Topic: Bounty for Debian Maintainer to package Bitcoin Armory (Read 7882 times)

You don't have to worry about the server being compromised, because the software would be signed. The problem is that the person building the software would need to be trusted to not put an exploit into the binaries that the person builds. Someone could probably set up a repository using the binary packages provided by Armory. That way they would be signed by ATI and therefore trusted.

That is a good idea though.

Bummer.
Thank you for all your good effort, Joseph, nevertheless!

Yes, I got used to git too. It boils down to three, four short commands to install Armory:
- download that stuff from github
- auto-configure the source
- compile the source

I always write down the stuff I did, so it takes only a few seconds the next time.
And that way I end up with an up-to-date version too.

So, as maybe the next-best option, how about having a repository/server where all common Bitcoin software is available and up-to-date? One-stop for bitcoin-core, Armory, Electrum, you name it? Of course that server really, really has to be like Fort Knox! :-)
Like, more secure than github or "regular" linux repos. If this one gets hacked and malware built into it's gonna hurt.
Ah, maybe the little gain in convenience isn't worth it?

Ente

Build from source. Fairly easy on Debian.

It is unfortunate. I don't know of a stable Linux distro that provides Bitcoin software other than stuff like electrum. I don't know what to say for someone in your case. I personally use Debian stable, so I have to either download the binaries from the website or compile from source.

Unfortunately it looks like Armory won't be in testing, because that would mean that Armory would be in stable too.

I will keep the thread updated.

Damn. That's a real drag. I'm sorry that I don't understand it all better.

I'm struggling a little bit because it seems like with things like Bitcoin I have to compromise. Either I get a stable distro, where I can install everything I need from the repo, or I have to run less stable distros or install from source or packages that aren't in the repo.

What would you suggest for somebody in my situation? You're saying it won't even make it to testing, too, or just stable?

Should I consider running Debian testing? That seems a bit more technically advanced. I've done some research online and there are several different instructions. I'd like it to be as easy as installing stable and just having it be testing forever, or something.

*sigh*

Thanks for all of your work anyways. Please keep us posted on this thread if things change in the future.

I don't mean to make it sound like it is just armory's fault. It is also partially Debian's for the policies they have.

I have sent the donation back.

So, if Bitcoin Armory had a bigger team of developers that could donate enough time to make the updates necessary for older versions of Armory it would be okay?

Ugg.

I hate to take my donation back, but I would like it back, as it not making to stable does me no good.

That being said, I'll re-donate again in the future if this ever gets straightened out.

The main issue is that upstream is a small team that can't support old versions of Armory with new versions of bitcoin core. Even if you won't, there will be people filing bugs against the old version. It might still be possible for old versions of Armory to have bugs that can cause bitcoins to be lost when combined with newer versions of bitcoin core.

I don't know about electrum. Maybe they don't have the same concerns. Maybe the maintainer has gone against the wishes of upstream. I'd rather not do that, because then it is on me if bitcoins are lost due to an outdated version of Armory being in Debian.

I guess I learned not to get people excited until there is a definitive plan of action.

Wait, what??

Look, I'm totally fine with an "outdated" version of Armory. I'm currently running an "outdated" version of armory now that I built from source over a year ago.

I have no problem running 0.92.3-1 for all of Jessie's stable lifetime. I mean, why isn't that possible? I can understand it for Bitcoin-core because there's a protocol requirement, yada yada. But Bitcoin Armory doesn't suffer from this problem.

I mean, hell, if Electrum can get into Debian Stable, why can't Amory?

Can you just double check and make sure it's not possible? Again, I'm not hung up on the updates, I just want to be able to sudo aptitude install armory in debian, and get my less technical family and friends to be able to do the same as well. If I start getting on them to change a bunch of stuff to run testing packages, it'll never happen.

Seriously, there has to be a way.

