Differences between revisions 30 and 161 (spanning 131 versions)
Revision 30 as of 2008-02-11 01:37:14
Size: 4889
Comment:
Revision 161 as of 2022-11-20 07:20:52
Size: 12962
Editor: ?GianfrancoCostamagna
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
## page was renamed from Maintainers
#language en
##For Translators - to have a constantly up to date translation header in you page, you can just add a line like the following (with the comment's character at the start of the line removed)
##<<Include(DebianMaintainer, ,from="^##TAG:TRANSLATION-HEADER-START",to="^##TAG:TRANSLATION-HEADER-END")>>
##TAG:TRANSLATION-HEADER-START
||<tablewidth="100%"style="border: 0px hidden ;">~-[[DebianWiki/EditorGuide#translation|Translation(s)]]: [[DebianMaintainer|English]] - [[ko/DebianMaintainer|한국어]] - [[pt_BR/DebianMaintainer|Português (Brasil)]]-~||<style="border: 0px hidden ; text-align: right;"> (!) [[/Discussion]] ||
##TAG:TRANSLATION-HEADER-END
----

== Contents ==
<<TableOfContents(3)>>
Line 2: Line 14:

Debian Maintainers are people who are not full developers but have a restricted ability to upload packages to the Debian archive.

The Debian Maintainers concept was introduced on 5th August 2007 by [http://www.debian.org/vote/2007/vote_003 General Resolution].
'''Debian Maintainers''' (DMs) are people who have a restricted ability to upload packages to the Debian archive. <<BR>>
Unlike [[SponsoredMaintainer|Sponsored Maintainers]], they can maintain packages '''without''' a [[Glossary#sponsor|sponsor]].

It is '''highly recommended''' to be a ''Debian Maintainer'' before applying to the [[http://www.debian.org/devel/join/newmaint|Debian New Members]] process to become an official [[DebianDeveloper|Debian Developer]] (see the [[http://www.debian.org/devel/join/nm-checklist|Applicant's Checklist]]).

The Debian Maintainers concept was introduced on 5th August 2007 by [[http://www.debian.org/vote/2007/vote_003|General Resolution]]. <<BR>>
An up to date list of DMs is available at [[https://nm.debian.org/public/people/dm_all|nm.debian.org]].
A [[http://ftp-master.debian.org/dm.txt|list of the upload rights held by DMs]] is maintained by the Debian ftp-masters, and a few reports with the same information are maintained [[http://qa.debian.org/dm-permissions/|here]].
Line 8: Line 25:

A Debian Maintainer has their key in the debian-maintainers keyring (available in the debian-maintainers package).

This keyring is used by dak on the Debian archive as part of the checks as to whether an uploaded package is to be accepted.

Packages signed by a key in the debian-maintainers keyring will be accepted if the package is not new and the previous version of the package contains both the maintainer in the {{{Maintainer}}} control field and has the {{{DM-Upload-Allowed}}} control field present.

== Becoming a Maintainer ==

To become a Debian Maintainer, you must:

 * agree to the [http://www.debian.org/social_contract social contract] and [http://www.debian.org/social_contract#guidelines DFSG]
 * agree to the [http://www.debian.org/devel/dmup Debian Machine Usage Policies] (dmup)
 * publically state your agreement to the above two documents, signing your declaration with your OpenPGP key. Most people will post their declaration to the [http://lists.debian.org/debian-newmaint debian-newmaint mailing list].
 * have your PGP key signed by at least one (but ideally more than one) Debian Developers.
 * have at least one (but preferably more) Debian Developers advocate you. This is usually a signed mail to debian-newmaint (often a reply to your declaration mail).
 * submit a bugreport with a jetring changeset to the bug tracking system, filed against the [http://packages.qa.debian.org/debian-maintainers debian-maintainers package]. Use only URLs from debian.org for the agreement and advocates fields of the jetring changeset.
 * there will be a waiting period of around four days to wait for more advocacies or objections from Debian Developers.
=== Annual ping ===

The DMs must reconfirm their interest annually.

