Hi,
first, thanks a lot to everyone who contributed to this thread!
s7r:
> mithrandi is of course interested into continuing to maintain Electrum
> in Debian and will do so, but we should find other people also to work
> as a team so he doesn't become the single point of failure, like it
> happened this time.
Sounds good. I'm elaborating on this below (option B).
> Unfortunately, I personally don't know how to do it
> all by myself, but I'm willing to help with monetary payments for the
> hours spent on this as well as donate testing infrastructure.
This is good to know. If we go this way in the end, I think we'll
greatly appreciate any kind of support you can provide :)
I've just had a meeting with 2 of my Foundations Team colleagues
(hefee & segfault), aiming at providing input regarding the available
options, guidance regarding the next steps, and information regarding
what the Tails Foundations Team feels we could do on our side.
Only the first two options below (A and B) seem doable.
Option A: use a trusted onion server and keep 3.1.3-1~bpo9+1 for now
====================================================================
If that's sufficient to fix the most critical issues on the short
term, then we need to know:
- Are there such servers available? Are they reliable enough
for Tails? What configuration change do we need to do to use them?
I'm not sure I understood this comment right:
https://redmine.tails.boum.org/code/issues/16564#note-10
- How much do we need to trust this server? (Ideally, we need
pointers to some authoritative document, rather than claims made by
the very person who runs this server :)
Option B: find co-maintainers for the Debian package
====================================================
We have the skills at Tails to become co-maintainers but if there's
a way to find some other co-maintainers, it would be sweet. Ideally we
would not have to be part of it but worst case we can, at least for
a while.
s7r, how about you ask the Debian Cryptocoin Team¹ if they want to
co-maintain Electrum with mithrandi and/or with some Tails folks,
under the umbrella of their team?
[1]
https://qa.debian.org/developer.php?email=team%2Bcryptocoin%40tracker.debian.org
If needed, there's now a formal package salvaging process in Debian:
https://www.debian.org/doc/manuals/developers-reference/ch05.en.html#package-salvaging
For Tails 3.x, if fetching the package from sid or experimental
doesn't work, it would be OK to ship a custom, Tails-only backport
from whatever is in sid or experimental. But for Tails 4.0 (Buster) we
would prefer shipping a package that's in buster-backports.
The FT would be ready to help s7r with maintaining the integration of
Electrum into Tails, if needed.
If we go this way, we would try this out for a while and invest as
little as possible into it, e.g. we would not bother about the
optional dependencies if they are not readily installable. Then, 6-12
months later, we would re-evaluate to check how much of our resources
this work takes, and Tails as a project can make a strategic decision
wrt. whether we should keep doing this work or focus our limited
resources elsewhere.
Option C: remove Electrum
=========================
This would be sad. We would like to evaluate options A and B first.
Doing a poll to learn how much people use Electrum in Tails might help
us better understand what the impact of this option would be.
Option D: AppImage
==================
segfault and I have documented on this thread and on #16564 various
reasons why we think it's not an acceptable option for Tails at the
moment, and could easily require more work from all affected parties
than option B.
Option E: Flatpak
=================
This could very well become the ideal option for Electrum at some
point but we're not ready for it yet. Flatpak is something we want to
work on in the next couple years anyway, for other reasons.
Thoughts?
Cheers,
--
intrigeri
