Hi, Unfortunately I am not able to get a timely reply from SPI's legal counsel advising us about the AWS and Azure marketplace agreements, due to factors outside of SPI's control. (We discussed it in a March phone call and I promptly sent over the agreement texts that evening.) But I think we should proceed anyway.
The risks to SPI and Debian of proceeding despite concerns over the indemification language, nonzero as they are, are comparatively small in practice when we consider the realpolitik / public-relations implications of possible litigation scenarios. For those who haven't been following, the TL;DR is that any lawsuits against Amazon for the Debian images which Debian publishes in the AWS Marketplace might give Amazon the contractual right to involve SPI, including covering their legal fees and any damages owed. Likewise for Azure. Small risk in practice for cases which wouldn't appropriately involve Debian/SPI anyway. By contrast, the disruption to Debian's cloud image publication plans from waiting long enough to resolve these questions would be definite, significant, and near-term in light of the imminent release of Debian 10 "buster". Therefore, given the long delays so far, in my mind the tradeoffs weigh in favor of taking a risk and signing the agreements as they are. If this worries any SPI directors, the DPL, or members of the Debian cloud team, please reply to this message sharing those concerns - drop [email protected] from the recipient list if you do not want your concerns to be publicly archived, but please keep [email protected] and preferably [email protected]. Please send any concerns by end of day UTC on Friday, April 12. In the absence of any blocking concerns by then, I will reply here that evening (Montreal time) or weekend giving the all-clear for whoever is going to do the technical work to create the AWS and Azure accounts as required, in a self-service online manner under the standard terms and conditions. I or another SPI debit card holder can be involved as necessary to get past "you must provide a debit card" hurdles, assuming my email archives already show DPL approval or assuming the DPL gives his approval. The separate discussion about where to point the upcoming debian-cloud-accounts@ alias in the spi-inc.org domain can continue in parallel, in the other thread. - Jimmy Kaplowitz [email protected]
