20:17:14 <ennael> #startmeeting
20:17:14 <Inigo_Montoya`> Meeting started Tue Mar  8 20:17:14 2016 UTC.  The chair is ennael. Information about MeetBot at http://wiki.debian.org/MeetBot.
20:17:14 <Inigo_Montoya`> Useful Commands: #action #agreed #help #info #idea #link #topic.
20:17:19 <ennael> hi all
20:17:28 <MrsB> hi o/
20:17:47 <Latte> hi - just in time ;)
20:18:07 <sebsebseb> hi
20:19:25 <papoteur> What are the topics?
20:19:58 <ennael> ok
20:20:07 <ennael> #topic Magiea 6 design
20:20:37 <ennael> just a quick review here
20:20:40 <Latte> typo ;)
20:21:08 <ennael> di dyou have a look on  what has been done already ?
20:21:17 <MrsB> he's made good progress
20:21:22 * ennael needs to buy new fingers
20:21:25 <wilcal> That by the person contracted to do the work yes
20:21:26 <ennael> indeed
20:21:39 <ennael> you can check it in git repository
20:21:47 <Akien> I had a quick look at some of the commits done, the icons look good for what I could see
20:22:46 <ennael> http://gitweb.mageia.org/software/control-center/tree/pixmaps/svg?h=user/animtim/designWork
20:22:59 <papoteur> I did not look for every thing, what I see was OK.
20:23:01 <ennael> just click on plain for non git addicts :)
20:23:16 <Akien> I think that when he's back (I saw he was giving a talk in India at a KDE event :)) we could ask him to give us some screenshots of how it all looks when put together
20:23:44 <ennael> I will give a try also, build mcc using his branch
20:24:20 <MrsB> What's the command for non git aware people to check out the current images so they're easier to view?
20:24:43 <Akien> Good question, I'll find that
20:24:49 <sebsebseb> indeed that link just gives me code when I try and go on a image
20:24:59 <ennael> sebsebseb: click on plain
20:25:17 <sebsebseb> oh plain ok that works yeah
20:25:37 <Akien> git clone --depth=50 git://git.mageia.org/software/control-center
20:25:47 <MrsB> thanks Akien
20:26:02 <Akien> Then: cd control-center && git checkout user/animtim/designWork
20:26:18 <Akien> Then you can browse the folders with your file manager and go to tree/pixmaps/svg
20:26:36 <ennael> why 50 ?
20:26:40 <Latte> yes - some screenshots for the total view would be nice
20:26:46 <sebsebseb> from what artwork I saw before, he was doing a good job yes
20:27:03 <Akien> ennael: So that it's faster, but it looks like it breaks the branching :D
20:27:09 <ennael> :)
20:27:46 <ennael> ok and I paid him a down payment
20:27:56 <ennael> (don't know if it's the correct words)
20:28:06 <Latte> what he posted previous version in the council ml looks nice
20:28:08 <ennael> which is quite usual in such cases
20:28:16 <Akien> So use: git clone git://git.mageia.org/software/control-center && cd control-center && git checkout && git checkout user/animtim/designWork
20:28:26 <ennael> better :)
20:28:37 <Akien> s/git checkout &&//
20:28:39 <Akien> Grr
20:28:46 <Akien> git clone git://git.mageia.org/software/control-center && cd control-center && git checkout user/animtim/designWork
20:30:50 <MrsB> they look good imho
20:31:23 <Akien> Regarding the design, atelier still has to setup the usual call for contributions for the background. We have already some nice proposals from animtim and from some MLO users, so we won't be in dire need this year :)
20:31:59 <Akien> But it's always a good event to get people a bit more involved with trying to make something for their distro, so it's worth running even if we already have good material
20:32:12 <Akien> (we usually also get nice photos for the screensavers, etc;)
20:32:45 <ennael> still I guess we could have one official included by default and some contribution package
20:32:59 <Akien> I need to trick stormi into organizing all this, as I don't really have the time, and otherwise atelier is... like always :D
20:32:59 <MrsB> a few blank ones in there - grey square, black square
20:33:11 <ennael> this could please people who do not like default one and create some noise around mageia
20:33:18 <Akien> Indeed
20:33:28 <Akien> That's what we do usually with the -extra package, but it's not very visible
20:33:36 <Akien> mageia-theme-extra
20:33:46 <ennael> I guess we could also propose a goodies packages for the winners
20:33:59 <Akien> We should probably try to communicate more about it (or ideally have it included on ISOs, but ISO space is expensive :p)
20:34:13 <ennael> no way for isos
20:34:17 <Akien> :-D
20:34:22 <ennael> 64 bits is just fat
20:34:37 <wilcal> by how much fat
20:35:12 <ennael> 4,34.3G    Mageia-6-dev1-x86_64-DVD.iso
20:35:19 <Akien> Drop Libreoffice
20:35:20 * Akien hides.