Here is my refund address: 1Fr67J7r5xJgmBE9oTvEDbnE17fbwHdaSu

Although I'd MUCH rather not get a refund, and get Armory in the Stable repo.

Thank you so much that was very generous of you, but I am going to have to ask you for an address to return it. I was doing some more talking with upstream and my sponsors and it looks like it is not going to be possible to update Armory in stable like I thought. It turns out stable-updates is meant for updates that are required to retain a minimal set of expected features. So it is probably not possible to provide updates via stable-updates. Therefore it is best to just not have Armory in stable if it is going to get outdated. To prevent Armory from getting into stable, we are going to have to remove Armory from testing too. That means Armory is going to only be in unstable, which isn't as useful as if it were in testing and stable too.

Sorry if anyone is disappointed. I am disappointed myself having put in the effort to make the package, but this is better than an outdated version in stable. I will return the donations to anyone who wants their donation back.

Hopefully in the future linux distros change their policies to provide exceptions for Bitcoin software or Bitcoin software stabilizes more.

There it is folks!

https://packages.debian.org/jessie/armory

I've kept my word and donated 300 mBTC, ~$100.

https://blockchain.info/tx/7622c723d427a4aff95980ffe6783e3aa50aaa9d663d211497f95fe3a22b0ca4

It's not much, but I'm not a wealthy man. The goal was a bunch of people to contribute to the bounty. That being said, it means a lot to me that Joseph is maintaining an armory package. So, thank you Joseph! Your work is a very important step for mainstream Bitcoin adoption.

You can check here. It says 9 of 10 days (have passed) but it will be 10 later today. So it is going to make it.

We (my sponsors and upstream and myself) have been talking and we think we can update Armory via stable-updates which are enabled by default, so that people running stable will have up-to-date versions of Armory. Ubuntu has stricter criteria for updates., so I don't think Armory is going to end up in Ubuntu like I thought.

It's November 4. How are things looking? Would hate to see it miss the freeze date.

I personally use Debian for my VPS' and this is quite an interesting thing. Good job Joseph! I donated a bit as well.

Thank you!

Excellent! Will donate as soon as it's guaranteed in Jessie for the next Debian Stable release. Here's to getting it in before November 5th's freeze!

I have signed a message with my donation address in it. I signed it using the key which I use for Debian stuff.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

The donation address for Joseph Bisch is 1GjnToz7atMN7fUtoqHP9YQvfXu4U5JWPi.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCAAGBQJUTqO/AAoJEE+tenU4RVnbk1IP/jt11NJQ2xPvcegDs8c5z6YR
J3P+KHyJddS+eHzKPyB8pkk0mQADkg+qauvphBCjxq6hDXXMwyVkvLqsH1G/Ltcj
x9/FeXD+l/t9WkFjC2fBeAgg/1Fa3/6mO5rPwGVB+ytJtDX3l/72f526tIeuxdZV
PPrmO+LeeWy/xfjYTVB6QDbytndxCARI28VuJXkJdiOPnWl67KjoK59TubI1dNlY
UuzLIG4buHCZiNTET8g7IE9XuI/yfiFBy0NiLEoi6zwrhTQuKeNIuUV0f7MfhUSI
dBjNSmDHtHPn3q8JfmJf+OSNVBXSkLMtAtL8aixPtznH9AFo4ZaTGQEWywRY/O+2
mffK65MyWQNG4d70CpNwo6Xcn5rhfREps9xT7EdQs3i9e62ejNiMNNxQ95VqpRnX
q40iQRNK5hNbam5bxF3T9+cQNCtn4eV2K485DLDys8xw5Kh4G76HiTHz5aV/Uf+n
XAlSpyTgZ9OEVNIQiMT0M5atQ9ZjFu8WiqRV5tBe1zGAGbq9ilNIR3Wx0XxVc1km
SaQXBISL0coRuINoK1xn8rlCdUGmSBaCs4cYIpFe94254QZgMyYuVyagWOn6ao6d
VR1UHDnr3J7QVRdrINwLu93xgmFKuteWWjh4g0/A/c9lAadx+BS3P6WJttivpDG0
BLz8ZOFs8Tw7pqPT/9NT
=3j+8
-----END PGP SIGNATURE-----

Nice job!

