Public Record Verification Request: dpkg 1.21.22 amd64 Package Provenance

--0000000000000738b7064dc272bd
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Dear Guillem Jover and Debian Project,
I am writing as a member of the public to respectfully request written
confirmation regarding publicly available information hosted in the
official Debian package repository at packages.debian.org. I understand
this repository to constitute a public record maintained under the GNU
Affero General Public License, version 3 (GNU AGPLv3+).

I am independently verifying the provenance of files present on my
Chromebook running a Debian 12 (bookworm) Linux environment provisioned by
Google Crostini. In preparing this inquiry, I have reviewed and relied upon
the following public records:

- Official package listing: packages.debian.org/bookworm/dpkg
- Official file list: packages.debian.org/bookworm/amd64/dpkg/filelist
- Official changelog:
metadata.ftp-master.debian.org/changelogs/main/d/dpkg/dpkg_1.21.22_changelo=
g
- Debian Policy Manual, version 4.7.3.0, released December 23, 2025
- GNU Affero General Public License, version 3, dated November 19, 2007

I note that Section 4.4 of the Debian Policy Manual establishes the
changelog as the authoritative record of package versioning, and that
Section 4.7 establishes that modification timestamps in packages carry
policy-governed meaning. My inquiry is grounded in these published
standards and in the rights granted to me as a recipient of software
distributed under the GNU AGPLv3+, specifically the rights affirmed under
Sections 2, 4, and 10 of that license.

I respectfully request written confirmation of the following:
1. That dpkg version 1.21.22 was released to the official Debian archive on
or around Thursday, May 11, 2023, as reflected in the public changelog
entry bearing your name and email address.

2. That the file /etc/cron.daily/dpkg is a standard component of dpkg
1.21.22 for amd64 architecture, distributed to all Debian systems carrying
that package version, as reflected in the official file list at
packages.debian.org.

3. That the file dates associated with this package reflect upstream
authorship and compilation dates rather than dates of installation on any
individual end-user system, consistent with the timestamp preservation
requirements of Section 4.7 of the Debian Policy Manual.

4. That a December 2, 2025 modification timestamp on a system carrying this
package would be consistent with a downstream distributor, such as Google
Crostini, repackaging or imaging this software subsequent to its original
Debian release date.

5. That a cryptographically signed release record or archive timestamp
exists within the public Debian infrastructure that independently verifies
the authenticity and release date of this package version, and if so, where
that record may be accessed by a member of the public.

I am making this request solely for personal verification and documentation
purposes. I am exercising rights expressly granted to me as a recipient of
software distributed under the GNU AGPLv3+ and as a member of the public
engaging with a publicly hosted open source repository governed by the
Debian Policy Manual. I intend to retain any written response as part of my
permanent personal records.

I am copying this inquiry to the Debian development mailing list and to the
Debian Press Contact to ensure that a permanent public record of this
verification request exists.

Thank you sincerely for your time, for your service to the Debian project,
and for the transparency of the project's public infrastructure.

*Respectfully submitted,*
*Marilyn Bretherick *

CC: [email protected]
CC: [email protected]
CC: [email protected]
CC: [email protected]

------------------------------

*CONFIDENTIALITY NOTICE:* This email and any and all accompanying
Electronically Stored Information (ESI), including all email threads,
attachments, linked content, and associated metadata, are intended *only*
for the use of the individual or entity to whom they are addressed. This
communication *may* contain information that is private, confidential,
legally privileged, and/or proprietary. *If you are not the intended
recipient of this communication,* you are hereby notified that any
unauthorized review, use, disclosure, dissemination, copying, or
distribution of this message or its contents is prohibited. If you have
received this communication in error, *please notify the sender. *

*COPYRIGHT AND INTELLECTUAL PROPERTY NOTICE:* The text, attachments, and
all other content of this email are unpublished literary works and/or
proprietary information protected by U.S. Copyright Law (17 U.S.C. =C2=A7 1=
01 et
seq.) and other applicable intellectual property laws. The sender is the
sole copyright and intellectual property holder. Unauthorized reproduction,
distribution, or use of this communication is strictly prohibited. The
disclosure of this communication does not waive any applicable legal
privilege. The sender retains all rights and privileges associated with
this communication and its contents.