20:35:26 <ennael> oups 4,3G
20:35:41 <wilcal> mmmm that's about 10% tooo big at least
20:35:52 <ennael> Akien: ok we write a blog post and we say it's because of Akien  :)
20:35:53 <sebsebseb> or maybe two backgrounds in th ISO properly, one by default, and the other there as an option in the background changer?
20:35:57 <sebsebseb> plus anything else in repos?
20:36:04 <ennael> nope
20:36:10 <ennael> we cannot afford it
20:36:21 <sebsebseb> pictures take up to much space now like that?
20:36:25 <ennael> it's not about one more image but all resolutions
20:36:34 <sebsebseb> oh I see
20:36:42 <sebsebseb> so it's lilke 10 or 20 images really
20:36:50 <MrsB> could perhaps add it as a recommended package in MageiaWelcome
20:37:12 <sebsebseb> yeah community backgrounds, and screensavers, taht should be known about
20:37:14 <ennael> backgrounds direcotry is nearly 10M
20:37:17 <sebsebseb> Magiea welcome is a place to announce it
20:37:32 <ennael> yep
20:37:34 <sebsebseb> otherwise it's just something that sits there in the repo's that like no one actsaully installs
20:37:51 <MrsB> we can trick Akien into organising that
20:37:59 <Akien> Yeah the -extra package is 27 MB... :)
20:38:02 <sebsebseb> on the subject of the welcome screen,  maybe the optional  once a month  or so Magiea email  option should be in there, something  MrsB suggested about a year or two ago
20:38:07 <ennael> also communicating on new release could focus about new design and backgrounds
20:38:12 <Akien> MrsB: Yeah that's a good idea
20:38:16 <MrsB> :)
20:38:20 <Akien> If someone open a bug report I'll ensure that it's taken care of ;)
20:38:23 <Akien> *opens
20:39:12 <sebsebseb> yes for Mageia 6 the design should be a big focus of the run up
20:39:21 <sebsebseb> since that's one of the main things that has changed that users are going to see
20:40:35 <papoteur> For Mageia welcome, all agree?
20:40:47 <ennael> we could plan an interview with animtim
20:40:50 <Akien> So yeah back to the design by animtim, I think the next step for us should be to review the new stuff in context (i.e. MCC with new icons, etc.), so that we can give feedback to animtim as soon as possible
20:41:21 <Latte> agree
20:41:59 <Akien> Maybe the simplest is that some of us build the changed packages with the animtim branch, and make screenshots for everyone
20:42:17 <Akien> I'll have a look at putting up a list of all repos with an animtim branch for starters :)
20:42:21 <MrsB> https://bugs.mageia.org/show_bug.cgi?id=17917
20:42:25 <ennael> in progress here
20:42:43 <Akien> ennael: for MCC, or all of them?
20:42:47 <sebsebseb> an interview with animtim for the blog could be a good idea yes
20:42:54 <ennael> Akien: all of them ?
20:43:16 <Akien> ennael: I mean I've seen some designWork branches in much much repos than just control-center
20:43:39 <ennael> yep will try t integrate all this
20:43:48 <Akien> e.g. isodumper, drakx, drakx-kbd-mouse-x11, drak3d, mgaonline, rpmdrake, etc.
