Package: debian-cd Source: debian-cd Version: 3.1.17 Severity: important
# How to reproduce? Do as follows: 1. get the installation DVD 1 from [1]; 2. use it to install Debian, optionally selecting a mirror; 3. notice that the target's "/etc/apt/sources.list" has both "security" and "updates" distributions/repositories for the "contrib" component. If no mirror was selected, only "security" distribution/repository is enabled. # How often it is reproduced? For "security" distribution/repository, it is always reproducible. In the case of "updates" distribution/repository, it applies only if a mirror was selected. # Other information No test was made for other architectures, download methods (e.g.: jiglo), or media types/variants (e.g.: CD, netinstall). These assume that you did `git clone --recursive "https://salsa.debian.org/images-team/debian-cd.git"; && cd "debian-cd" `. ## Commits related to "contrib" component The following procedure was used to find what implemented "contrib" component: 1. use `git grep -Ei 'contrib' | sed -E '/(^|\/)(doc|info|man)|\.pot?:/d' `; 2. for each file, do a `git blame`, and look for related lines and corresponding commits that implemented "contrib" component; 3. checkout the previous from that commit (`git checkout hash~1`); 4. repeat from step 1 until there is no other match for that path; 5. do `git checkout master` and repeat from step 1 until there are no more paths matching the search for implementations of "contrib" component. This led to the following possibly problematic commits: Commit: e83ef58217c4f830ed12ecb314517818417c984d Date: 1999-11-11T17:10:37+0000 Note: "contrib" added for the first time. Commit: 916440cf9a265370facae13776213aefaa8a28d6 Date: 2002-12-07T10:22:40+0000 Note: makes the usage of "contrib" an opt-out. ## Commits related to popcon/popularity-contest The following procedure was used to find what added popcon/popularity-contest: 1. do `git log -p tasks/{,*/}popularity-contest* | less -I '+/contrib' +GN `, and take the coomit hash of the nearest line from above, to do so, type “?^commit”, Enter; 2. checkout the previous from that commit (`git checkout hash~1`); 3. repeat from step 1 until there is no other match for contrib on popcon. This results in the following list of possibly problematic commits: Commit: 8e74984498ffaff1d64fe125a5d09ca6d521c035 Date: 1999-12-27T23:11:18+0000 Note: adds popcon/popularity-contest which by default takes the most used packages, which as of today takes stuff from "main" and "contrib". # Possible list of affected paths The possibly related files, across all iterations of the steps from the procedures described earlier are as follows: tasks/*/popularity-contest tasks/popularity-contest* tasks/README CONF.sh tools/apt-selection tools/create_control tools/generate_di_list tools/grab_source_list tools/make_disc_trees.pl tools/sort_deps tools/start_new_disc tools/which_deb update-cd # Possible affected versions Based on the fact that the commits found date back to 1999, version tag 3.1.17, from 2015, was selected, since it is the oldest one which is still present in the pool ([2]). # Rationale and suggestions All in all, due to the way that which the DVD/CD process is done as of today, the inclusion of the packages that came from "contrib" also inserts this repository on the target's "/etc/apt/sources.list" since the apt-setup source package sees the list of sources. The reasoning for reporting this is that, according to the Debian Policy Manual, only the "main" component is part of Debian distribution ([3], [4]), while "contrib" is not ([5]), so the target's "/etc/apt/sources.list" should reflect that. Possible solutions include: a) make "contrib" an opt-in (instead of the current opt-out), and use opt-in for the Debian-provided media; b) move this bug to Debian Policy team so that the "contrib" component is also considered as part of the Debian distribution; c) since the only package that is currently fetched is "iucode-tool", find a way to detect which processors would need "iucode-tool", and ask for the user themselves to insert an extra media with the firmware, and only use that during install; d) remove "contrib" from popcon/popularity-contest. # References [1]: https://get.debian.org/images/release/current/amd64/bt-dvd/debian-11.0.0-amd64-DVD-1.iso.torrent . [2]: https://deb.debian.org/debian/pool/main/d/debian-cd/ . [3]: https://www.debian.org/social_contract#guidelines , search for “Works that do not meet our free software standards”. [4]: https://www.debian.org/doc/debian-policy/ch-archive#the-main-archive-area . [5]: https://www.debian.org/doc/debian-policy/ch-archive#the-contrib-archive-area . -- * https://libreplanet.org/wiki/User:Adfeno * Ativista não advogado, nem técnico de informática * Compre dos vendedores locais * Use e contribua ao software livre (diferente do gratuito) * Enviando docs.? Use OpenDocument. Outros tipos: vide endereço anterior * Use XMPP (federado, pai do WhatsApp) * E-mails assinados com OpenPGP (anexo "signature.asc")
OpenPGP_signature
Description: OpenPGP digital signature