--0000000000000738b7064dc272bd
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div class=3D"gmail_default" style=3D""><font face=3D=
"verdana, sans-serif">D</font><span style=3D"font-family:Arial,Helvetica,sa=
ns-serif">ear Guillem Jover and Debian Project,</span></div>I am writing as=
 a member of the public to respectfully request written confirmation regard=
ing publicly available information hosted in the official Debian package re=
pository at <a href=3D"http://packages.debian.org">packages.debian.org</a>.=
 I understand this repository to constitute a public record maintained unde=
r the GNU Affero General Public License, version 3 (GNU AGPLv3+).<br><br>I =
am independently verifying the provenance of files present on my Chromebook=
 running a Debian 12 (bookworm) Linux environment provisioned by Google Cro=
stini. In preparing this inquiry, I have reviewed and relied upon the follo=
wing public records:<br><br>- Official package listing: <a href=3D"http://p=
ackages.debian.org/bookworm/dpkg">packages.debian.org/bookworm/dpkg</a><br>=
- Official file list: <a href=3D"http://packages.debian.org/bookworm/amd64/=
dpkg/filelist">packages.debian.org/bookworm/amd64/dpkg/filelist</a><br>- Of=
ficial changelog: <a href=3D"http://metadata.ftp-master.debian.org/changelo=
gs/main/d/dpkg/dpkg_1.21.22_changelog">metadata.ftp-master.debian.org/chang=
elogs/main/d/dpkg/dpkg_1.21.22_changelog</a><br>- Debian Policy Manual, ver=
sion 4.7.3.0, released December 23, 2025<br>- GNU Affero General Public Lic=
ense, version 3, dated November 19, 2007<br><br>I note that Section 4.4 of =
the Debian Policy Manual establishes the changelog as the authoritative rec=
ord of package versioning, and that Section 4.7 establishes that modificati=
on timestamps in packages carry policy-governed meaning. My inquiry is grou=
nded in these published standards and in the rights granted to me as a reci=
pient of software distributed under the GNU AGPLv3+, specifically the right=
s affirmed under Sections 2, 4, and 10 of that license.<br><br>I respectful=
ly request written confirmation of the following:<br><span class=3D"gmail_d=
efault" style=3D"font-family:verdana,sans-serif">1.=C2=A0</span>That dpkg v=
ersion 1.21.22 was released to the official Debian archive on or around Thu=
rsday, May 11, 2023, as reflected in the public changelog entry bearing you=
r name and email address.<br><br>2. That the file /etc/cron.daily/dpkg is a=
 standard component of dpkg 1.21.22 for amd64 architecture, distributed to =
all Debian systems carrying that package version, as reflected in the offic=
ial file list at <a href=3D"http://packages.debian.org">packages.debian.org=
</a>.<br><br>3. That the file dates associated with this package reflect up=
stream authorship and compilation dates rather than dates of installation o=
n any individual end-user system, consistent with the timestamp preservatio=
n requirements of Section 4.7 of the Debian Policy Manual.<br><br>4. That a=
 December 2, 2025 modification timestamp on a system carrying this package =
would be consistent with a downstream distributor, such as Google Crostini,=
 repackaging or imaging this software subsequent to its original Debian rel=
ease date.<br><br>5. That a cryptographically signed release record or arch=
ive timestamp exists within the public Debian infrastructure that independe=
ntly verifies the authenticity and release date of this package version, an=
d if so, where that record may be accessed by a member of the public.<br><b=
r>I am making this request solely for personal verification and documentati=
on purposes. I am exercising rights expressly granted to me as a recipient =
of software distributed under the GNU AGPLv3+ and as a member of the public=
 engaging with a publicly hosted open source repository governed by the Deb=