=== Uploading packages ===

Once you have your key in the keyring, you will be able to upload packages, where the following conditions hold:

 * the package already lists you in the {{{Maintainers}}} or the {{{Uploaders}}} control fields
 * the package already has the {{{DM-Upload-Allowed: yes}}} control field
 * the package is not NEW

==== dpkg caveat ====

Until recently dpkg did not understand the {{{DM-Upload-Allowed}}} field and would not add it to the DSC. You need to
either have dpkg version >= 1.14.16 (you should use the most up to date tool versions anyway ;-)) or prefix it with 'XS-' for it to make it into the DSC file.

== Advocating a Maintainer ==

A developer should only advocate a candidate if they are familiar with the candidate's existing work in Debian and believe it to be of a suitable standard both technically and socially.

Developers advocating DMs (or potential DDs for that matter) must go into a bit more detail in their advocacy.

If the prospective DM has done "a great job", please explain what "a great job" means -- is there something special she/he's done, or is it that whatever she/he's working on is particularly important, or is she/he remarkably consistent, or what? What's she/he actually done that's earnt your trust? What makes her/him special compared to the other folks who're helping Debian? What in particular about her/his work should people lurking on the debian lists be trying to emulate if they want to be a DM or a DD?

For example, if the prospective DM has good packaging skills, go into a bit more detail about what's convinced you he's got those skills? Are there any difficult bugs you've worked together on, or new features he's done a good job of getting into Debian, or has he been particularly helpful supporting users, or...?

== External links ==
Debian Maintainers have their keys in the ''debian-maintainers'' keyring (available in the {{{debian-keyring}}} package).

This keyring is used by [[DebianDak|dak]] on the Debian archive as part of the checks as to whether an uploaded package is to be accepted. <<BR>>
Packages signed by a key in the {{{debian-maintainers}}} keyring will be accepted if the key has upload right for the package. <<BR>>
For the new interface for managing DM permissions, refer to the mail [[http://lists.debian.org/debian-devel-announce/2012/09/msg00008.html|Changes to Debian Maintainer upload permissions]].

Debian Maintainer should read this [[DebianMaintainer/Tutorial]] to know more about --(the annual ping)--, key changes and uploading packages.


== Advocating a Debian Maintainer ==
A [[DebianDeveloper|Debian Developer]] should only advocate a ''Debian Maintainer'' candidate if
 * they are familiar with the candidate's existing work in Debian
 * and believe it to be of a suitable standard both technically and socially.

[[DebianDeveloper|Debian Developers]] advocating Debian Maintainer candidates (or potential Debian Developers for that matter) must go into a bit more detail in their advocacy.

 * If the Debian Maintainer candidate has done "a great job", please explain what "a great job" means
  * is there something special the candidate has done,
  * or is it that whatever the candidate is working on is particularly important,
  * or is the candidate remarkably consistent, or what?
 * What has the candidate actually done that has earned your trust?
 * What makes the candidate special compared to the other folks who are helping Debian?
 * What in particular about the candidate's work should people lurking on the Debian lists be trying to emulate if they want to be a Debian Maintainer or a [[DebianDeveloper|Debian Developer]]?

For example, if the Debian Maintainer candidate has good packaging skills,<<BR>>
go into a bit more detail about what's convinced you the candidate has got those skills?
 * Are there any difficult bugs you've worked together on,
 * or new features the candidate has done a good job of getting into Debian,
 * or has the candidate been particularly helpful supporting users,
 * or...?

Once you have decided to advocate a Debian Maintainer applicant, you should
 * login to the [[https://nm.debian.org|New Members]] website
 * and find their open application (the direct link can be found at the bottom of their Declaration of Intent email).
 * You can then add your declaration, GnuPG-signed by your Debian key. <<BR>>
 This will automatically be sent to the {{{debian-newmaint}}} list as well. <<BR>>
 (Note that in previous times sending the email directly to the list yourself was sufficient; this is no longer the case. <<BR>>
 Advocacy must be submitted via the NM website for it to be attached to the application.)

