Chris Lamb

Started in late 2014, [Debian LTS](https://wiki.debian.org/LTS/ "Debian LTS") exists and has provided additional security support for the Squeeze, Wheezy and Jessie releases. LTS support for Stretch is also planned. In this BoF we want to briefly explain how LTS is done, how you can support it, either finanically or by volunteer work and provide a venue for discussions how to improve it. The targetted audience for this talk is everyone, user, contributor, sysadmin, sponsor, you. Though of course due to the subjects being discussed this will be a quite technical discussion.

Other people: Hugo Lefeuvre Holger Levsen Markus Koschany

Static analysis tools are criminally underused in software engineering; not only can they detect many common problems, pitfalls and security issues, unlike test suites, no additional code needs to be written. Futhermore, many tools provide helpful hints on how to fix the issues they expose. In Debian, Lintian dissects packages and tries to find bugs and policy violations. It contains automated checks for many aspects of Debian policy as well as some checks for common errors. Reports are generated and published on the lintian.debian.org website. In this talk you will learn about the past, present and future of Lintian, as well as how to contribute and make Debian better.

The goal of this talk is to give the whole Debian community an update on the state of Reproducible Builds in Debian and in the whole free software world as well as to explain what we are aiming for the bullseye release. It’s been 6 years since Reproducible Builds were first introduced to the Debian community at large at DebConf13 in Vaumarcus and much progress has been achieved since, yet the buster release has not really achieved reproducible builds. In this talk we will explain the current status, explain what's missing and hopefully present workable ideas how to improve things for bullseye.

Other people: Holger Levsen Vagrant Cascadian

In late 2018, Redis Labs relicensed a number of GNU AGPL-licensed Redis modules with the "Commons Clause" amendment. This talk outlines the history, background, and response to this style of license, and explains how this is ultimately a short-sighted and retrograde step for the companies that are advocating for these licenses.

In August 2018, Redis Labs relicensed a number of AGPL-licensed Redis modules with the "Commons Clause" amendment on the grounds that it prevents abuse and therefore ensures the sustainability of its development.

As this renders the software no-longer free and open source, GNU/Linux distributions such as Debian and Fedora are unable to ship Redis Labs' versions of the affected modules to their users.

This talk from a long-time (2009) Redis user & developer will outline the history, background & response to this flavour of license, as well explain how this it at odds with communities in which they participate in and are ultimately are a short-sighted & retrograde step for the companies and individuals that are advocating for them.

Furthermore, this talk will ask some thought-provoking questions about how the the conversation around "sustainability" in open source is being co-opted by foregrounding of financial elements to the detriment of the principles & people that have so clearly and demonstratively served us so well in the past four decades.

The goal of this talk is to give the whole Debian community an update on the state of Reproducible Builds in Debian and in the whole free software world. It's been 5 years since Reproducible Builds were first introduced to the Debian community at large at DebConf13 in Vaumarcus and much progress has been achieved since. In this talk we will present some milestones we have reached since then, show where our current blockers are and give an outlook on what we consider still achievable until the Buster freeze. While it is true that we have been quite succesful in promoting Reproducible Builds, both the concept as well as actual patches in a great number of projects, too many people are misled by our "93% of Debian packages are reproducible (in theory)" statistics and other things. So, to sum up, Buster is not frozen yet and so we are still working on making Buster as reproducible in practice as possible. And we want to go even further in future! To achieve this we want and need to take all of Debian with us on this journey.

Other people: Holger Levsen

Projects like Debian can only exist in a connected world, but the immense increase in communication capability of the Internet also has a dark side. The same capabilities that enable intense technical collaboration across immense distances also make it possible for negative voices to be amplified. This session will be a panel discussion featuring some well-known, long-time contributors to Debian who are willing to share their experiences and advice on how to remain focused on what's important. Criticism is vitally important to Debian, but developers need to be able to extract the constructive elements from public discussions. Hopefully, the content of this session will help!

Other people: Bdale Garbee Enrico Zini Steve McIntyre

State of the project, ongoing activities, etc..

If you develop or distribute software of any kind, you are vulnerable to whole categories of attacks upon yourself or your loved ones. This includes blackmail, extortion or "just" simple malware injection! By targeting software developers such as yourself, malicious actors, including nefarious governments, can infect and attack thousands -- if not millions -- of end users.

How can we prevent these disasters? The idea behind reproducible builds is to allow verification that no flaws have been introduced during build processes; this prevents against the installation of backdoor-introducing malware on developers' machines, ensuring attempts at extortion and other forms of subterfuge are quickly uncovered and thus ultimately futile.

Through a story of three different developers, this talk will engage you on this growing threat to you, and how it affects everyone involved in the production lifecycle of software development, as well as how reproducible builds can help prevent against it.

Whilst anyone can inspect the source code of free software for malicious flaws, software in Debian is distributed pre-compiled to end users. The motivation behind the Reproducible Builds effort is to permit verification that no flaws have been introduced — either maliciously or accidentally — during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised. This talk will explain the current status of the Debian Reproducible Builds project, what has changed in the last year, how this is relevant to you as a maintainer, and how this is relevant for the complete free software eco system and, finally, how you can contribute.

Other people: Holger Levsen

State of the project, ongoing activities, etc..

There are many in-person Debian events apart from DebConfs including Bug Squashing Parties, hackathons, summits and sprints. These have not only been socially rewarding but incredibly productive for the project. This BoF will touch on all subjects around easing organisation of events, plus ideas on how to improve existing ones - what works & what doesn't.

With free software, anyone can inspect the source code for malicious flaws. But Debian provide binary packages to its users. The idea of “deterministic” or “reproducible” builds is to empower anyone to verify that no flaws have been introduced during the build process by reproducing byte-for-byte identical binary packages from a given source. This talk will explain the current status of the Debian Reproducible Builds project, how this is relevant for the complete free software eco system and how you can contribute.