I figured out that pbuilder ignores secure apt's verification warnings, and was deeply disappointed. One cannot tell everyone that pbuilder is the preferred build environment when pbuilder is happily using untrusted debs to build. After some digging, however, I found out that it's fairly easy to build a trusted pbuilder environment:

pbuilder create --debootstrap debootstrap --debootstrapopts --keyring=/etc/apt/trusted.gpg

This tells pbuilder to tell debootstrap to check packages using the default apt keyring. In turn, debootstrap will install the keyring in /etc/apt/ in the chroot, and so that the rest of the apt-installing done inside the chroot will verify the packages. Note that I also had to force pbuilder to use debootstrap instead of cdebootstrap, because cdebootstrap doesn't support --keyring. Also, --keyring is not (yet) documented in debootstrap's manpage, although you can find it in debootstrap --help. Note: I put this tip on the Debian Wiki at: http://wiki.debian.org/SecurePbuilder, and that version may in the future become more up to date that this blog entry. Note: pbuilder will still install untrusted packages, although it will warn about it. Check your pbuilder output!

One thing that never really came to my mind during Debconf6 in Oaxtepec, Mexico, was blogging about what went on. In part, that's because I never had a minute to spare, plenty of other people were blogging about the event on the planet, and definitely also because I developed a dislike to play-by-play blogging, which I certainly do not like to read for my part. But now, sitting in Oaxaca in the Hostel Pochon (which has free wireless, imagine that), I feel like at least jotting down some of the highlights. My favourite non-Debian related happening must have been the descent to Mexico City airport. I am willing to bet that our pilots either had too much to drink or way too much fun, because we literally zig-zagged across this amazing city. It's about 2200 metres above sea level and our inflight information system noted our altitude at 3500m for at least 20 minutes, so glued to the window, I felt in a miniature world, hovering above a city that extends to all sides however far the eyes could see (I conclude that in all miniature worlds I've seen so far, such as the Eisenbahnmuseum Hamburg and Swiss Miniature, trains and cars are generally moving too fast). The population of "la Ciudad de Mexico" (which the locals just call "Mexico") is estimated to be somewhere between 20 and 24 million, which makes it the largest city in the world, and it was not hard to believe that during the descent (and afterwards). I arrived at Oaxtepec, a government-run vacational complex, some three or four hours after touchdown and didn't last very long until the jetlag took me to bed. That was Saturday night. With Sunday morning, the official Debconf conference had started and was to last for seven days. In general, that meant talks and BoF sessions throughout the day, loads of hacking and socialising in between, food, and drinks with more socialising in the evening (and throughout the night in some cases). I really enjoyed seeing many of the folks I had met at last year's conference in Helsinki, while some others' absence was equally prevalent. I spent most of the week hanging out with Biella Coleman, Micah Anderson, Sean Finney, Clint Adams, and a bunch of others, I also managed to make the real-life acquaintance of some people I had known online for a long time. In retrospect though, I should have spent less time with the regular clique (with whom I was to go to the post-Debconf trip anyway) and spent more time getting to know more of the attendants. The vacational complex was interesting, and unlike many others, I didn't get annoyed by the long distances between presentation room, my accomodation, the hacklab, and the place where we were served edible lunches and dinners. Rather, I enjoyed walking with others, engaged in discussions on some of the more prevalent topics filling my life with Debian (such as version control, low-level Debian tools, security issues, and social challenges). The only nuisance was the long walk to the nearby town and its market, from where I would get most of my food and drink throughout the week -- but even that walk I rarely had to manage alone. The massive pool (with a ten metre diving board) that lay in the middle of it all didn't really attract me that much, but then again I've never been much of a pool person. In the interest of various people worrying about my safety in Mexico, as well as some of my clients, I purchased a Mexican prepaid SIM card for my cellphone and linked up with the world (after two attempts and an accumulated 2.5 hour wait). The fun was only short though, when I found out that in Mexico, phone charges are ridiculously expensive, and receiving calls on a mobile phone costs exactly the same as making them. At USD 1/Minute to and from Europe, I ended up limiting my air time to a minimum. I spent most of the first couple days getting mdadm back into shape, bug triaging and uploading a new upstream to experimental, except for Monday, which I spent together with Joey Hess, Micah, and Biella trying to recover files from her wrecked filesystem, which we managed in the end using a simple fsck to at least recover her presentation. I'd be sitting on the terrace in front of the "hacklab" where people kept passing by, so my work certainly wasn't focused and without interruptions, but in the end I was still satisfied with the end result. And in the evenings, it was usually the same terrace, sampling the local beer, enjoying cheese from all over the world at the cheese party on Tuesday night, trying liquors from other parts of the globe, and talking and joking and meeting great people (I truly love the Debian crowd). Out of the large assortment of talks available, I attended several but found that front-up presentations aren't my thing and I would have to let the topic simmer a bit (along with some research) before delivering my questions to the speakers outside of the talk (where I finally got some interesting answers to long-standing questions). Thanks to the awesome work by our video team, which recorded every single presentation to tape, streaming it live and also intending to publish it on a post-conference DVD, I found myself often listening in on talks I wouldn't have gone to, while hacking away on said porch. Noticing, however, that many talk slots were left unfilled at the start of the conference (they did quickly fill with impromptu presentations and BoF sessions once the inertia of the event picked up), I was a little annoyed that my proposal was turned down in the first phase of selection. Wednesday was the day of the day trip. Against my recommendations of an early departure, we left the site at 11:30 with six busses (remarkably on time), heading for Xochicalco for a rather boring tour of the museum, and a vastly more interesting, two hour stroll (in the midday sun) around the actual archeological site, which was quite impressive despite mostly being artificially built or rebuilt by the government. We