== Becoming a Debian Maintainer ==

Steps required to become a ''Debian Maintainer''

=== Prerequisite ===

Before becoming a ''Debian Maintainer'' you should have a history of contributions to Debian as a [[SponsoredMaintainer|Sponsored Maintainer]] where you can meet and establish a level of trust with other project members.

=== step 1 : Identification ===

 * You must have a strong (>= 2048 bit required; 4096 bit recommended) RSA or an ECDSA GnuPG key (see line above) <<BR>>
 and it must be [[Keysigning|signed]] by at least one (but ideally more than one) [[DebianDeveloper|Debian Developer]].

If signed by only one DD, try to make sure there is at least another trust path to your key.


=== step 2 : Declaration of intent ===
To become a ''Debian Maintainer'', you must:

 * agree to the [[http://www.debian.org/social_contract|social contract]]

 * agree to the [[http://www.debian.org/social_contract#guidelines|DFSG]]

 * agree to the [[http://www.debian.org/devel/dmup|Debian Machine Usage Policies]] (dmup)

 * subscribe to the [[http://lists.debian.org/debian-devel-announce/|debian-devel-announce]] mailing list.

 * ensure that GnuPG uses SHA2 signatures (in preference to SHA1); an example is having the following content in ~/.gnupg/gpg.conf:
 {{{
personal-digest-preferences SHA512
cert-digest-algo SHA512
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
 }}}
 If you use caff (part of DebPkg:signing-party package) for signing keys you will also need to add these lines to ~/.caff/gnupghome/gpg.conf as well.

 * register for a Salsa account if you do not have one
 * register for a [[https://nm.debian.org|New Members]] account
 * in [[https://nm.debian.org|New Members]], apply for the Debian Maintainer status
 * a mail will automatically be sent to the {{{debian-newmaint}}} mailing list.

The prospective DM is highly encouraged to subscribe to the [[http://lists.debian.org/debian-devel/|debian-devel]] mailing list.

Please check your key and fix any problem with your key. <<BR>>
Please read the document [[https://help.riseup.net/en/security/message-security/openpgp/best-practices|"OpenPGP Best Practices"]] by [[DanielKahnGillmor|Daniel Kahn Gillmor]] (dkg). <<BR>>
Its OpenPGP key checks have been implemented by [[ClintAdams|Clint Adams]] (clint) in the Debian package hopenpgp-tools and dkg's recommended settings has been put together in a gpg.conf file by [[https://en.wikipedia.org/wiki/Jacob_Appelbaum|Jacob Appelbaum]] (error). <<BR>>
Please check your key with clint's hokey lint command and use error's gpg.conf file as explained in dkg's document.

=== step 3 : Advocacy ===
 * You must have at least one (but preferably more) [[DebianDeveloper|Debian Developer]] '''advocate''' you.
 * You should send a mail to all your advocates, asking them
  * to log into [[https://nm.debian.org|New Members]],
  * find your open application,
  * and advocate you.

Their comments will also be sent to the {{{debian-newmaint}}} mailing list.

=== step 4 : Objections ===

Your application will stay pending for four days, to allow time for any objections to be filed.

=== step 5 : Keyring update ===

When your application is complete, it will be sent to the keyring maintainers who will actually update the keyring.

This can take anything from days to weeks, and you will be notified when it happens.


== Debian Maintainer retirement ==

Following each Debian release, all DMs who did not make an upload during the cycle for that release will be automatically retired.

For example: after the release of Stretch, DMs who did not make an upload
since the release of Jessie will be retired.

There used to be an annual "ping" bug procedure to indicate continued interest: that is not required anymore.

Announced [[https://lists.debian.org/debian-devel-announce/2016/08/msg00007.html|here]].