I never got any bounty going, but I'll happily donate to you for packaging this. What's your bitcoin address?

BTW, this is big news for Armory, as getting into the Debian stable repo is a necessity.

Wow... I was a doubter that this would happen, and I'm very happy to be wrong!

Thanks!

Hi everyone,

Armory is now in Debian Sid. If nothing goes wrong, Armory will be in testing (Jessie) around November 4, which is in time for the November 5 freeze. That means that Armory will be in Jessie when it becomes the new stable release.

You can install Armory right now on your Debian Sid system by running the following command:


Joseph

We're getting there! :-)

Ente

Hi everyone,

I have an update on the status of Armory in Debian. I had some slowdowns, but Armory is now in the New Queue. The New Queue is a list of packages that haven't been uploaded previously. They need to be reviewed manually. I am not sure how long it will take to review Armory. Once Armory is reviewed, it will become part of Debian unstable (sid) and eventually migrate to Debian testing after 5 days. The version of Armory being uploaded is the latest (0.92.3).

The new queue: https://ftp-master.debian.org/new.html

Joseph

Thank you again for the interesting insights!
I read through that "bug" discussion, all sides made good points. This really is a much more complicated situation than it seems at first glance.
Shows how young Bitcoin still is, not?

Cheers,

Ente

It is not already in Jessie, but it should be soon.

If you want a program in Debian, you file a RFP (Request for Package) (only if someone has not already filed a RFP for that program). That lets people know that there is someone interested in seeing the program packaged. See here for more information. You can use the reportbug tool or email [email protected]. Ideally more than one person would like to see the program in Debian, since someone is going to have to take the time to maintain the program in Debian, and there is already a lot of software in Debian. People can reply to your RFP to express their interest.

If someone is interested in packaging a program for Debian, they file an ITP (Intent to Package). Either they change the title of an existing RFP to ITP or they file a new ITP if no RFP exists.

Once an ITP is filed, you work on the package. I can go into more detail if you are interested. Once you are done with the package, you need a sponsor who is a Debian Developer to review it and upload it to the Debian archive. Then the package goes through the process in my last post. Note that packages always start out in unstable (sid), progress to testing (currently Jessie), and then, once a new release happens, go to stable (currently Wheezy).

If you want to see all the RFP and ITP bugs, you can check out http://wnpp.debian.net/. It also includes ITA (Intent to Adopt), O (Orphaned, meaning the maintainer has abandoned a package), RFA (Request for Adoption, meaning the maintainer wants someone else to maintain), and RFH (Request for Help, meaning the maintainer wants a co-maintainer). Any orphaned packages not adopted will be dropped from the next release (Jessie).

There are some RFPs for other Bitcoin software. There is Multibit and Bitcoinj, but Multibit needs Bitcoinj first, and it looks like nobody is working on Bitcoinj. There is also a Bitcoin trading application called Bitcointrader.

Armory doesn't technically depend on Bitcoin Core, because it runs without Bitcoin Core, so it is not listed as a dependency for the package. Bitcoin Core is available as part of Debian, but it is only in unstable and is split into bitcoin-qt and bitcoind. The reason it is only in unstable is this bug. Essentially they filed a critical bug to prevent bitcoin-qt and bitcoind from migrating to testing, because they don't want Bitcoin Core in the stable release, because then it would get outdated. It is okay to be in unstable, because then the maintainers can release a new version and it would go directly to unstable, unlike stable, which would only get updated when there is a new version of Debian. We feel like Armory doesn't have the same issues, since it offloads the network communication work to Bitcoin Core. So we don't have to worry about network consensus issues. So we can have Armory in testing and stable.

