2

I'm interested in who builds the Debian main packages for distribution. I'm aware that packages need to be reproducably buildable and I'm not asking about any specific individuals but the process in general (e.g. how "trust" would be involved here and how decentralized it is).

At https://lwn.net/Articles/676799/ it says:

More generally, Mozilla trusts the Debian packagers to use their best judgment to achieve the same quality as the official Firefox binaries.

At https://wiki.debian.org/Packaging it says:

Debian packages are maintained by a community of Debian Developers and volunteers.

I'm new to Debian so please edit this question if that's needed.

mYnDstrEAm
  • 4,275
  • 14
  • 57
  • 118

2 Answers2

3

What I know, I am not an insider, or expert, so read the links at the end.

I know that packages are cryptographically signed, by the packager/developers. This allows your system to know who it came from. Your system has the public key of every Debian packager/developer. Therefore there is end to end authentication between developer and end user.

Developer keys are swapped between developers, and then added to the system, by adding them to a developer key package.

Developers have to show ID: passport etc to be added as a developer. They also have to build up trust. See difference between maintainer and developer.

see here for more info: https://wiki.debian.org/DebianDeveloper and https://wiki.debian.org/DebianMaintainer

ctrl-alt-delor
  • 27,993
2

It's a little unclear what you really want to know, since you seem to have found good resources, but I'll try to give a short (and not accurate in every detail) description of the process and hope I get the right parts included (I haven't worked with this in Debian's own repositories, but in different iterations of a setup at work, that grew ever bigger and more automated getting more and more like - how I understand - Debian's system). Every (maintained) package in Debian has a developer (or a team of developers), who locally (i.e. on his own machine(s) takes the upstream source code and makes some files that details how a Debian package should be made. He then collects that into a source package, which he signs with GPG and uploads to one of Debian's systems. If that system can verify the the source package came from a developer (by virtue of having a valid signature), it then sends the source package to a build host for each relevant architecture. Those packages, along with any binary packages uploaded directly by the developer, are then uploaded to the relevant repositories, and distributed to mirrors, from where you download and install them. The build host also signs the build packages (with some common key, it obviously can not sign stuff with developers's private keys), and the repository verifies those signatures.

Stephen Kitt
  • 434,908
Henrik supports the community
  • 5,636
  • This is exactly what I wanted to know. Thank you.                How are the developers chosen / assigned to specific packages? Is it open for everyone to do and people simply come forward to volunteer?                  Also are there already mechanisms built in that allow people to build packages themselves and verify the dev-build's integrity (e.g. verification counters with public keys of people who verified next to packages in Synaptic)? – mYnDstrEAm May 29 '17 at 12:48
  • 1
    Debian is volunteer-based; packages are not "assigned" so much as "taken", though the Debian QA team occasionally needs to take over abandoned packages. Maybe google "wnpp". – tripleee May 29 '17 at 13:09