20:43:57 <Akien> He does his job well, without having us to tell him what to do :D
20:43:59 <ennael> do you have a complete list ?
20:44:09 <Akien> I'll make one
20:44:56 <ennael> thanks
20:45:03 <ennael> ok is that all for this topic ?
20:45:19 <MrsB> how much was the down payment?
20:46:10 <ennael> 600€
20:46:15 <Akien> ennael: Here's the list: http://hastebin.com/ujaqoteveq.hs
20:46:19 <MrsB> ok thanks :)
20:46:36 <Akien> Sounds good to me for the down payment.
20:46:49 <ennael> next topic ?
20:46:57 <ennael> #chair MrsB Akien
20:46:57 <Inigo_Montoya`> Current chairs: Akien MrsB ennael
20:47:09 <ennael> it's women day \o/
20:47:14 <ennael> oups sorry Akien
20:47:16 <Akien> #unchair Akien
20:47:16 <Inigo_Montoya`> Current chairs: MrsB ennael
20:47:19 <Akien> :D
20:47:35 <MrsB> ahh yes it is :)
20:47:42 * Akien fell off his #chair.
20:47:42 <ennael> ok
20:47:47 <Latte> congrats
20:47:48 <ennael> #topic Mageia 6 dev1
20:47:56 <ennael> let's talk about hell :)
20:48:12 <Akien> \o/
20:48:16 <MrsB> Could you say what's been the main cause of the delay?
20:48:49 <ennael> well a mix of availibility of developers, geeks planning babies and ... time :)
20:49:16 <ennael> on classical isos side we had an issue with the first boot
20:49:27 <ennael> it took some time to get a fix done
20:49:42 <ennael> we still have an issue with systemd scriptlet failed during install
20:49:50 <ennael> but at least it works
20:50:42 <MrsB> People have been feeding back on the pad - i've not got that far yet though today :\
20:51:17 <wilcal> CI had a no go here installing gnome
20:51:43 <wilcal> install went clean but booted to a black screen
20:52:06 <sebsebseb> ennael: who's having a baby or planning too?
20:52:14 <ennael> I'm not :)
20:52:37 <Akien> Our highlander I believe
20:52:43 <sebsebseb> who?
20:52:56 <lebarhon> Oliver ?
20:53:07 <ennael> Akien: indeed :)
20:53:17 <sebsebseb> highlander???
20:53:24 <Akien> Well Oliver's baby(ies) has(ve) long done their harm to his contributions :p
20:53:59 <lebarhon> he tried a come back
20:54:08 <sebsebseb> what was meant by high lander?
20:54:24 <Latte> Oliver's 2nd son is there
20:54:52 <Latte> but this help not Olivers availability ;)
20:54:58 <ennael> ok so I have to fix 32 bits iso
20:55:43 <Akien> So from first results it looks like there are issues with custom partitioning, and issue bringing up the desktop as wilcal mentioned
20:56:06 <wilcal> but big progress with these ci iso's
20:56:10 <Akien> https://bugs.mageia.org/show_bug.cgi?id=17564
20:56:15 <wilcal> something works
20:56:33 <Akien> True :)
20:57:13 <Akien> On the optimistic side, once we do manage to get ISOs that install a working desktop, Mageia 6 should start looking quite good :)
20:57:24 <ennael> yep
20:57:40 <Akien> At least I'm using cauldron myself and it works pretty well.
20:57:43 <MrsB> I don't think the diskdrake bug will block dev1
20:57:52 <Akien> MrsB: True
20:58:04 <Akien> I'll put it release_blocker nevertheless so that it's not forgotten in the general development
20:58:20 <MrsB> yes
20:58:41 <ennael> ok sounds better indeed
20:58:46 <ennael> what about live isos ?
20:58:57 <wilcal> it's nice to start file'n some bugs for M6
20:59:27 <MrsB> have live's been rebuilt since isolinux fix?
20:59:44 <ennael> I don't thinks so but not sure
20:59:48 <ennael> tmb: ping ?
