The way I interpret this is someone, instead of coordinating things with Daniel, who is the upstream of that package and the maintainer of the package, they just went and fixed it using an inferior fix that Daniel was trying to ship in his own conflicting possible future version.

That is pretty ignorant, and I can't blame Daniel.

This is somewhere up there with Debian habitually backporting security patches into an ancient version of Apache to the point its a broken unsecure mess, and adding an unapproved patch to ssh that caused it to generate completely broken and highly unsecure keys.

AFAICT you have it backwards -- the other packager is the upstream developer and maintainer of the pre-existing ubuntu package. The only thing that Daniel's package had going for it was that he had submitted it earlier, but he had not gone through the process of filing an ITP to tell other people that they don't need to spend time on packaging it.

I find the whole thread somewhat cringey to read and I'm not sure why he thinks it reflects well on him.

Is there an ITR process ("Intent To Replace")? Because the issues REALLY got bad when the following was written:

  live-build has been deprecated by debian-cd, and live-build-ng 
  is replacing  it. In a purely Debian context at least, live-build
  is deprecated. live-build-ng is being developed in collaboration
  with debian-cd and D-I.

  I'm aware that I'm going to be upsetting people, but this has been 
  a long time coming and I'm not going to spend time bikeshedding
  over naming. I would rather spend that time on integration of live
  image creation into official Debian infrastructure and building 
  the best system for live image creation possible.

  Consider this thread marked as wontfix.

https://lists.debian.org/debian-live/2015/11/msg00008.html

So in other words, there was an upset about Daniel not filing an ITP, and then this casual email gets sent saying an entire project has been deprecated, that discussion is not needed as it was a fait accomplis and the hundred and thousands of man hours people contributed to it weren't important?

Not good, and very poorly handled.

That one stood out to me - plus the other part that says that debian-live was never an official project, which seems to be in contradiction to https://www.debian.org/News/weekly/2006/08/

Well, too late does that same guy realise that things have gone pear shaped!

He's gone from "this has been a long time coming" and "consider this thread marked as wontfix" to the below:

https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=155;bug=80...

  original aim for this was that this new tool would be integrated 
  into the existing Debian Live project, and that we would bring 
  the Debian Live project into Debian. This is not the way it 
  has gone.

Except that is not what he wrote. He didn't say anything about integrating into the project. Instead he said the project a. Wasn't an official Debian project (when actually it does look like it was), and b. They were about to deprecate the entire project!

I have to call bullshit on this one. There was never any intent to integrate with the project.

That's one dishonest email!

> Wasn't an official Debian project (when actually it does look like it was)

There were no Debian Developers involved in Debian Live of late, because Daniel (somehow -- I don't care for the drama) got removed as a Debian Developer. I don't know for sure, but I would totally believe that it was officially a Debian project in 2006 but was not in 2015.

As a Debian Live user, this situation was quite a bit confusing: the only Debian-related URL it had was live.debian.net (in the debian.net namespace that any Debian developer can request a DNS record for, pointing anywhere), and it really seemed to live on live-systems.org, which pointed to the same servers.

Sadly, it sounds like the e-mail you get from mangers when they want you to keep working until your replacements are ready to discard you properly. I agree with you that those two e-mails say totally different things.

Sadly the Linux ecosystem seems to be getting a whole lot of that managerial double talk lately.

Regardless of who was in the right, there's a number of people on that thread who come off as incredibly disrespectful and should be issuing public apologies for their behavior. I get that it was a heated argument, but people deserve more respect than that, especially when they're volunteering their time.

No. Because Daniel ignored protocols someone else had to volunteer time to clean up that mess. It's quite possible such thing happened before and Daniel failed to learn a lesson. Either way — it's pointless drama and rage quit.

> This is somewhere up there with Debian habitually backporting security patches into an ancient version of Apache to the point its a broken unsecure mess, and adding an unapproved patch to ssh that caused it to generate completely broken and highly unsecure keys.

Please don't spread FUD.

Debian does a great job of creating and maintaining a stable, secure, and coherent operating system.

