[debexpo-devel] Considerations about email addresses/features
Christoph Haas
email at christoph-haas.de
Wed Jun 4 17:28:16 CEST 2008
On Mittwoch, 4. Juni 2008, Jonny Lamb wrote:
> On Wed, Jun 04, 2008 at 04:20:03PM +0200, Michael Stapelberg wrote:
> > As talked about in IRC, I'm a bit concerned about the email address
> > which is shown on mentors.debian.org. Currently, it is based on the
> > user id of the PGP signature. However, I'm using plussing as an
> > anti-spam measure. That means I usually assign a short string for each
> > project/website which I can later revoke, for example
> > michael+mxallowd at example.net for my program mxallowd.
> >
> > Therefore, debexpo should parse the Maintainer:-line in the DSC-file
> > instead of using the PGP signature.
>
> I can't see any other place a maintainer's email address is shown apart
> from [0], for example. Please correct me if I'm wrong here.
>
> If I am correct, then yes, showing the true "Maintainer" field (from the
> changes file) will be used.
>
> In fact, not only did I not realise that the PGP key's email address was
> shown, but I don't know why it does that. Christoph, can you shed some
> light on this?
I'm afraid so. Yes, currently the signer of the changes file is taken as
the uploading maintainer. I wanted to change that a while ago to the
person mentioned in the "Maintainer:" field of the control files but that
was a mess. I don't think it's necessarily bad but often the addresses
were different and the "Maintainer:" was a mailing list or something. It
should be no problem to do that correctly from the start so that
maintainers use proper control files.
With optional authentication during the upload process the problem of
identifying the uploader will be gone anyway, right?
> > - Handling of lenny/etch-repositories (having identical lenny and etch
> > packages) isn't as convenient as it could be (one has to add the
> > package to "both" repositories)
>
> I don't think debexpo will be solve this. I'm not thinkit's a good idea
> to try and solve it anyway.
>
> I hate to say this, and Christoph will kill me for suggesting this, but
> have you tried running dak?
I won't kill you. But let me just contact Google so they can redirect the
cheque. :)
> It is an immensely powerful tool, but I
> think it's good at what it does and it might solve some of your issues.
> It's just a bit of a pain to set up.
Yes, I second that. For multiple repositories it's probably worth using
dak. Although I wonder if it's worth to allow multiple "queues"
or "repositories" in debexpo, too. So that I can e.g. provide certain
packages for Etch and Sarge in different paths. Jonny, do you think that's
worth it? Perhaps the apt-get'able URLs can be used to address a certain
repository?
http://mydebexpo.reposito.ry/apt-source/sarge
http://mydebexpo.reposito.ry/apt-source/etch
That might not even mean that you have to extend the database schema.
Perhaps just save whether a package was uploaded to "unstable"
or "caipirinha" and allow to query for packages of that distribution.
</2¢>
Christoph
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part.
Url : http://workaround.org/pipermail/debexpo-devel/attachments/20080604/813a4fd6/attachment.pgp
More information about the debexpo-devel
mailing list