20:59:56 <MrsB> there was a build that wans't really QA ready
20:59:58 <wilcal> not yesterday or today
21:00:32 <tmb> yeah, the live isos need some fixes + rebuild
21:00:35 <wilcal> last live media was the 27th
21:00:42 <MrsB> if we can get them to install/boot/login we can call it cooked
21:01:18 <ennael> hi tmb
21:01:33 <tmb> but I need to do a new kernel first as there are atleast 2 non-booting regressions for radeon hw in current 4.4.4 kernel
21:01:42 <papoteur> A big issue (for me) was to not be able too choose the language/keyboard
21:02:34 <ennael> issue but not blocking for dev1
21:02:39 <ennael> still we need to fix it
21:03:07 <MrsB> is there a bug report for that papoteur?
21:03:27 <papoteur> MrsB: I look for
21:04:22 <MrsB> as long as one exists papoteur thta's ok
21:04:49 <papoteur> https://bugs.mageia.org/show_bug.cgi?id=17223
21:05:07 <MrsB> did you see the sha1 comments on ML ennael?
21:05:27 <ennael> saw it before the meeting I will have a look
21:05:59 <MrsB> seems like incorrect path
21:06:41 <ennael> yep
21:06:54 <papoteur> Check with Mageiasync is OK.
21:07:30 <MrsB> will file a bug for mageiasync ;)
21:07:45 <papoteur> MrsB: :/
21:08:42 <MrsB> I haven't checked so could be user error but the email showed /home/bcd/ etc in the iso path
21:11:49 <ennael> bug in my script sorry
21:11:55 <ennael> just fixed it on rabbit
21:11:58 <ennael> it should be ok now
21:12:46 <MrsB> cool thanks
21:15:19 <papoteur> do the classical ISO need to be rebuilt against new kernel ?
21:15:43 <ennael> yes I will do it
21:16:27 <papoteur> tmb when will be the new kernel available?
21:18:07 <tmb> papoteur, later tonight / tomorrow...
21:18:24 <MrsB> I'll let people know to expect new isos
21:18:25 <papoteur> OK
21:19:05 <Akien> Should we move on to the next topic?
21:19:08 <ennael> anything else ?
21:19:13 <sebsebseb> nope
21:19:15 <ennael> about dev1
21:19:17 <wilcal> on ward
21:19:17 <sebsebseb> nope
21:19:21 <sebsebseb> next topic
21:19:27 <MrsB> yep
21:19:45 <sebsebseb> one thing uhmm relealse in 2017 maybe at this rate :d
21:19:55 <sebsebseb> ,but other than that nope nothing more about Mageia 6
21:20:11 <ennael> #topic teams vote
21:20:22 <MrsB> ahh
21:20:41 <ennael> :)
21:20:47 <sebsebseb> yep anyone want to out vote MrsB from the QA leader (which would be silly ), here's your chance to try now
21:21:03 <MrsB> sebsebseb: it's not like that at all
21:21:08 <sebsebseb> I was joking :)
21:21:11 <MrsB> ok
21:22:07 <sebsebseb> but yes it's March so leader and deputy leader voting time
21:22:26 <MrsB> we began discussing this in QA a week or so ago and decided basically to stay more or less the same with one overall lleader and two deputies, but the deputies would take part in the running of the team to aleviate the workload somewhat
21:23:12 <ennael> ok
21:23:27 <MrsB> we have yet to vote on who those people will be though
21:23:44 <MrsB> it makes sens to get dev1 out before we begin I think
21:23:50 <MrsB> sense
21:24:25 <Latte> I would like to propose another guy for the i18n, because I'm not any kind of team leader
21:24:40 <Latte> However I doubt to find any volunteer in that group ;)
21:24:56 <MrsB> that makes you top choice :D
21:25:07 <sebsebseb> I remember our dicussion at Brussels Latte you are probably ok leader :)
21:25:14 <DavidWHodgins> I think each team should decide what structure they want. The only thing the council should decide is how many reps each team can have.