== Information ==
Now that you are a Debian Maintainer, you have to read this [[DebianMaintainer/Tutorial]]

=== Granting Permissions ===
After a Debian Maintainer's key has been added to the debian-maintainers keyring, a Debian Developer may grant upload permissions to the DM for specific packages by uploading a signed dak command to ftp.upload.debian.org [[https://lists.debian.org/debian-devel-announce/2012/09/msg00008.html | as described in the FTP-Master's announcement to debian-devel.]] <<BR>>
This process can be simplified with the help of the {{{dcut}}} command from the '''{{{dput-ng}}}''' package. Note that this does not work with the {{{dcut}}} command from the {{{dput}}} package. You can check which one you have via {{{apt list dput*}}}.

For example, both of the following work:

{{{
$ dcut ftp-master dm --uid "Jane Doe" --allow glibc
$ dcut ftp-master dm --uid 0xfedcba9876543210 --allow glibc linux --deny kfreebsd9
}}}

If the DM's key is not in the keyring package yet but in the DD's local keyring, use the {{{--force}}} option and the fingerprint, without spaces and, in this special case, without the 0x prefix and in all uppercase:

{{{
$ dcut ftp-master --force dm --uid FEDCBA9876543210FEDCBA9876543210 --allow glibc
}}}

Both the DD and DM will receive a mail notification about any changes taken. <<BR>>
 The archive's knowledge about DMs can be [[https://ftp-master.debian.org/dm.txt |checked here.]]


=== External links ===
Line 56: Line 168:
 * http://packages.debian.org/debian-maintainers - keyring package
 * http://git.debian.org/?p=d-m/debian-maintainers.git;a=summary - git repo summary
 * http://packages.debian.org/debian-maintainers - old keyring package, no longer exists, as it was merged into debian-keyring in 2009
 * http://packages.debian.org/debian-keyring - keyring package
 * http://
git.debian.org/?p=d-m/debian-maintainers.git;a=summary - git repo summary, until July 2009, when it was merged into debian-keyring
 * http://bzr.debian.org/loggerhead/keyring/debian-keyring/files - bazaar repo summary
Line 61: Line 175:
 * http://ftp-master.debian.org/dm-uploaders.html - core raw information about DM

== IRC Channel ==

#debian-maintainer at irc.debian.org
 * http://lists.debian.org/debian-devel-announce/2010/09/msg00003.html - Debian wants stronger keys
 * http://keyring.debian.org/creating-key.html - Creating a new OpenPGP key
 * http://keyring.debian.org/replacing_keys.html - rules for key replacement in the debian-developers keyring
 * http://ftp-master.debian.org/dm.txt - raw information of DM upload permissions (new interface)
 * https://help.riseup.net/en/security/message-security/openpgp/best-practices - OpenPGP Best Practices
 * http://lists.debian.org/debian-devel/2011/04/msg01058.html - DM upload permissions in detail
 * https://lists.debian.org/debian-devel-announce/2012/09/msg00008.html - Changes to Debian Maintainer upload permissions

==== IRC Channel ====
 * Packaging and sponsoring questions: [[irc://irc.debian.org/debian-mentors|#debian-mentors]] at irc.debian.org
 * Questions about becoming a DM: [[irc://irc.debian.org/debian-newmaint|#debian-newmaint]] at irc.debian.org

=== Statistics ===
==== Data ====
http://people.debian.org/~anibal/dm/dm-history

==== Graph ====
{{http://people.debian.org/~anibal/dm/dm.png}}
<<BR>>
/!\ graph image above was last updated circa 2009

==== Bugs ====
{{https://qa.debian.org/data/bts/graphs/d/debian-maintainers.png}}

