Tuf: post a Debian RFP (Request for Package)

[adrelanos]

This is a formal step that should be done to get software packaged for Debian.
(Related: #259 #129 #262)

More info on RFP:
https://wiki.debian.org/RFP

Example RFPs:
https://www.debian.org/devel/wnpp/requested

The purpose of this ticket is to write a draft and to post it on the Debian tracker.

[adrelanos]

Here is a proposal.

Header

This is what I suggest as the header.

* Package name    : python-tuf
   Version         : 0.99
   Upstream Author : Name <[email protected]>
* URL               : http://theupdateframework.com/
* License         : BSD
   Programming Lang: Python
   Description  : Like the S in HTTPS, a plug-and-play library for securing a software updater

Who is the upstream author? I mean, who's name can replace Name <[email protected]>? And who's e-mail address can be used in this non-encoded form?

License is correct? Any else that needs fixing?

---

Body

A more detailed description belongs into the body.

I suggest, we leave out the current progress (#259) in the original post. Mixing the request with technical discussion seems wrong. We can add separate mail were we discuss technical progress.

TUF (The Update Framework) helps developers secure their new or existing software update systems. Software update systems are vulnerable to many known attacks, including those that can result in clients being compromised or crashed. TUF helps solve this problem by providing a flexible security framework that can be added to software updaters.

TUF is [currently being / will / might soon?] be implemented into python-pip [...?].

TUF is being developed by ... [the same people?] that ... wrote the paper on package manager security that resulted in ... [1]

[1] http://www.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html

Could you fill out the gaps please? And could you go on a bit please? Tell why it would be great and perhaps needed to get TUF into Debian and why you are great and serious [cooperation with, developed since]?

---

Feel free to either just edit, correct, rewrite my draft or to post alternative drafts below.

It doesn't really matter who posts it. Anyone can post an RFP. It's like a Debian feature request "can you package that please". No formal relation to the upstream project required or so. So I don't mind if in the end you post or me.

[adrelanos]

Ping?

[vladimir-v-diaz]

Hi Adrelanos,

Thanks for staying on top of this feature request! Your ping came just in time.

Since TUF v0.99, we have been busy trying to finalize TUF v1.0. We had previously made improvements to the framework in terms of security and efficiency. These improvements are covered in the Diplomat paper (secure delegations for community repositories) that was accepted to NSDI 2016, and in another paper that will soon be submitted to a conference.

More recently, we have been trying to make minor design changes to the framework that you can review here: https://github.com/theupdateframework/tuf/pull/326. These final touches were mainly to modify how the delegations are organized on the repository, and to give developers and repository maintainers more freedom in how they delegate trust of packages.

Once PR #326 is reviewed, we'll be free to finally work on your feature request. It'd be nice to submit a Debian RFP for a version of the framework that contains our latest work.

[adrelanos]

Ping? :)

[awwad]

Thanks, Patrick. There have been some changes in developer availability, so now I'm taking a look at the broader Debian packaging issue. I'll have more by tomorrow.

[adrelanos]

Any update?

[trishankatdatadog]

@adrelanos Could you help us send one, please?

[adrelanos]

Already done. See https://github.com/theupdateframework/tuf/issues/263#issuecomment-73368366.

[trishankatdatadog]

@adrelanos I see, sorry, my bad, I missed this. What can we do to help? Do you need someone to post the RFP?

[adrelanos]

https://github.com/theupdateframework/tuf/issues/263#issuecomment-73368366 could use a review and comes with some open questions.

Feel free to either just edit, correct, rewrite my draft or to post alternative drafts below.

It doesn't really matter who posts it. Anyone can post an RFP. It's like a Debian feature request "can you package that please". No formal relation to the upstream project required or so. So I don't mind if in the end you post or me.

[lukpueh]

Thanks for your initiative, @adrelanos! I am in the process of packaging TUF's sister project, in-toto, for Debian. I have just uploaded securesystemslib (the crypto and metadata library that both TUF and in-toto use) to mentors.debian.net.

I would like to fix the Lintian errors and upload in-toto as well and then ping up some Debian developers, who I met at MiniDebConf in Hamburg last week, and ask them to sponsor my maintainership.

Once that's through, I can do the same thing for TUF.

[trishankatdatadog]

Thanks for picking up the ball, Lukas, I dropped this due to work...

[lukpueh]

Quick status update, I have:

• debianized TUF (https://github.com/theupdateframework/tuf/commit/a2532a15424fc667c4423f1795cfb7ea3399ea92),
• built and uploaded it to mentors.debian.net/package/python-tuf, and
• filed an RFS/ITP bug.

I already have a volunteer for in-toto, which will hopefully also get in securesystemslib, which we need for TUF as well.

[trishankatdatadog]

Thanks @lukpueh!

[lukpueh]

Update:

In addition to filing an RFS/ITP bug as mentioned above, I also filed an actual ITP bug, and updated debian/changelog to reference it, which also satisfies a lintian requirement.

Moreover, I adopted review comments I received from a Debian developer for securesystemslib and in-toto metadata on the TUF debian metadata too (see recent commits on tuf@debian).

The package, built with the new metadata, can be found on mentors.debian.net/package/python-tuf.

[trishankatdatadog]

We're blocked on Debian: we need to find a sponsor for the package...