- Haskell-community - Haskell.org

Hackage Roots of Trust
by Boespflug, Mathieu 21 Sep '15

21 Sep '15

GershomB wrote: > One related discussion we started to have was if we might want > to do haskell community funding for "phase two" of the update > framework rollout, as discussed in Duncan's talk -- that phase > where we not only implement server trust and signing, but also > author signing. This sounds like a project that potentially the community could consider valuable. However, how much total effort are we talking about here? How much funding would be required? PS: apologies for the top-post. Just signed up to the mailing list and didn't find a way to convince my mail client to set the in-reply-to field appropriately to reference the original message.

1 0

Hackage Roots of Trust
by Gershom B 18 Sep '15

18 Sep '15

At the Haskell Implementor's Workshop at ICFP, Duncan gave a talk on the work on security and package infrastructure that has been going on: https://www.youtube.com/watch?v=D9juHHlnayI One element of that, which was turned over the committee to figure out is who our actual roots of trust would be, in the same sense that there are root certificates for TLS and https authentication, etc. at the Haskell Symposium itself, I gave a quick lightning talk on the work the committee had done in this regard: https://www.youtube.com/watch?v=U8ISiSXV2c0 (If you are interested in verifying your communications with Duncan by the way, and if you trust the video is undoctored, then his GPG key fingerprint appears on it, which may be of some use.) We did in fact get some keysigning done at the conference, and we also secured a fair number of keys from the roots of trust we co-ordinated, though some followup work remains to be done there. We certainly already have enough in hand to bootstrap the process as the hackage security work gets fully rolled out. One related discussion we started to have was if we might want to do haskell community funding for "phase two" of the update framework rollout, as discussed in Duncan's talk -- that phase where we not only implement server trust and signing, but also author signing. Apropos of nothing, but a related thought/question I had was if there would be interest in making cabal files themselves more potentially secure in the manner of the LIO / HLIO work [1]. Having a better chain of trust seems to somewhat obviate the need here, but it does seem like something worth considering. Similar mechanisms might also be worth integrating into template haskell IO for that matter. However, one concern is that the worth of these approaches depends in part on good SafeHaskell takeup, which has a whole bunch of obstacles in itself :-) Cheers, Gershom [1] http://www.cse.chalmers.se/~russo/publications_files/hybrid-icfp2015.pdf and https://hackage.haskell.org/package/lio-0.11.5.0 and http://www.scs.stanford.edu/~deian/pubs/stefan:2014:building-haskell.pdf

3 4

Code signing for Windows exes
by Randy Polen 17 Sep '15

17 Sep '15

It would also be great, while considering the roots of trust, to also consider acquiring and escrowing (i.e., who keeps, who uses) a code signing certificate so that we can sign the handful of Haskell Community executables that we build for Windows. Top of that list would be the Haskell Platform installation executables, but we could also use it for the pre-built cabal, stack, etc.

2 1

Better Stats
by Gershom B 09 Sep '15

09 Sep '15

One of the things I mentioned wanting help with in the haskell infra status update I gave at HIW [1] was better stats. In fact, when I prepared the talk, I forgot we actually had some google analytics in place. In any case, they need work to be extended and made more complete with regards to pages covered, and especially downloads. Jose Calderon volunteered afterwards to put some effort in on this, as time permits. He says he’d like to be able to stamp out “quarterly traffic reports” or the like eventually, which sounds pretty neat to me, and I got him set up (I think) on GA. Again, just recording this here and ideally we can track this as time goes forward. —Gershom [1] https://www.youtube.com/watch?v=cblJf84nkj8

1 0

A few kickoff notes and Outreachy
by Gershom B 09 Sep '15

09 Sep '15

Hi everyone and welcome. I’m surprised we have roughly 50 subscribers so far. Bear in mind I do expect this to be a relatively boring list, but we will of course see how things develop :-). I came back from ICFP with a bunch of discussions about various small things in various stages of work and repair, and I plan to start a number of small threads as time permits over the next few days on each of these in turn, with the idea that people who are interested can follow only relevant discussions, and people can reply over time (be it rapidly or just a month or two down the line) to update on how things are going. Many of these were discussed by the whole committee at one of our first in-person meetings since inception where all members were present (a rare occasion, and not one I think we should imagine is easily replicable). One thing thought I would mention first is that we are planning to participate in Outreachy (https://www.gnome.org/outreachy/) which is the successor to the Gnome Outreach Program for Women. It works sort of like GSoC but with an outreach focus, and with orgs funding their own interns and Outreachy coordinating, as I understand it. We had meant to do so for a few years but the timing hasn’t worked out. The applications for orgs to participate in the new round closes on September 21 — I think we had thought it was too late for us to co-ordinate for this round, but instead we would prefer to do it in May so as to co-ordinate our admin overhead with that of dealing with GSoC. Nonetheless, I believe the plan was to get in touch with Outreachy very soon, so that we could actually have things lined up by the next round, unlike previous years. I think Adam was going to handle this? I think an overall consideration here is that we have now acquired a relative surplus compared to our income, year over year, and it would be good to look for modest ways to use it to good ends. So an intern in the next outreachy round seems like a good “trial balloon” in this direction. Anyway, we can use this thread to track when we make any progress on discussions with Outreachy and what steps we need to take when. —Gershom

2 1

ANN: Creation of Haskell-Community list for Haskell.org Community Infrastructure Discussions
by Gershom B 09 Sep '15

09 Sep '15

Dear all, The haskell.org committee [1] had a productive week during ICFP, and at some point we'll try to write up some of the small things underway and future plans -- many things are quite tentative at the moment. However, one thing that became clear to us (well, thanks to the useful prodding of SPJ) is that we have historically participated in discussions in other venues (-cafe, reddit, etc) and then had our own internal discussions (few, seldom, and largely organizational to be honest) on the low-traffic committee [at] haskell.org mail alias. But this leaves open people wondering what those discussions are. And it also leaves open where the *designated place* to discuss haskell.org community infrastructure is. The haskell-infrastructure [2] list is very quiet and really about technical considerations. Meanwhile, -cafe, reddit and soforth are about anything and everything. So we created another list, which will be a place where we seek to have our discussions related to plans for haskell.org committee work, and where we invite everyone to join us. This new list is the haskell-community list: https://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-community The committee alias will still work, and is still the way to just write directly to the members of the committee -- no list to join. But if you wish to have a discussion about how we have things set up on haskell community infrastructure, services provided, and that we might wish to add, and how you can help (or even just what your thoughts are on how things might be done), now there is a good place for that. Hope to continue conversations with many of you there, Gershom (for the haskell.org committee) [1] https://wiki.haskell.org/Haskell.org_committee [2] http://community.galois.com/mailman/listinfo/haskell-infrastructure

2 2

Test message
by John Wiegley 08 Sep '15

08 Sep '15

This is a test of posting to the haskell-community mailing list. John

1 0