Line 68: Line 202:
||||<tablestyle="width: 200px; background: #F2F4F7; font-size:12px;" rowstyle="background: #B8C5D9; font-size:14px;" >''' Page Copyright'''||
||<^)> '''License''' || ["GPLv2"]||
||<^(> '''Authors''' || JonDowland AnibalMonsalveSalazar||
~-see ["LicencingTerms"] for info about wiki content copyright.-~

||||<tablebgcolor="#f2f4f7" tablewidth="200px" tablestyle="font-size: 12px;"rowbgcolor="#b8c5d9" rowstyle="font-size: 14px;"style="text-align: center;">''' Page Copyright''' ||
||<style="text-align: right; vertical-align: top;"> '''License''' || [[GPLv2]] ||
||<style="text-align: left; vertical-align: top;"> '''Authors''' || JonDowland AnibalMonsalveSalazar ||


~-see DebianWiki/LicencingTerms for info about wiki content copyright.-~

----
## This page is linked from http://www.debian.org/intro/organization for "Debian Maintainer Keyring Team"
## This page is linked from http://www.debian.org/doc/manuals/developers-reference/pkgs
CategoryPermalink CategoryDeveloper

Translation(s): English - 한국어 - Português (Brasil)

(!) /Discussion


Contents

Introduction

Debian Maintainers (DMs) are people who have a restricted ability to upload packages to the Debian archive.
Unlike Sponsored Maintainers, they can maintain packages without a sponsor.

It is highly recommended to be a Debian Maintainer before applying to the Debian New Members process to become an official Debian Developer (see the Applicant's Checklist).

The Debian Maintainers concept was introduced on 5th August 2007 by General Resolution.
An up to date list of DMs is available at nm.debian.org. A list of the upload rights held by DMs is maintained by the Debian ftp-masters, and a few reports with the same information are maintained here.

Overview

Debian Maintainers have their keys in the debian-maintainers keyring (available in the debian-keyring package).

This keyring is used by dak on the Debian archive as part of the checks as to whether an uploaded package is to be accepted.
Packages signed by a key in the debian-maintainers keyring will be accepted if the key has upload right for the package.
For the new interface for managing DM permissions, refer to the mail Changes to Debian Maintainer upload permissions.

Debian Maintainer should read this DebianMaintainer/Tutorial to know more about the annual ping, key changes and uploading packages.

Advocating a Debian Maintainer

A Debian Developer should only advocate a Debian Maintainer candidate if

  • they are familiar with the candidate's existing work in Debian
  • and believe it to be of a suitable standard both technically and socially.

Debian Developers advocating Debian Maintainer candidates (or potential Debian Developers for that matter) must go into a bit more detail in their advocacy.

  • If the Debian Maintainer candidate has done "a great job", please explain what "a great job" means
    • is there something special the candidate has done,
    • or is it that whatever the candidate is working on is particularly important,
    • or is the candidate remarkably consistent, or what?
  • What has the candidate actually done that has earned your trust?
  • What makes the candidate special compared to the other folks who are helping Debian?
  • What in particular about the candidate's work should people lurking on the Debian lists be trying to emulate if they want to be a Debian Maintainer or a Debian Developer?

For example, if the Debian Maintainer candidate has good packaging skills,
go into a bit more detail about what's convinced you the candidate has got those skills?

  • Are there any difficult bugs you've worked together on,
  • or new features the candidate has done a good job of getting into Debian,
  • or has the candidate been particularly helpful supporting users,
  • or...?

Once you have decided to advocate a Debian Maintainer applicant, you should

  • login to the New Members website

  • and find their open application (the direct link can be found at the bottom of their Declaration of Intent email).
  • You can then add your declaration, GnuPG-signed by your Debian key.
    This will automatically be sent to the debian-newmaint list as well.
    (Note that in previous times sending the email directly to the list yourself was sufficient; this is no longer the case.
    Advocacy must be submitted via the NM website for it to be attached to the application.)

Becoming a Debian Maintainer

Steps required to become a Debian Maintainer

Prerequisite

Before becoming a Debian Maintainer you should have a history of contributions to Debian as a Sponsored Maintainer where you can meet and establish a level of trust with other project members.

step 1 : Identification

  • You must have a strong (>= 2048 bit required; 4096 bit recommended) RSA or an ECDSA GnuPG key (see line above)
    and it must be signed by at least one (but ideally more than one) Debian Developer.

