[ previous ] [ Copyright Notice ] [ Contents ] [ next ]

Debian Developer's Reference
Chapter 2 Applying to Become a Maintainer


2.1 Getting started

So, you've read all the documentation, you understand what everything in the hello example package is for, and you're about to Debianize your favourite piece of software. How do you actually become a Debian developer so that your work can be incorporated into the Project?

Firstly, subscribe to debian-devel@lists.debian.org if you haven't already. Send the word subscribe in the Subject of an email to debian-devel-REQUEST@lists.debian.org. In case of problems, contact the list administrator at listmaster@lists.debian.org. More information on available mailing lists can be found in Mailing lists, Section 4.1.

You should subscribe and lurk (that is, read without posting) for a bit before doing any coding, and you should post about your intentions to work on something to avoid duplicated effort.

Another good list to subscribe to is debian-mentors@lists.debian.org. See Debian Mentors, Section 2.3 for details. The IRC channel #debian on the Linux People IRC network (e.g., irc.debian.org) can also be helpful.


2.2 Registering as a Debian developer

Before you decide to register with the Debian Project, you will need to read the Debian Social Contract. Registering as a developer means that you agree with and pledge to uphold the Debian Social Contract; it is very important that maintainers are in accord with the essential ideas behind Debian GNU/Linux. Reading the GNU Manifesto would also be a good idea.

The process of registering as a developer is a process of verifying your identity and intentions. As the number of people working on Debian GNU/Linux has grown to over 500 people and our systems are used in several very important places we have to be careful about being compromised. Therefore, we need to verify new maintainers before we can give them accounts on our servers and letting them upload packages.

Registration requires that the following information be sent to new-maintainer@debian.org as part of the registration application:

If you do not have an OpenPGP key yet, generate one. Every developer needs a OpenPGP key in order to sign and verify package uploads. You should read the manual for the software you are using, since it has much important information which is critical to its security. Many more security failures are due to human error than to software failure or high-powered spy techniques. See Maintaining Your Public Key, Section 3.2 for more information on maintianing your public key.

Debian uses the GNU Privacy Guard (package gnupg version 1 or better as its baseline standard. You can use some other implementation of OpenPGP as well. Note that OpenPGP is a open standard based on RFC 2440.

The recommended public key algorithm for use in Debian development work is the DSA (sometimes call ``DSS'' or ``DH/ElGamal''). Other key types may be used however. Your key length must be at least 1024 bits; there is no reason to use a smaller key, and doing so would be much less secure. Your key must be signed with at least your own user ID; this prevents user ID tampering. gpg does this automatically.

Also remember that one of the names on your key must match the email address you list as the official maintainer for your packages. For instance, I set the maintainer of the developers-reference package to ``Adam Di Carlo <aph@debian.org>''; therefore, one of the user IDs on my key is that same value, ``Adam Di Carlo <aph@debian.org>''.

If your public key isn't on public key servers such as pgp5.ai.mit.edu, please read the documentation available locally in /usr/doc/pgp/keyserv.doc. That document contains instructions on how to put your key on the public key servers. The New Maintainer Group will put your public key on the servers if it isn't already there.

Due to export restrictions by the United States government some Debian packages, including gnupg, are located on ftp sites outside of the United States. You can find the current locations of those packages at ftp://ftp.debian.org/debian/README.non-US.

Some countries restrict the use of cryptographic software by their citizens. This need not impede one's activities as a Debian package maintainer however, as it may be perfectly legal to use cryptographic products for authentication, rather than encryption purposes (as is the case in France). The Debian Project does not require the use of cryptography qua cryptography in any manner. If you live in a country where use of cryptography even for authentication is forbidden then please contact us so we can make special arrangements.

Once you have all your information ready, and your public key is available on public key servers, send a message to new-maintainer@debian.org to register as an offical Debian developer so that you will be able to upload your packages. This message must contain all the information discussed above. The message must also contain your public key (extracted using gpg --armor --export user_id in the case of gpg) for the database of keys which is distributed from url-debian-keyring; and the debian-keyring package. Please be sure to sign your request message with your chosen public key.

Once this information is received and processed, you should be contacted with information about your new Debian maintainer account. If you don't hear anything within a month, please send a followup message asking if your original application was received. Do not re-send your original application, that will just confuse the New Maintainer Group. Please be patient, especially near release points; mistakes do occasionally happen, and people do sometimes run out of volunteer time.


2.3 Debian Mentors

The mailing list debian-mentors@lists.debian.org has been set up for novice maintainers who seek help with initial packaging and other developer-related issues. Every new developer is invited to subscribe to that list (see Mailing lists, Section 4.1 for details).

Those who prefer one-on-one help (e.g., via private email) should also post to that list and an experienced developer will volunteer to help.


[ previous ] [ Copyright Notice ] [ Contents ] [ next ]
Debian Developer's Reference
ver. 2.7.2, 16 April, 2000
Adam Di Carlo, current maintainer aph@debian.org
Christian Schwarz schwarz@debian.org
Ian Jackson ijackson@gnu.ai.mit.edu