Hector Oron writes ("Bug#906317: dgit: consider demoting git-buildpackage to recommends"): > As I understood, DSA team had some concerns for security reasons since > porterboxes are meant to be used to debug package build failures and > not used for anything else, so it is much preferred a 'push' scenario > where developers push the code to porterboxes, rather than 'pull', > being `apt-get source` the unique exception to that unwritten policy.
That concern seems to be related to #790093 and the presence of dgit at all, rather than the Depends on git-buildpackage ? > So developers would like to use `dgit push` from porterboxes, however > getting that functionality also opens a can of worms, allowing for > pulls as well. This is probably out of context for this bug, but: I think developers ought not to run `dgit push' on a porterbox because that would involve exposing their private key (via gpg agent at least) to the porterbox. It would be better to run `dgit rpush' on their own machine. In practice do man people try to upload directly from a porterbox anyway ? I confess I haven't looked at what howtos etc. we provide to porters. Maybe we should have a `how to be a porter' guide which covers finding a machine, proper gitish source code management, BTS interaction, etc. (That would I think inevitably result in advising the user to run `dgit clone' on the porterbox for the same reasons that in a legacy source-package-based workflow they would say `apt source'. Hence the desire to fix #790093.) Ian. -- Ian Jackson <ijack...@chiark.greenend.org.uk> These opinions are my own. If I emailed you from an address @fyvzl.net or @evade.org.uk, that is a private address which bypasses my fierce spamfilter.