<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr">On Mar 7, 2022, at 1:34 AM, Ben Cooksley <bcooksley@kde.org> wrote:<br></div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div class="gmail_quote"><div>Thanks to those who have now responded and your packaging work.</div><div>Compared to when this incident began requests have now reduced noticeably.</div><div><br></div><div>Due to their failure to respond, I have now suspended pre-release package access for the following distributions:</div><div>- Aosc</div><div>- Manjaro</div><div>- Mageia</div><div>- PLD</div><div>- Solus</div><div>- Homebrew</div><div><br></div><div>With respect to Ubuntu and Debian, these two distributions are requested to advise when they have released the fixes.</div><div><br></div><div>I'm extremely disappointed in both Debian and Ubuntu for the delay they've had in releasing these updates. Their conduct falls well short of what I had expected.</div><div>In the future items such as this will likely need a CVE to be requested for them (regardless of how appropriate that may be) to ensure these two distributions act appropriately.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_quote"><div></div><div><br></div><div>If those distributions could please acknowledged the steps they have taken that would be much appreciated (I'd really prefer not to have to send individualised followups)</div><div><br></div><div>Special mention in this goes to Ubuntu/Canonical, who currently have their release of the fixes held up in internal policies and workflows - despite representing half of the traffic being generated by this whole incident at one point in time.</div><div>(and it looks like users won't see the patches from them for at least another week). Suffice to say, i'm extremely displeased with them.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><br></div><div>Thanks,</div><div>Ben Cooksley</div><div>KDE Sysadmin</div></div></blockquote><div><br></div><div>Thanks,</div><div>Ben </div></div></div></blockquote><div><br></div><div>Regards,</div><div>Ben </div></div></div>
</div></blockquote><br><div>I assume Homebrew didn't respond because they do not package Discover, or any part of Plasma. The only (few) parts of Plasma that are packaged for Homebrew are in the KDE Invent repository[1]. Moreover, most of the formulae that made it upstream are maintained by KDE community members.<div><br></div><div>So, technically, you just suspended access to other KDE community members. No real bother, as Git HEAD can be easily used anyway.</div><div><br></div><div><br></div><div>As for the rest of this message/thread, I highly recommend that everyone including Ben remind themselves of the KDE Community Code of Conduct[2].</div><div><br></div><div>Best,</div><div>-A.</div><div><br></div><div>[1]: <a href="https://invent.kde.org/packaging/homebrew-kde">https://invent.kde.org/packaging/homebrew-kde</a> - to which I contributed Tellico and some fixes.</div><div>[2]: <a href="https://kde.org/code-of-conduct/">https://kde.org/code-of-conduct/</a></div><div><br><div dir="ltr"><div style="direction: inherit;">--</div><div style="direction: inherit;">A. Wilcox (Sent from my iPhone)</div><div style="direction: inherit;">Mac, iOS, Linux software engineer</div><div><br></div></div></div></div><div><br></div></body></html>