21:25:28 <MrsB> yes
21:26:46 <sebsebseb> I think it's suaully two for a team, but ok QA has three now
21:26:47 <Akien> So should all team leaders start discussing this with their teams?
21:26:50 <sebsebseb> or had three
21:27:00 <MrsB> yes
21:27:15 <ennael> could we fix a deadline ?
21:27:28 <sebsebseb> end of march?
21:27:45 <sebsebseb> or vote by say 21st March?
21:27:54 <papoteur> two weeks for starting to vote?
21:28:09 <MrsB> I'd like to move dev1 out before we begin
21:28:30 <sebsebseb> yeah, but that can happen in the background anyway I guess, but I see your point to an extent
21:28:45 <MrsB> lol @ in the background
21:28:46 <sebsebseb> altough that would mainly effect QA and packeger teams  not the reest I guess
21:28:50 <ennael> MrsB: :)
21:28:52 <MrsB> yeah
21:29:21 <sebsebseb> Atelier doc team etc don't have to do much for now :d
21:29:26 <MrsB> set a date, we'll just have to work to it
21:29:53 <MrsB> we can co it inside a week probably, so end of march is probably ok
21:29:56 <MrsB> do*
21:30:08 <sebsebseb> what's that rfor getting dev 1 out? heh
21:30:37 <MrsB> welcome to help sebsebseb
21:31:05 <MrsB> was everybody generally ok with end of march as a deadline?
21:31:12 <ennael> so let say try to do it by the end of march
21:31:14 * sebsebseb has some sort of life away from Mageia as well :d heh
21:31:38 <sebsebseb> end of March for dev 1 you mean?
21:31:42 <sebsebseb> or for team votes?
21:31:50 <ennael> what is the current topic?
21:31:59 <sebsebseb> team votes
21:32:06 <ennael> bingo :)
21:32:24 <sebsebseb> end of march for a team vote ok
21:32:32 <MrsB> #info end of march deadline for team leadership elections
21:33:06 <MrsB> let's press on
21:33:49 <ennael> ok
21:33:54 <ennael> anything else ?
21:33:57 <ennael> other topic ?
21:34:10 <DavidWHodgins> iso validation
21:34:32 <MrsB> you mean after the mint thing?
21:34:57 <DavidWHodgins> I'd like to see sha1 replaced with sha512, gpg sigs for the full iso, not just the sums, an the iso signing key signed by all council members
21:35:01 <MrsB> there was some discussion on discuss ml
21:35:03 <DavidWHodgins> MrsB: Yes
21:35:35 <MrsB> signed iso shouldn't be too difficult
21:35:38 <sebsebseb> I think Ubuntu acstaully ahs the lost,  md5sum, sha1sum sha256sum
21:35:42 <sebsebseb> we could have the lot as well?
21:35:57 <sebsebseb> apparnatly there's some gpg way to verify a ISO as well or wahtever it was, something newer, that's meant to be more secure
21:36:19 * sebsebseb remembers seriosuly checking the ISO's in all three provided way before for Ubuntu
21:36:29 <MrsB> #topic ISO validation
21:36:48 <MrsB> #info <DavidWHodgins> I'd like to see sha1 replaced with sha512, gpg sigs for the full iso, not just the sums, an the iso signing key signed by all council members
21:37:01 <sebsebseb> yes we could provide it all?
21:37:09 <MrsB> tmb ennael does this sound workable?
21:37:17 <DavidWHodgins> I don't see any reason we couldn't.
21:37:22 <sebsebseb> although if hte website gets broken into like Mint,  then people can change the code hmm
21:37:50 <DavidWHodgins> We all have @mageia.org email addresses we could set up keys for, and sign the iso signing key with.
21:37:56 * ennael do not dare to contradict DavidWHodgins
21:37:58 <ennael> :)
21:38:11 <DavidWHodgins> sebsebseb: True, there is only so much we can do.