They may modify upstream software so that it complies with the Linux FHS, but the goal is to achieve a coherent system (e.g. config in /etc, data in /var/lib, etc). IMO, they do a better job than any other Linux distro.

Debian also has a strict policy on decoupling libraries from programs. This means that when a security update is released (e.g. the security fix for latest libpng vulnerability), you only need to update a single package.

Finally, Debian aims to be stable, which means they'll keep an eye out for vulnerabilities and backport fixes. This is done instead of forcing you to move between versions of software, which has the potential to break things, or create new security issues (e.g. changes in config).

The Debian+openssl vulnerability happened in 2008. Go back, and look at Debian's security record (e.g. go to LWN and see Debian release fixes for the latest vulnerabilities just as quickly as Red Hat and Canonical/Ubuntu).

You're preaching to the choir however.

I've used Debian for over 15 years, use it on all my home machines that run Linux, and also use it for prod everywhere at work. Everything you listed is why I still use Debian, even when Debian politics like this keeps ruining Debian further.

I won't touch Ubuntu with a twelve foot pole, and I think RHEL family distros are trash.

However, when I say Debian has deep internal politics issues, I am saying this unbiasedly: I like Debian, but I wish they'd stop ruining my distro of choice.

The final email on this page is a very important read. If you tl;dr this link, skip to the last email before you leave.

Can someone give us a clue what's going on in this thread? I can't follow the jargon at all.

A group of people failing to cooperate, communicate, or generally work together in a reasonable way. It's both a failure of each individual to work together constructively amongst some confusion or disagreement and a systematic failure of the whole organization to set expectations and have reasonable clear remedies for such conflicts.

"ITP" stands for "intent to package". When you want to package something in Debian, you file a Debian bug with "ITP" in the subject. (The bug is filed against "wnpp", an entry in the bug tracker that doesn't actually represent a Debian package but represents "work-needing and prospective packages.")

The ITP bug does not actually do anything with regards to the upload process; it's simply a coordination point. You can ignore the ITP process and upload a package straight to "NEW".

For historical reasons, the team that maintains the Debian package archive is called the "ftp-master" team, though the archive is generally retrieved via HTTP. They have the final authority (subject to, like, a project-wide vote or whatever) on what actually goes into the archive, and it's their job to prevent things like packages being hijacked from an active maintainer, in addition to verifying free software status, non-atrocious packaging quality, etc. Part of that verification takes time, especially for brand-new packages.

What happened in this bug is that Daniel did not file an ITP and uploaded the package, and Serge did file an ITP and uploaded the package, and the NEW queue got both of them. Who's in the right is pretty unclear. Daniel had his package in the queue well ahead, but Serge followed the procedure, and the very reason the procedure exists is to avoid conflicts like this. So Ansgar, a member of the ftp-master team, told them to work it out amongst themselves (a common response for conflicts). Later, Paul, also on the ftp-master team, said the same thing in stronger words, in the email rejecting both of their uploads.

Serge also had uploaded a newer version of cgmanager which unblocked systemd-shim (the compatibility layer for running non-systemd systems). Daniel had uploaded an older version that was not useful for systemd-shim.

So Daniel and Serge worked things out amongst themselves, except Daniel did not actually get around to uploading his package, so Serge uploaded his original package after timing out on Daniel.

Serge was technically in the right, but that isn't really the metric. Serge was also probably socially in the right, but this was unfortunately a murky case.

Paul accepted Serge's next upload after hearing both Serge and Daniel saying that they were working together, even though Serge just uploaded his original package (without Daniel's packaging and without listing him as a maintainer).

There are obvious echos with what happened in Debian Live: Daniel feels hurt because other people ignored work he was doing in favor of their own thing, and everyone else felt frustrated because Daniel's work didn't support things that the rest of Debian needed, and there was no sign of that changing in a timely fashion.

Actually, it appears that Daniel was wronged there also. If you are going to upload a new package and you know there might be a conflict, wouldn't you notify the other person?

Seems like Daniel has been wronged. Dick move by the debian-cd teams.