ian Policy Manual. I intend to retain any written response as part of my pe=
rmanent personal records.<br><br>I am copying this inquiry to the Debian de=
velopment mailing list and to the Debian Press Contact to ensure that a per=
manent public record of this verification request exists.<br><br>Thank you =
sincerely for your time, for your service to the Debian project, and for th=
e transparency of the project&#39;s public infrastructure.<br><br><b>Respec=
tfully submitted,</b><br></div><div><div dir=3D"ltr" class=3D"gmail_signatu=
re" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><b><font face=
=3D"verdana, sans-serif">Marilyn Bretherick=C2=A0</font></b></div><div><b><=
font face=3D"verdana, sans-serif"><span class=3D"gmail_default" style=3D"fo=
nt-family:verdana,sans-serif"></span><br></font></b></div><div><font face=
=3D"verdana, sans-serif"><b><span class=3D"gmail_default" style=3D""></span=
></b></font><span style=3D"font-family:verdana,sans-serif">CC:=C2=A0</span>=
<span class=3D"gmail_default" style=3D"font-family:verdana,sans-serif"></sp=
an><span style=3D"font-family:verdana,sans-serif"><a href=3D"mailto:press@d=
ebian.org">[email protected]</a></span></div><div><span style=3D"font-family=
:verdana,sans-serif">CC:=C2=A0<span class=3D"gmail_default" style=3D"font-f=
amily:verdana,sans-serif"></span></span><a href=3D"mailto:[email protected]=
g">[email protected]</a></div><div><span style=3D"font-family:verdana,sans=
-serif">CC: <a href=3D"mailto:[email protected]">debian-devel@l=
ists.debian.org</a></span></div></div><div dir=3D"ltr"><div class=3D"gmail_=
default" style=3D""><font face=3D"verdana, sans-serif">CC:=C2=A0<a href=3D"=
mailto:[email protected]">[email protected]</a></font></div><=
br><div><hr><p><font face=3D"verdana, sans-serif"><span></span></font></p><=
p></p><div dir=3D"ltr"><p style=3D"color:rgb(34,34,34)"><font size=3D"1" fa=
ce=3D"verdana, sans-serif"><font color=3D"#666666"><b>CONFIDENTIALITY NOTIC=
E:</b>=C2=A0This email and any and all accompanying Electronically Stored I=
nformation (ESI), including all email threads, attachments, linked content,=
 and associated metadata, are intended <b>only</b> for the use of the indiv=
idual or entity to whom they are addressed. This communication <b>may</b> c=
ontain information that is private, confidential, legally privileged, and/o=
r proprietary.=C2=A0</font><span style=3D"color:rgb(102,102,102)"><b>If you=
 are not the intended recipient of this communication,</b> you are hereby n=
otified that any unauthorized review, use, disclosure, dissemination, copyi=
ng, or distribution of this message or its contents is prohibited.=C2=A0</s=
pan><span style=3D"color:rgb(102,102,102)">If you have received this commun=
ication in error, <b>please notify the sender.=C2=A0</b></span></font></p><=
p style=3D"color:rgb(34,34,34)"><font face=3D"verdana, sans-serif"><font si=
ze=3D"1"><b style=3D"color:rgb(102,102,102)">COPYRIGHT AND INTELLECTUAL PRO=
PERTY NOTICE:</b><span style=3D"color:rgb(102,102,102)">=C2=A0The text, att=
achments, and all other content of this email are unpublished literary work=
s and/or proprietary information protected by U.S. Copyright Law (17 U.S.C.=
 =C2=A7 101 et seq.) and other applicable intellectual property laws. The s=
ender is the sole copyright and intellectual property holder. Unauthorized =
reproduction, distribution, or use of this communication is strictly prohib=
ited.=C2=A0</span></font><span style=3D"color:rgb(102,102,102);font-size:x-=
small">The disclosure of this communication does not waive any applicable l=
egal privilege. The sender retains all rights and privileges associated wit=
h this communication and its contents.=C2=A0</span></font></p></div></div><=
/div></div></div></div>

--0000000000000738b7064dc272bd--