21:38:13 <DavidWHodgins> ennael: lol
21:38:31 <sebsebseb> DavidWHodgins: no only some people have @mageia.org email addresees I don't etc
21:38:33 <MrsB> we'd probably need one of your key signing tutorials Dave
21:38:56 <DavidWHodgins> I thought all council members have @mageia.org addresses.
21:39:04 <sebsebseb> DavidWHodgins: nope :(
21:39:33 <DavidWHodgins> Also, the existing key should be reused. Just has to be edited by someone with the private key, to extend the expiry date, each year.
21:39:46 <DavidWHodgins> Only change keys if there is a known leak of the private key.
21:39:52 <sebsebseb> all major enough contributers should have @mageia.org really in my opinion, but that's something that got dicussed before, and didn't happen
21:40:29 <papoteur> DavidWHodgins: Ah?
21:40:45 <DavidWHodgins> We should wait till after the election, then ensure all council members have @mageia.org email addresses
21:41:07 <sebsebseb> IRC cloaks is another one,  that should be sorted out to really
21:41:11 <MrsB> i thought it was so already
21:41:23 <Akien> sebsebseb: Please, try to stay on topic.
21:41:31 <sebsebseb> nope only packagers and such got @mageia.org
21:41:44 <DavidWHodgins> papoteur: We've been creating new signing keys for the iso signing when the old one expires instead of editing it to extend the expiry date
21:42:03 <tmb> DavidWHodgins, nope, not true
21:42:30 <tmb> I'm extending the signing keys every year
21:43:16 <DavidWHodgins> There's 0xDA10B483, 0x41BCD9E7
21:43:33 <tmb> the only time we had to do a new key was when we stopped using old rabbit _way_ back and had forgot backups of private key...
21:43:36 <DavidWHodgins> Those are still on the key servers, though expired
21:43:51 <DavidWHodgins> Ah. Ok. My mistake
21:44:39 <MrsB> sha512 sum could be added and probably iso hash too without too much bother
21:45:17 <ennael> I can have a look
21:45:24 <DavidWHodgins> Internally, gpg creates a hash (forget which type now), and signs that, so it just makes it faster to check. One step instead of two.
21:45:24 <MrsB> will need to add to dorsync if we go ahead with it
21:45:25 <ennael> sorry all kids crying have to leave
21:45:37 <tmb> yeah, those are simple... gpg signing a whole iso takes a long time but I guess we can live with that too
21:45:42 <ennael> I let you end the meeting
21:45:49 <MrsB> ok ennael thanks nite
21:45:57 <DavidWHodgins> tmb: No longer than generating the sums and signing them
21:46:06 <MrsB> #chair Akien
21:46:06 <Inigo_Montoya`> Current chairs: Akien MrsB ennael
21:46:07 <DavidWHodgins> ennael: Have a good night
21:46:13 <Latte> ennael: thanks
21:47:43 <papoteur> What is the mechanism to check the integrity then?
21:47:44 <Akien> I have no clue about ISO signing personally, should we open a bug report to document what has to be done, or have someone write it up in a dev@ email?
21:48:25 <MrsB> currently we have md5 and sha1 hashes of the iso, each of the hashes are then signed
21:48:28 <tmb> Akien, a bug report assingned to release.... someting whould do...
21:48:45 <DavidWHodgins> It's part of iso creation, so I assume just tmb/ennael involved, but a bug report for tracking is a good idea.
21:49:11 <MrsB> dave is proposing to sign the actual iso too and also to add a new hashing mechanism - sha512 - which is more secure
21:49:33 <MrsB> the down side is that the iso is 4Gb and it would be slow
21:49:44 <MrsB> the upside is that it's more secure this way
21:49:50 <DavidWHodgins> papoteur: Download the key from a public key server, the iso, and the sig for the iso, then use pgp or gpg to verify the signature is valid.
21:50:09 <DavidWHodgins> MrsB: The same amount of time as generating a sum and signing that
21:50:17 <DavidWHodgins> That's what pgp/gpg do internally
21:50:29 <tmb> yeah, it's not much extra code to have bcd/draklive generate more shas... the signing of the isos happends only after QA ok the iso for release
21:50:46 <MrsB> so no longer then
21:50:51 <tmb> signing of the sha/md sums
21:51:30 <DavidWHodgins> It's another step, but no longer than generating sha or md5 sums and signing them.  Acually slightly faster, as it's all one step.
