# Devuan meet 2021-06-03 @20:30 UTC

Present: Xenguy, Rick Moen, plasma41, mason, fsmithred, LeePen, tuxd3v,
golinux Apologies: Adam (vax issues, not with DEC but with Astra & her
friend Zeneca ;)

## Old Business

## Old Actions

## New Business

### golinux
* FlibberTGibbet [09:08:26] Hi all, just realised about the change of
  irc networks. friendsofdevuan.org is due to expire on 12 June and I'm
  not really minded to pay to keep a moribund site going. If anyone
  fancies taking it on, let me know, otherwise it'll be in the aether
  after that.
  * (Xenguy) There is a link to friendsofdevuan.org on one web page, but
    it is currently commented out.
    * Flibber said he was dropping that domain last year but he forgot
      to do it.
* The new "packaging" forum is open for business but no takers . . .
  Participation needed.
* From an email sent to freedom@???: I'm glad to announce to you
  that I've created the very first Devuan group into Brazilian
  Portuguese. It's hosted on Telegram at https://t.me/Devuanpt_BR  And
  I'd like to have you approval on the matter. From Du_Querido
  * UPDATE:  S/He is now a member of the forum

### Beer (Won't attend)(golinux sheds a tear)
* `130.225.254.116`, part of `deb.devuan.org` (`PTR`:
  `mirrors.dotsrc.org.`) unresponsive for 48h (at the time of this being
  written) Would temporarily dropping unresponsive mirrors from the pool
  be a doable thing?
  * (onefang) As I mentioned already in IRC, this is what I'm working
    on.  Automated testing and selection of which mirrors are on the
    DNS-RR, using apt-panopticon as the testing mechanism.  This was
    discussed in previous meetings, I've just been snowed under with
    everything, and also had to await admin access to things.

### LeePen

#### Jenkins Fixed package build pipeline to accommodate change in
behaviour of pbuilder in chimaera.

#### Amprolla
* verification of upstream GPG signatures stable in testing. Will deploy
tomorrow.
* working on recursive banned package exclusion.

#### Dak web api Following discussion about making package maintenance
easier last week and with bgstack15 about his new fork of xrdp, I
think it would help to enable the dak web api. It can be accessed
using the rmadison(1) command from the devscripts package. We already
have most of the pieces in place. New requirements:-
* public DNS to a VM with nginx. Hostanme?
* nginx reverse proxy to dak
* wsgi server on dak running dakweb application

#### Updates in ceres
* policykit-1 (fix CVE-2021-3560)
* apt and tomcat9 (thanks amesser).

### Rick Moen Test installation of Mailman 2.1 ran into two CVEs not
fixed in the best Debian package (v. 2.1.29-1+deb10u1). (Missing
sysvinit support was an easy fix, and already noted.) The alternate
suggestion of getting Debian LTS sourcing isn't possible, as Debian
LTS will not support Buster for a year and there's no reason to think
they'll do Mailman 2.x at all. Backports ditto. Conclusion: MM 2.1
is not just going away but not even practical for near-term
installation on Devuan-stable. Adam did a test installation of
Mailman 3 in a Beowulf VM, and I'm awaiting his comments. Can revert
my work on backup.devuan.dev with 2.1 and build MM3 if we want to go
that way. On IRC #devuan-dev, "onefang" pushed for courier-mlm as
provided by the courier MTA. We hadn't considered its merits, so I
noted the suggestion without further comment. One obstacle is that
backup.devuan.dev is a production host that relies on Postfix, and I
have carefully avoided messing with that. My inclination is to go
ahead with Mailman 3 -- despite it being quite a bit more complex than
MM 2.1 (e.g., reliant on a database back-end, as is Sympa), and quite
different. For the record, other credible MLMs: Sympa, mlmmj (mail
suite including MTA), ezmlm (optional component of a mail suite
including MTA qmail), mailtrain. As it has come up in discussion, no,
we should not seriously consider Brent Chapman's Majordomo, as it is
(1) long-orphaned, and (2) proprietary. There was for a while an
effort to create Majordomo2 as an open-source successor, but it
folded. And for completeness's sake, Smartlist, ListProc, BeroList,
NList, TULP, minordomo, and procList are also way too antique. And
LISTSERV is both antique and proprietary. Disclaimer: I've not
investigated practicality / packaging on Devuan/Debian of any of the
alternative MLMs. (MLM means mailing list manager, not multilevel
marketing. ;->) (adam) acknowledging your concern with MM2.x, let's
go with MM3. we get to learn and we implement a more sustainable
solution. (adam) i would suggest if you back out the MM2.x changes, we
can try installing default, vanilla Beowulf mailman3 together
following my initial notes and kick the tyres of the default v3
system, before even attempting to import lists from the old MLM(s).
[RM] Excellent to hear. Will do! And will love to see your notes.
(adam) very rough,
https://pad.dyne.org/code/#/2/code/edit/F3dwZxCSy99pv6ShWxhu93qv/

## New Actions

### Xenguy
* [x] Ping mason on IRC re: the `friendsofdevuan.org` domain name:
  * **Q.** Does mason anticipate any need for that domain in connection
    with his 'wiki' project? The domain expires in about 1 week.
    * **A.** As golinux mentions below, `wiki.devuan.org` will be used
      for any future wiki, so `friendsofdevuan.org` domain can be
      allowed to expire.
  * (gl) The "official" wiki should be wiki.devuan.org, right?