Gentoo Archives: gentoo-project

From: Roy Bamford <neddyseagoon@g.o>
To: "Michał Górny" <mgorny@g.o>
Cc: gentoo-project <gentoo-project@l.g.o>, Gentoo Elections <elections@g.o>, infrastructure <infrastructure@g.o>, council <council@g.o>, trustees <trustees@g.o>
Subject: [gentoo-project] Re: [RFC] vote.gentoo.org - a new voting frontend for Gentoo Elections
Date: Sat, 27 Jul 2019 10:40:35
Message-Id: IVJWTX3Z.ONQLCJ2P.H6HOYBYA@VOYN4NAJ.RTHOZEQV.J3JUG5JJ
In Reply to: [gentoo-project] [RFC] vote.gentoo.org - a new voting frontend for Gentoo Elections by "Michał Górny"
1 On 2019.07.27 07:21, Michał Górny wrote:
2 > Hi,
3 >
4 > (CC-ing all parties interested in technicals, plus main consumers)
5 >
6 > I'd like to work on providing new web-based frontend for voting
7 > in Gentoo elections. It would replace votify in the pipeline but
8 > generate countify-compatible data, so the votes would still be counted
9 > using old tooling.
10 >
11 >
12 > Goals
13 > =====
14 > The goals for the new system would be to:
15 >
16 > 1. Improve privacy of votes by removing connection between voters
17 > and their confirmation IDs ASAP (not storing them unencrypted
18 > on permanent storage at all).
19 >
20 > 2. Unifying voting mechanism for developers and non-developers.
21 > The latter currently vote by mail and get their votes manually hacked
22 > into the system.
23 >
24 > 3. Removing dependency on dev.gentoo.org shell access for voting.
25 > This
26 > is implied by 2. but should also support any future efforts of
27 > reducing
28 > reliance on the single system in Infra.
29 >
30 > 4. Make it possible to use the system for unofficial elections (e.g.
31 > team lead votes). Currently setting a vote up requires root
32 > privileges
33 > on dev.g.o which is not really feasible.
34 >
35
36 5. Election Officials shall have a means to determine the voter turmout
37 from time to time while the election is in progress.
38
39 Today, its carried out by the -infra contact and publicised in reminders
40 to vote, IRC channel topics etc
41
42 [snip]
43
44 > Before the election starts, election officials prepare a list of voters
45 > containing their e-mail addresses and OpenPGP key fingerprints. They
46 > run a script which creates tokens for all voters, encrypts them, then
47 > mails them to voters.
48
49 How do we deal with expired public keys?
50
51 Devs get a warning at commit time before their key expires. Non devs
52 will not be permitted (by gpg) to sign a ballot with an expired key.
53 Here, the election officials script will be attempting to make use of
54 expired keys.
55
56 I can see another requirement ...
57 6. At the record date for any election, voters public keys shall be
58 checked for validity until at least the end of the voting period.
59
60 That will give election officials time to remind the electorate to fix
61 their keys.
62
63 [snip]
64
65 > Your comments
66 > =============
67 > What are your thoughts?
68 >
69 > --
70 > Best regards,
71 > Michał Górny
72 >
73 >
74
75 No showstopper comments from me.
76
77 --
78 Regards,
79
80 Roy Bamford
81 (Neddyseagoon) a member of
82 elections
83 gentoo-ops
84 forum-mods
85 arm64

Replies