21:51:30 <MrsB> shall we OK this then ?
21:51:53 <DavidWHodgins> I vote yes. :-)
21:51:55 <MrsB> so iso and all ahshes all signed
21:51:58 <MrsB> hashes
21:52:15 <MrsB> and add sha512
21:52:16 <tmb> ashes :)
21:52:16 <sebsebseb> waht's that having it all? sha1sum sha256sum md5sum etc?
21:52:24 <Akien> haschisch?
21:52:30 <MrsB> Oopsie
21:52:31 <DavidWHodgins> May as well replace sha1 with sha512
21:52:41 <sebsebseb> 512????
21:52:44 <sebsebseb> is there a newer one?
21:52:48 <MrsB> we need to decie as we'll need to update our tools
21:52:55 * sebsebseb may as well have all optons to check the ISO that's what I am thinking
21:52:55 <MrsB> decide*
21:53:02 <DavidWHodgins> sha512 has been around for years
21:53:15 <MrsB> dorsync, mageiasync
21:53:18 <sebsebseb> sha256 was one I used as well not 512 I think hmm
21:53:23 <sebsebseb> for Ubuntu checking
21:53:28 <DavidWHodgins> It's in coreutils
21:53:35 <DavidWHodgins> On Mageia 5
21:53:39 <papoteur> Oops, work for me :/
21:53:42 <papoteur> ;)
21:54:10 <sebsebseb> bbut yes whta's better and more secure is the way to go
21:54:13 <sebsebseb> for this kind of thing
21:54:21 <MrsB> do we ADD sha512 or REPLACE sha1 wiith sha512
21:54:26 * sebsebseb hopes our website and servers are secure enough to, hmm
21:54:31 <DavidWHodgins> Replace, in my opinion
21:54:37 <sebsebseb> add in my opinion
21:54:43 <sebsebseb> keep md5sum there to
21:54:46 <sebsebseb> just provide the lot :)
21:54:50 <MrsB> tmb?
21:55:00 <sebsebseb> tmb
21:55:09 <sebsebseb> ? won't  high light him probably heh
21:55:24 <papoteur> If one key is corrupted on the server, three keys will be also.
21:55:56 <sebsebseb> exactly the servers need to be secure enough to, or would could get a mint style attack hmm
21:56:03 <sebsebseb> or we could get above
21:56:19 <papoteur> The security comes from the other way to do the check.
21:56:30 <sebsebseb> which other way?
21:56:49 <tmb> sha512 takes 10 seconds on LiveDVD
21:56:50 <papoteur> with gpg key
21:57:01 <MrsB> add then?
21:57:07 <papoteur> tmb OK ;)
21:57:10 <sebsebseb> yes using any of htos md5sum, sha256 etc should all be quick in terminal
21:57:18 <sebsebseb> add whatever so we have them all? :)
21:57:22 <sebsebseb> all ways to check ISO?
21:57:46 <DavidWHodgins> sebsebseb: We don't want to add too many files for download. The download screens are pretty cluttered already.
21:57:48 <MrsB> #info We'll add an sha512 sum rather than replace one of the others
21:58:14 <MrsB> we can revisit again later when everyone is awake :)
21:58:29 <DavidWHodgins> lol
21:58:31 <sebsebseb> as for the gpg check thing that's just a compelty differnet way to check isn't it?
21:58:35 <MrsB> Is there anything else?
21:58:37 <tmb> yeah, lets just add for now so papoteur dont have to change the code directly :)
21:59:05 <tmb> yeah... bed time :)
21:59:06 <sebsebseb> the code in the tool?
21:59:17 <MrsB> T - 5
21:59:23 <papoteur> sebsebseb: in Mageiasync
21:59:27 <DavidWHodgins> I'd think it would be easier to change  the sha1sum command to sha512sum rather then add it.