If signed by only one DD, try to make sure there is at least another trust path to your key.

step 2 : Declaration of intent

To become a Debian Maintainer, you must:

  • agree to the social contract

  • agree to the DFSG

  • agree to the Debian Machine Usage Policies (dmup)

  • subscribe to the debian-devel-announce mailing list.

  • ensure that GnuPG uses SHA2 signatures (in preference to SHA1); an example is having the following content in ~/.gnupg/gpg.conf:
    personal-digest-preferences SHA512
    cert-digest-algo SHA512
    default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed

    If you use caff (part of signing-party package) for signing keys you will also need to add these lines to ~/.caff/gnupghome/gpg.conf as well.

  • register for a Salsa account if you do not have one
  • register for a New Members account

  • in New Members, apply for the Debian Maintainer status

  • a mail will automatically be sent to the debian-newmaint mailing list.

The prospective DM is highly encouraged to subscribe to the debian-devel mailing list.

Please check your key and fix any problem with your key.
Please read the document "OpenPGP Best Practices" by Daniel Kahn Gillmor (dkg).
Its OpenPGP key checks have been implemented by Clint Adams (clint) in the Debian package hopenpgp-tools and dkg's recommended settings has been put together in a gpg.conf file by Jacob Appelbaum (error).
Please check your key with clint's hokey lint command and use error's gpg.conf file as explained in dkg's document.

step 3 : Advocacy

  • You must have at least one (but preferably more) Debian Developer advocate you.

  • You should send a mail to all your advocates, asking them
    • to log into New Members,

    • find your open application,
    • and advocate you.

Their comments will also be sent to the debian-newmaint mailing list.

step 4 : Objections

Your application will stay pending for four days, to allow time for any objections to be filed.

step 5 : Keyring update

When your application is complete, it will be sent to the keyring maintainers who will actually update the keyring.

This can take anything from days to weeks, and you will be notified when it happens.

Debian Maintainer retirement

Following each Debian release, all DMs who did not make an upload during the cycle for that release will be automatically retired.

For example: after the release of Stretch, DMs who did not make an upload since the release of Jessie will be retired.

There used to be an annual "ping" bug procedure to indicate continued interest: that is not required anymore.

Announced here.

Information

Now that you are a Debian Maintainer, you have to read this DebianMaintainer/Tutorial

Granting Permissions

After a Debian Maintainer's key has been added to the debian-maintainers keyring, a Debian Developer may grant upload permissions to the DM for specific packages by uploading a signed dak command to ftp.upload.debian.org as described in the FTP-Master's announcement to debian-devel.
This process can be simplified with the help of the dcut command from the dput-ng package. Note that this does not work with the dcut command from the dput package. You can check which one you have via apt list dput*.

For example, both of the following work:

$ dcut ftp-master dm --uid "Jane Doe" --allow glibc
$ dcut ftp-master dm --uid 0xfedcba9876543210 --allow glibc linux --deny kfreebsd9

If the DM's key is not in the keyring package yet but in the DD's local keyring, use the --force option and the fingerprint, without spaces and, in this special case, without the 0x prefix and in all uppercase:

$ dcut ftp-master --force dm --uid FEDCBA9876543210FEDCBA9876543210 --allow glibc

Both the DD and DM will receive a mail notification about any changes taken.

IRC Channel

Statistics

Data

http://people.debian.org/~anibal/dm/dm-history

Graph

http://people.debian.org/~anibal/dm/dm.png
/!\ graph image above was last updated circa 2009

Bugs

https://qa.debian.org/data/bts/graphs/d/debian-maintainers.png


Page Copyright

License

GPLv2

Authors

JonDowland AnibalMonsalveSalazar

see DebianWiki/LicencingTerms for info about wiki content copyright.


CategoryPermalink CategoryDeveloper