25] <vapier> we're just hedging out bets on the idea that it's harder to "crack" multiple hashes simultaneously
[14:25] <jaervosz> but you'd have to provide a collision for both the md5 and sha1 checksums
[14:25] <vapier> yes, but we're still hedging our bets
[14:26] <vapier> and really, when it comes to computing SHA256 vs SHA1 on files in portage, the disk I/O tends to be more overheard than the additional cpu cycles
[14:27] <vapier> so how about this everyone, we say that 'if the reason they are looking for our feedback is the issues stated in http://thread.gmane.org/gmane.linux.gentoo.devel/33434, we recommend (#)'
[14:27] <vapier> that way if theres more underlying issues, we can get them to show up next meeting
[14:28] <vapier> that sit well with people ?
[14:29] <solar> my understanding is that he is asking for a decision vs a recommendation
[14:30] <SwifT> something like "can I can I can I? Please? Can I?"
[14:30] <vapier> give em a strong recommendation ?
[14:31] <agriffis> vapier: it's fine with me if that's the sentence to send back to them, are you going to take a vote on which number next?
[14:31] <solar> if you go back to th first mail on the topic he sent to the council. http://rafb.net/paste/results/NQH1vd21.html
[14:31] <vapier> that's ok with me
[14:31] <vapier> so shall we pool our cards and see what we got ?
[14:32] <vapier> (1) ? (2) ? (2.5.1) ?
[14:32] <agriffis> btw, I've checked wikipedia and it seems that we don't have to worry about export restrictions on these.  IANAL though ;-)
[14:33] <agriffis> vapier: referring to the link solar provided,
[14:33] <vapier> it's just a forward of the gmane ive posted
[14:33] <agriffis> I think the a-b-c-d choices are more explicit.
[14:33] <jaervosz> (2)2.5.1
[14:33] <agriffis> Not toward the bottom it isn't.
[14:33] <jaervosz> bahh forget that
[14:34] <vapier> agriffis: not really ...
[14:34] <vapier> (1/a) manifest2 (2/b) SHA1 (2.5/d) force sha256/rmd160
[14:35] <agriffis> vapier: well, there are 4 choices there ;-) and I like the distinction between c and d.  I think it's best for our recommendation to be one or the other, if either.
[14:35] <agriffis> vapier: ah ok, so you're just skipping c.  That's fine with me.
[14:35] <vapier> yes
[14:35] <agriffis> c seems pretty pointless
[14:35] <vapier> imo if we're going to do sha256/rmd160, half-assing it is a waste
[14:35] * agriffis nods
[14:35] <vapier> btw seemant called me ... he lost network at work
[14:35] <vapier> he said if it came together, he was pro 2.5.1
[14:36] <seemant> wow, back
[14:36] <seemant> thanks vapier
[14:36] <seemant> agriffis: left you a msg too
[14:36] <vapier> heh, well that was a waste
[14:36] <seemant> yeah, sorry
[14:36] <agriffis> seemant: I have my earphones in, I can't hear my lawn tractor nevermind my phone ;-)
[14:36] <vapier> i didnt hear my cell cause my acid trance was too loud
[14:36] <agriffis> hehe
[14:37] <vapier> so given the e-mail, what are people in favor of ?
[14:37] * vapier points at 2.5.1
[14:38] <seemant> "
[14:39] <agriffis> vapier: based on the idea that the manifests aren't going to take more space blockwise, I'd say 2.5.1 is fine (i.e. d, forced SHA256 / RMD160).  It would be nice to drop MD5 / SHA1 entirely, but dropping MD5 would break older portage.  It's possible though that dropping SHA1 would be cool.
[14:39] <vapier> that's the .1
[14:39] <vapier> 2.5 -> {SHA1,SHA256,RMD160}    2.5.1 -> {SHA256,RMD160}
[14:40] <agriffis> oh, I must have missed that.
[14:40] <agriffis> 2.5.1 is great with me then.
[14:40] <solar> I'm in favor of giving genone 1 slacker dev point for calling us in on the subject and not bothering to show up. Otherwise {SHA256,RMD160}
[14:40] <jaervosz> 2.5.1 is fine with me
[14:40] <vapier> SwifT: ?
[14:40] <SwifT> pfft
[14:40] <SwifT> (2) and (2.5.1) are both okay for me
[14:41] <SwifT> I mean, the 2.5.1 requires some additional work, no?
[14:41] <vapier> for portage devs ? no
[14:41] <SwifT> which could very well be spend to work on the Manifest2 stuff
[14:41] <vapier> it's done
[14:41] <SwifT> oh, it's just the python-package dependency then?
[14:41] <vapier> yes
[14:41] <solar> vapier: he has too much code in there.
[14:41] <SwifT> must've missed it, sorry
[14:41] <SwifT> 2.5.1 it is then
[14:41] <agriffis> if we try, we could manage to take an hour on this. :-)
[14:41] <vapier> any other points people wish to mention before we tag it & bag it ?
[14:42] <vapier> {it -> portage manifesting stuff}
[14:42] <solar> yank SHA1 and metadata.xml and it would seem fine to me
[14:42] <vapier> noted
[14:43] <seemant> let's {t,b}ag
[14:43] <vapier> {tea,bag}
[14:43] <vapier> anyways, the last note before people peace out
[14:43] <vapier> for those who have forgotten, the signing [preglep] stuff
[14:44] <solar> vapier: ChangeLog not listed in his example anywhere. But I'd say add that the to notes as well for something that should not be added to the hash file
[14:44] <vapier> i talked with robbat2, and imo, his e-mail thread he posted more than covered anything we need for a first step
[14:44] <vapier> shall we turn it into a running item for each meeting ?  current signing status ?
[14:45] <jaervosz> sounds like a good idea to keep the thing flowing
[14:46] <vapier> we'll call it an Action Item
[14:46] <vapier> each month needs a TPS report
[14:47] <SwifT> you mean PSR?
[14:47] <SwifT> Present Status Report
[14:47] <vapier> while sipping my warm cup of STFU
[14:47] <SwifT>  
[14:47] <vapier> pwnt
[14:47] <SwifT>  
[14:47] <vapier> all in all, a quiet meeting ... so i guess unless someone else wants something posted, lets call it a day ?
[14:47] <solar> stalled. robbat2 has some good ideas but portage team is not in favor
[14:48] <vapier> ok, so i'll poke robbat2 and genone some more about it
[14:49] <solar> Each of them have thier own methods. I'd still say step 1 is to make repoman force pkgs to be atleast signed. next step should be for somebody to code whats needed for eclasses and profiles
[14:50] <vapier> i thought manifest2 covered that, but i guess not huh
[14:50] <solar> no it does not.
[14:50] <agriffis> vapier: mtg is over, this is post discussion, right?
[14:51] <vapier> i think we can wrap it up solar ?
[14:51] <vapier> post the summary to gentoo-dev and we can expand upon current shortcomings there
[14:51] <solar> I'm done
[14:51] <vapier> k
[14:51] <vapier> agriffis: latesr
[14:52] <SwifT> I'm off; bye all
Session Close: Thu Dec 15 14:52:41 2005