21:59:52 * MrsB cancels the countdown
22:00:00 <MrsB> let's decide please
22:00:10 * sebsebseb blames tmb if the Mageia servers turn out not to be secure enough, heh joke kind of
22:00:13 <MrsB> Please choose ADD or REPLACE
22:00:24 <DavidWHodgins> I vote replace
22:00:24 <sebsebseb> ADD
22:00:37 <MrsB> tmb papoteur
22:00:39 <tmb> DavidWHodgins, I meant for people using old mageiasync it will still be happy... then nes one extends that and all still hapy
22:00:53 <papoteur> REPLACE
22:00:54 <tmb> *next one*
22:01:00 <DavidWHodgins> tmb: Ah. Ok.
22:01:23 <Akien> REPLACE is fine by me.
22:01:25 <papoteur> tmb OK
22:01:37 <sebsebseb> is what's being replacedd if one is going to get replaced
22:01:40 <sebsebseb> more secure yeah I guess so
22:01:57 <sebsebseb> maybe md5sum should be replaced if going to replace something, apparnatly that one isn't so secure anymore, but whatever
22:02:02 <DavidWHodgins> next was providing sigs for the iso images themselves
22:02:08 <MrsB> we have 3x replace and 2x add
22:02:19 <wilcal> replace the least secure
22:02:30 <sebsebseb> which is the least secure?
22:02:36 <sebsebseb> md5sum ?
22:02:52 <tmb> of you do REPLACE then you need to push it to updates too for stable users...
22:03:08 <sebsebseb> tmb: so adding is easier then :) ?
22:03:18 <MrsB> that's a good reason to ADD
22:03:30 <DavidWHodgins> tmb has convinced me add is better, so changing my vote
22:03:34 <sebsebseb> so ADD wins :)?
22:03:41 <papoteur> yes
22:03:42 <sebsebseb> ok good looks like ADD wins :)
22:03:56 <MrsB> Let's just stay with ADD for now then as per the info
22:04:01 <MrsB> thanks everybody
22:04:29 <MrsB> next was providing sigs for the iso images themselves
22:04:50 <tmb> I can add that to the iso signing procedure...
22:04:55 <MrsB> cool
22:04:57 <MrsB> thankyou
22:05:01 <DavidWHodgins> Makes it simpler to check. One step instead of two, both for creating the sig and verifying it.
22:05:02 <MrsB> happy Dave?
22:05:09 <DavidWHodgins> Yep
22:05:21 <MrsB> #info We'll add signing for the ISO too
22:05:29 <DavidWHodgins> The last item was having everyone sign the iso signing key
22:05:39 <MrsB> let's come back to that one
22:06:14 <tmb> to do that securely, it would have to be IRL key signing like k.org did
22:06:15 <MrsB> Is there anything else for tonight?
22:06:20 <leuhmanu> (hello I will check if could adapt extension from tails https://tails.boum.org/install/linux/usb/index.en.html)
22:06:24 <wilcal> not from me
22:06:34 <sebsebseb> tmb: so FOSDEM ?
22:06:44 <sebsebseb> but some people don't go to FOSDEM or yet such as MrsB hmm
22:06:51 <DavidWHodgins> tmb: No. Anyone can sign the public key and upload the signed key back to the key servers
22:06:54 <papoteur> I must leave. Good night
22:07:01 <MrsB> Nite papoteur thanks
22:07:08 <MrsB> I think we can wrap this up for tonight
22:07:12 <DavidWHodgins> Have a good night papoteur
22:07:20 <MrsB> T - 5 then peeps
22:07:24 <DavidWHodgins> Yeah. The signing can be done anytime.
22:07:25 <MrsB> 4
22:07:29 <MrsB> 3
22:07:32 <MrsB> 2
22:07:35 <sebsebseb> the end
22:07:35 <MrsB> 1
22:07:40 <DavidWHodgins> :-)
22:07:41 <MrsB> Thanks for being here everybody !
22:07:42 <sebsebseb> the end of meeting
22:07:46 <MrsB> #endmeeting