went on for an excellent buffet-style lunch (which was amazingly well organised), and then headed on for Cuernevaca, a small, romantic town where we had only an hour to spend before heading back home (who recommended starting the day earlier?). When we finally made it back to the conference, most of us were just tired and the evening wasn't as wild as some of the other ones during the week. Come Thursday, my mission was to attack the thinkpad packages, which make Debian on IBM laptops a lot more of a pleasure to use. Unfortunately, I didn't get anywhere (yet) with that work, simply because most of my time was spent battling the weird hacks that make up module-assistant, which actually makes it a lot harder for developers to provide kernel module packages (while really improving the end-user's experience). But of course, there was a positive twist to this issue, as I would now leave my screen in frustration much more frequently and socialise with the others. For the evening, the organisers had prepared the "formal dinner" (which isn't so formal at all). A bunch of busses took us to a nearby shed, where we found all tables arranged in a massive swirl, and when we were all seated, a Mariachi band entered, at the same time as the rain outside picked up -- I thought one of the Mariachis was playing the snare drum but as the rain grew stronger, I concluded it must instead be the drops on the metal roof causing the noise. Generally in love with rain, I made my way to the door while others lined up to fetch dinner and stood in awe for a bunch of minutes at the sight of the marble-sized drops descending from the sky. ... when suddenly I saw one of Debian's troublemakers, Jonathan/Ted Walther, running at me, chased by three developers and found myself amidst their altercation before I could do anything. People screaming, one reaching over my shoulder to push Ted, it was all too much. I told everyone to calm down, to which Jonathan/Ted reacted, vigorously shaking and foaming, with a "get out of my fucking way, you fucking Nazi" and I knew that stuff had gone wrong. I withdrew, and in an attempt to find out what had happened managed to piss off one of the three involved developers, who'd then later refuse to hear me out for an explanation. All that really left me in a depressed state mainly because I simply hadn't expected Debian developers getting physical at each other, and this time it was Erinn Clark who consoled me and turned the night around for the better. I still had no appetite and took the first bus home, sent an apologetic email to the offended developer (who never acknowledged receipt but seemed to have forgotten the incident the next day), and enjoyed beers while the others kept returning to the hacklab. Apparently, people were quite aware of my (passive) involvement during the incident, so I was bombarded with plenty questions, most of which I refused to answer for lack of knowledge of the actual facts. Still, when I saw one girl in another altercation with Jonathan/Ted later that night in response to severe offences he published on his blog, which led her to come close to tears, I decided it was time to pull him off the planet. He re-added himself shortly afterwards by "fixing a typo" (according to the CVS changelog), but by that time, I couldn't care less no more and simply resumed the discussions, which eventually turned into topics of life, intelligence, and the bottom-up vs. top-down debate. I am a strong supporter of bottom-up (as many of you know), and I somehow regret the way I approached the discussion, because in retrospect I see myself as somewhat arrogant during it; fortunately, noone seemed to hold it against me the next day. Throughout the entire week, I built up a reputation of the guy that needs no sleep: staying up until the early morning hours, yet rarely missing any of the first talks at 10 in the morning, and even joining with people for breakfast at the market before. Friday morning, however, I just couldn't get up. We talked until six in the morning, and when my eyelids finally moved after I dropped into bed, it was already noon and I dragged myself to the next talk. after which I simply returned to the hacklab and developed more of my dislike towards module-assistant, before the call for the official Debconf6 group picture rescued me (and those around me). The keysigning party followed and I made the mistake to offer to coordinate it (picking up where Anibal's great preparation left off), without really running the process through my head before. Standing up on the diving tower and screaming to the crowd of 140 participants, it was in part due to Moray Allen's comments that the party went more or less without any complications; I did get to conduct another experiment though. During the keysigning, Mark Shuttleworth invited a bunch of us to join him for dinner to discuss the Debian-Ubuntu situation (no bribes involved; we paid for ourselves). I'll have more on this in a separate post when it's ready. The discussion continued after we arrived back at the hacklab, and once again, I didn't go to bed at a civilised hour... ... but I did get up in time for Biella's talk, during which she employed very effective techniques to get me to actually pay attention (which I would have done anyway): she required my laptop for the presentation. Again, the talk didn't do much to me (which is not Biella's fault), but I am certainly interested in reading the relevant parts of her dissertation. At the same time, however, it made me realise how far from reality the academic world is: big words and complicated concepts just don't count when it comes to getting your hands dirty, and I will try my best not to go down that route when my own dissertation gets more serious. Two other memorable events happened on Saturday: the fun group photos (I was determined to get the participants to line up in a swirl in the pool, and partly succeeded), and the last-night-party on the porch of the hacklab, which was mighty fun, in part because we had speakers blasting tunes for the first time that week (thanks to the dance BoF the night before), and Ryan Murray was playing some of the truly excellent mixes of a close friend of his, which are available from mux.ca. I didn't sleep that night. And then Sunday had arrived, the sad last day of a great conference. I would like to thank all the organisers and helpers for making this event possible! I know some of you had some reservations before and during the event, but in the end it's the result that counts, and I was only one of many who were absolutely satisfied by the week. A great big THANK YOU to you! Following the last bits of socialising and copying Biella's harddrive image to Micah's drive for later rescue of some of her precious videos, we were off to Mexico city for the vacational part of the trip. Some of us went by bus, Vagrant and myself hopped onto the bus to assist one of our developers with his wheelchair at the airport. When the group reconvened in front of our hotel for the night in the centre of Mexico city, the vacation had started (blog post forthcoming sometime...)