Awesome! :-)
This sounds like we are very close now! Excellent work, thank you!
Already in Jessie? Whoa!

Who decides if a (stable) makes it into a repo? Like, would any program be accepted? Or is there an entry limit to only have programs which will be used by many people, or the like?

Normally, Armory depends on bitcoin-core. Which is not in the repos. How is that dealt with?
Probably not at all, as Armory works in offline mode too, without bitcoin-core installed? So I guess bitcoin-core is not listed as dependency in the to-be Armory package?

Ente

I have 0.92.2-testing packaged (as 0.92.1+20140910git4305b08-1) and I think it is almost ready for upload to the Debian archive! My plan is to get 0.92.2-testing uploaded and then package 0.92.2 proper when it is released.

I am just waiting on my sponsor to do a final review of the package. Once that happens and he uploads Armory to Debian, it will be in the new queue. The new queue is where new packages get reviewed. Once Armory passes the new queue it will enter sid, the unstable release. After five days of being in sid, the package will migrate to testing (Jessie). If that happens before Nov 5, then Armory will be in Jessie when it becomes the next stable release. Armory won't be part of Wheezy, but I can package it as part of Wheezy backports so that people with backports enabled can install it. Adding a package to backports involves recompiling the testing version of software for the stable distribution.

I hope this gave you some insight into the process a new package goes through and how it is progressing for Armory.

Welcome to Bitcointalk!

..and thank you, again, for the work you do!
It's much appreciated here!

Cheers,

Ente

Hi,

Yes I am working on packaging Armory. I actually have 0.92.1 packaged, but I am going to wait for the next version to be released and package that due the privacy issues that came to light recently.

I hope to get Armory into testing in time for the Jessie freeze. Then I will also look into getting Armory into wheezy backports.

Let me know if you have any questions.

Feel free to also email me at joseph.bisch [AT] gmail.com.

Yep, same guy that filed the ITP.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739405

There's josephbisch on reddit:

http://www.reddit.com/r/Bitcoin/comments/2c20sa/armory_092_released_now_with_multisig/cjbx2ko


Ente

Someone filed an ITP (intent to package).

I want Armory to be in Debian repos!

However..
- It only makes sense when all dependencies are there too. Especially bitcoin-core, which isn't there as far as I know.
- bitcoin-core and Armory would have to be updated in the repo quickly when an update is available. Noone wants outdated nodes out there, vulnerable to the latest bitcoin-stealing bug which is already updated and publically known..
- It would have to be in the regular, stable repo. At least at some point. People who mess with "unstable" or "backports" won't have problems installing Armory the regular way. I, at least, would rather stick to the regular way.

I don't know if those points can be solved any time soon.
To help out, I'll double the (still unknown) bounty you started. At least within reasonable limits and if the outcome seems worthwile.

Ente

Armory's Ubuntu .deb installs and runs on Debian.

cool. We will wait I guess bounty should be from 0.2 - 1 BTC

I haven't come up with a bounty amount yet. Looking forward to what others reply.

I am IT engineer so just need to sit on it and try to do it  )
I did not say I will complete it and mae it work - but I will give it a try when I will find some spare time.

I have a lot of thing on my head to do ... but this project is interesting.

Have you ever maintained a package for Debian before? It's not a walk in the park.

that's nice and results are going to be useful
I would give a try but I need a time and perhaps nice to know what is your minimum bounty?

I'm just throwing this out here because I'm not really sure where else to put it.

I would very much like to see Bitcoin Armory packaged for Debian so that I can install from the Jessie repo. I'm willing to put a bounty on the maintainer who packages Bitcoin Armory for Debian. I'm not sure how much. I'd like to know if anybody else would be willing to donate to the bounty and how much is a reasonable amount for such a request.

I've created a bug report for a Request For Package. But so far nobody has put in the Intent To Package bug report.

Anywho, just throwing this out there. If you're a Debian Maintainer or know of one who would be willing to package Armory say so here please.