[gentoo-dev] Abuse by gentoo developer

[Casey Allen Shobe <lists@seattleserver.com>]

Hello all, I'm sorry to bring this here, but I don't know where else 
to take it, and feel that I was treated really unfairly.

As you know, I recently inquired about ebuild development on this 
list, and mentioned vpopmail.  Jory Pratt answered my mail and 
suggested that I submit a patch.

I then spent some time working on the ebuild, and in doing so, 
discovered that the postgres support in vpopmail was not very good 
at all, so I wrote back to Jory, and said that I was going to hold 
off working on the ebuild since I am currently working with the 
vpopmail team to improve vpopmail itself.  Jory wrote this rather 
rude reply:

-------------------
Casey Allen Shobe wrote:
> Well I patched the ebuild and got it working, but I'm so terribly 
> disappointed with vpopmail's horrible postgresql support that I 
> don't think I'll be using it at all until I rewrite it. :P
> 
> Ah well, thanks anyways.  I'll let you know when/if they let me
> fix vpopmail (already posted about it on the list).

The will not allow it and I will not allow someone to go fooling in 
an ebuild I maintain. Not trying to be an ass here but we have 
something called respect for others when it comes to the tree and 
what they maintain.
> 
> One suggestion for you, some servers (i.e. qmail-smptd) runs as a 
> non-root user, so they will fail to authenticate 
> unless /var/vpopmail/bin/vchkpw is SUID.  I have a script that
> runs once a minute on my machines and makes this file +s if it's
> not because I've dealt with this problem so much (mail server
> breaks every time I rebuild vpopmail).

Default install is setup as setuid seeing we know this already. 
Useless info like this tells me you do not understand the 
permissions that are being set in the ebuild.
> 
> I would strongly recommend doing chmod +s /var/vpopmail/bin/vchkpw 
> in the ebuild, and then if the end user doesn't want it SUID, then 
> that's what FEATURES=suidctl is for.

This is not how we can handle this the user should have already read 
up on how to setup vpopmail before ever installing it, which means 
they would already know that SUID is required.
-------------------

So, I wrote the following response, which I feel was courteous 
enough given the situation:

-------------------
On Tuesday 19 July 2005 16:09, you wrote:
> The will not allow it and I will not allow someone to go fooling
> in an ebuild I maintain. Not trying to be an ass here but we have
> something called respect for others when it comes to the tree and
> what they maintain.

Umm look, you ARE being an ass, and I don't appreciate it as I'm 
only trying to help.

A> I was simply offering you help - adding support for a postgres 
use flag to the ebuild that called appropriate configure options 
and such.  I have no intent of hacking up vpopmail source outside 
of the main distribution.

B> You are not one to say whether the vpopmail team will or will not 
accept my patches - I believe they will as my intent is to make 
vpopmail a better product, and members of their development team 
have already been welcoming and helpful in discussing the best way 
to redesign things.  It's no secret to the vpopmail team that the 
postgresql support is lacking flexibility and has some bugs, and is 
simply hacked together quickly by people who wanted it to work, and 
didn't care much for ease of use or configurability.  Try it 
yourself, I'm sure you'll be disappointed.  It's simply not as 
configurable as the mysql option, and neither mysql or postgresql 
allow customizing the backend table format without editing i.e. 
vpgsql.h for postgres.

> Default install is setup as setuid seeing we know this already.
> Useless info like this tells me you do not understand the
> permissions that are being set in the ebuild.

Umm, no it's not, and it's not useless info.  I reported the bug to 
the gentoo-dev list some months ago, but should have probably used 
bugs.gentoo.org instead.  In any case, it's certainly not installed 
setuid by default:

# emerge -va vpopmail && ls -l /var/vpopmail/bin/vchkpw

These are the packages that I would merge, in order:

Calculating dependencies ...done!
[ebuild   R   ] net-mail/vpopmail-5.4.6-r1  +clearpasswd -ipalias 
-mysql -postgres 0 kB [1]
[...]
>>> net-mail/vpopmail-5.4.6-r1 merged.
[...]
-rwx--x--x  1 root root 85036 Jul 19 23:53 /var/vpopmail/bin/vchkpw*

So stop telling me my info is useless, when it's obviously not.

> This is not how we can handle this the user should have already
> read up on how to setup vpopmail before ever installing it, which
> means they would already know that SUID is required.

As SUID is required for qmail-smtpd, vchkpw should indeed be 
installed SUID by default unless overridden by using suidctl.  This 
is NOT the case now.
-------------------

I then received this lovely mail from Jory:

-------------------
You want to curse me and tell me you think your gonna go playing in 
my vpopmail ebuild you can take your bullshit upstream I am black 
listing you on my filters so I do not need to read your bullshit 
you do not understand the full picture if you did you would know 
vpopmail works with more then just qmail you dumb ass. So have a 
nice Day chow!!
-------------------

Umm look I'm just trying to help here, and I really feel like I've 
been treated very unfairly by this developer.  I'm working hard to 
try to make vpopmail AND gentoo better products, I'd really 
appreciate not being told on things I know very well that I'm right 
about, and getting severe reactions like this when I prove that my 
statements were indeed correct and that I'm only trying to help.

I really feel that this response whas wholly unjustified, and that I 
did nothing to warrant it.  Please advise.

Cheers,
-- 
Casey Allen Shobe | http://casey.shobe.info
cshobe@seattleserver.com | cell 425-443-4653
AIM & Yahoo:  SomeLinuxGuy | ICQ:  1494523
SeattleServer.com, Inc. | http://www.seattleserver.com
-- 
gentoo-dev@gentoo.org mailing list