The real story behind Arch Linux package signing

http://www.toofishes.net/blog/real-story-behind-arch-linux-package-signing/

by For_Iconoclasm • 15 years ago

67 30 15 years ago

cakeface2• 15 years ago

Arch is an amazing distro and every one of my experiences with the community have so far been positive. Kind of a bummer to see people dumping on it in the mailing lists and LWN.

tygorius5• 15 years ago

Agreed on the thumbs up for Arch; I'm not thrilled with the direction Ubuntu has been taking recently (at least in the desktop version) and so have been migrating my non-server Linux boxes to Arch.

Sad to see LWN publish an attack without making an effort to get the other side of the story first. If the complainer had made the patch submissions he claimed and that the Arch maintainers deny ever seeing, well it should be pretty easy to sort out before publishing the article -- if you're really interested in journalism, that is.

wladimir3• 15 years ago

What's wrong with Ubuntu's direction, according to you?

To me, it seems they are fighting really hard to make Linux a user friendly desktop platform. Even if it leaves behind some ways of working that us older Linux users are accustomed to, I think this is a worthy cause.

danssig• 15 years ago

What are you unhappy about with Ubuntu?

lloeki2• 15 years ago

Besides its core philosophy and approach, I like Arch for its community. Its forum and IRC channel are among the rare places on the Internet where you can openly talk about flamewar-inducing topics (like foofs vs barfs or vim vs emacs) while avoiding ignition point and actually have a constructive discussion.

I witnessed rare similar cases of the random guy knocking on Arch's door and raving in about how he knows the world and everything and that we should all bow down before him but it never escalated to the point it has on that precise case.

syaz1• 15 years ago

tl;dr anyone? Arch is the only distro I use but never heard of this before.

mycroftiv• 15 years ago

Many distributions try to provide some security assurance to users by having packages in the repo cryptographically signed. This makes it harder for naughty people to trick users into installing malicious software. As a relatively small, non-"enterprise" distribution, Arch has not implemented such a system. Some people believe this is a Bad Thing, and recently there has been some controversy about it on mailing lists, which eventually bubbled up into an article on Linux Weekly News. Some Arch developers believe the issue has been portrayed inaccurately, and that a hostile individual has framed the issue unfairly.

trotsky• 15 years ago

As someone who hasn't ever used arch, I am surprised to find out that they don't sign. The distros I use, RHEL, fedora and openSUSE have pushed all signed packages for quite some time. Clearly debian/ubuntu do as well. FBSD and OBSD also. Even gentoo supports signing of portage source packages, though apparently there is no policy that requires package builders to sign. This would seem to be an argument against rolling your own package manager, at least if you lack the resources to bring it up to industry standards.

Does anyone know of other distros that don't sign their packages?

jarin• 15 years ago

People want a feature, but nobody wants to code it. It's obviously either: a) not that important, or b) people don't want it that badly.

roryokane• 15 years ago

Or c) those who want it don’t have enough skill to code it, and those who have the skill aren’t interested.

That’s the generalized response to the flawed argument “if you want it, why don’t you make it?” in open source. People specialize at tasks to hopefully increase the total effectiveness of a system to more than it would be if everyone did everything. However, this means that if the only people who have the power to do something unionize, other people can’t get that thing without agreeing to their demands.

You could say in this situation, the core devs of Arch “unionized” to demand either coding help or patience from those who want the feature. I’m not interested enough in this situation to be bothered to research whether this is a reasonable demand. If it is unreasonable, c) is the case, and if it is reasonable, a) or b) is, but that’s as far as I care to investigate.

ComputerGuru• 15 years ago

That's what capitalism is for.

If you don't have something you want and I have (the skill to write this patch), instead of bitching and griping, make it worth my while to do it for you.

tygorius5• 15 years ago

Well c) isn't really the case in Mr. WhinyUser's second request, to add SHA256 hashes. He originally claimed it was "really easy" to do, but balked at actually providing any code unless the maintainers promised to accept it. A couple of days later Dan implemented the change -- without any help or thanks from Mr. WhinyUser.

I don't know that the union argument really works in the Linux distribution realm. After peeing in the community pool Mr. WhinyUser went off to a fork of Arch that supports signatures (for their additions only, which doesn't appear to address his original concerns about Arch repositories, but apparently for some the appearance of "security" is enough). But even if he didn't have that fork to go to, there was nothing stopping him from adopting one of the many Debian offshoots, or Redhat, or ... The Arch maintainer union -- really an odd term for a handful of unpaid volunteers -- have no control over his actions or desires, but there are plenty of Linux distribution alternatives out there.

pyre4• 15 years ago

  > Or c) those who want it don’t have
  > enough skill to code it, and those who
  > have the skill aren’t interested.

As others have pointed out, this would be more correctly stated as:

  Those who want it, but don't have the skill
  to code ti, want to demand that someone that
  has the skills, spends their leisure time
  creating it for free because they don't want
  to pay for it.

Aka

  If it is really that important to you, and
  you don't have the skills to do it, you always
  have the option of paying someone that *does*
  have the skills to do it for you.

Apparently in most cases it's just more fun to fire up the email client and rant and rave about how it's 'unfair' that the feature isn't being implemented. And in the more interesting examples claim that the developers are 'Nazis' because they won't heed your bid and call.

crocowhile3• 15 years ago

I am with you on this and with IgnorantGuru on the issue (I don't even care about the lies).

There is no rational explanation that justify why a really major issue, or for that matter even simply an issue most users want, should not be implemented by the core developers for 6 freaking years. If you are too busy to code, you should step down and leave the position; same thing if you think the bug is not one of your personal priority: you are the maintainer and you have taken up a responsibility towards the users. Abandon if you cannot do it.

I had my own little delusion with nautilus developer, of which I talk here ( http://gilest.ro/2011/patches-for-nautilus-move-to-trash-bug... ). Same attitude there: lots of people want the bug fixed, patches exist, won't fix.

Supermighty• 15 years ago

or d) those that don't know how to code it learn how to and start contributing to the thousands man hour project they leach off of.

illumen• 15 years ago

This happens from time to time in OSS projects. Some users kick up a big stink. Often times their issues get fixed.

However, it's a shit way to do it and tramples on a lot of people... and in the mid to long run can damage a project greatly.

A more constructive way for a user to get a feature in is to either pay for it, or code it. Setting up a 'bounty', or helping to get funding is a better way to try and get these novel writers to help with the project.

Get these passionate writers working for the project by directing their energies towards getting funding. Telling them to shut up and submit a patch won't work... since they are not capable of writing code sometimes. However they do care greatly about the issue, and have time to send off emails and write blog posts.

pyre4• 15 years ago

In this case, it seems like the user is more interested in trolling than anything else. He claimed that one of the features was 'easy' to implement and that he would submit a patch, but then never did. Presumably because it was too busy writing a blog post about how the developer was being 'difficult' because they asked him to write a patch for such an 'easy' feature (e.g. "encryption is easy, right? you just take a piece of information and then you encrypt it! Pow! It's done! Easy as pie! What's so hard?").

km3k• 15 years ago

There was an "Arch Bounty" system for funding things like this. It died with only one donation. It wasn't well promoted, but it did exist and was mentioned on the Arch Linux website in various places. Info is available from an Arch Linux developer at http://archlinux.me/dusty/2010/01/22/death-of-arch-bounty/

Notice the dates. The "Arch Bounty" system was born and died while people complained. People who were complaining about this could have asked for a bounty for this feature and paid for it, but they didn't.

The real story behind Arch Linux package signing

Related Stories