Re: [GNU-linux-libre] review of uruk

[bill-auger]

On Thu, 30 Mar 2023 00:28:56 +0200 Denis wrote:
> > that may be a adequate clarification, what i would add to the
> > "complete distros" section:
> >   
> > > Distro maintainers must have complete autonomy over all software
> > > that they distribute.  
> > 
> > i really dont think that is expecting too much - i would tend to
> > see it as essential, if i were choosing a distro  
> If the question here is to make the review faster, I don't see any
> issue so far.
> 
> If instead the question here here is what is FSDG compliant, there
> is the issue of defining that precisely. 
> 
> If a distro runs a VM, does it need to control the underlying hardware?

i did not intend to be so specific about the infra, such as to
own all hardware and operate all services - there is no criteria
about SaaSS, for example - i only meant that the distro should
be able to fix bugs and freedom issues in any portion of the
distro, at any time - to do that, requires controlling what gets
built and published

for example, i would be fine if the distro hosted all source
code, recipes, and binary packages on github, sourceforge,
whatever, with all packages auto-built by a third-party CI
service - the point is that the distro would be in control over
what gets built, and when, the exact recipes, etc

naturally, security issue come into play; but i think you are
correct, in that there is no criteria requiring software to be
secure

it would not significantly alter the review process - there
should be no need to scrutinize the infra, beyond determining
that the distro maintainers can control what gets built and
published