How Debian Developers Vote Using Condorcet Method

Debian Developers make major governance decisions and elect leadership through General Resolutions (GRs) using a specialized, ranked-choice Condorcet voting system. Ballots are distributed and collected via cryptographically signed emails, which are processed by an automated tallying engine called Devotee. By employing the Schulze method (a form of Cloneproof Schwartz Sequential Dropping), the Debian Project determines a single winning option that beats all other individual choices in head-to-head comparisons, ensuring fair, transparent, and mathematically rigorous community decisions.

The Condorcet Voting Principle in Debian

A Condorcet voting system elects the option that wins a pairwise comparison against every other competing option on the ballot. If Option A is preferred over Option B, and Option A is also preferred over Option C, Option A is the Condorcet winner.

Because voters can produce circular preferences (where A beats B, B beats C, and C beats A), Debian uses the Schulze method to resolve these ties. The system evaluates the strength of the strongest paths between options in a directed graph and sequentially eliminates the weakest links until a single, clear winner emerges.

Every Debian General Resolution ballot also includes a default option, usually designated as "Further Discussion." To win, an option must not only beat the other alternatives but must also defeat this default option and satisfy quorum and supermajority requirements defined in the Debian Constitution.

The Ballot and Ranking System

When a General Resolution reaches the voting stage, the Debian Project Secretary sends a Call for Votes to the debian-devel-announce mailing list. This email contains a standardized ASCII text ballot listing all proposed choices.

Debian Developers cast their votes by ranking the options numerically:

  • Preferences: Voters assign a number to each choice, where 1 represents the most preferred option, 2 represents the next preference, and so on.
  • Equal Ranking: Developers can assign the same number to multiple options if they view them with equal preference.
  • Unranked Options: Any option left unranked is automatically treated as less preferred than all explicitly ranked options, and equal to all other unranked options.

Ballot Submission and Authentication

Voting in Debian is conducted entirely over email using OpenPGP cryptography to authenticate voters while preserving voter privacy:

  1. Filling the Ballot: The developer copies the standard ballot template into a text editor and enters their numeric preferences next to the corresponding options.
  2. GPG Signing: The completed text block is cryptographically signed using the developer's OpenPGP/GnuPG key, which must be present in the official Debian Web of Trust keyring.
  3. Transmission: The signed email is sent directly to Debian’s automated vote-collection address (ballot@vote.debian.org).
  4. Verification and Receipt: The automated voting engine, Devotee, validates the PGP signature against the project keyring. Once verified, Devotee replies to the developer with an acknowledgment email containing a unique cryptographic hash of the received ballot.

Developers may submit a new ballot at any point before the voting period ends; the latest valid submission supersedes all previous ones.

Tallying and Transparent Auditing

Once the voting period closes, the Project Secretary runs the tallying process:

  • Matrix Generation: Devotee counts the preferences across all valid ballots and constructs a pairwise comparison matrix showing how many voters preferred Option X over Option Y for every possible pairing.
  • Resolution of Cycles: If Condorcet cycles occur, the Schulze path-finding algorithm calculates the Schwartz set and drops the weakest pairwise defeats to identify the winner.
  • Quorum Verification: The system verifies that the required quorum of developers participated and that any proposal requiring a constitutional supermajority (such as a 3:1 ratio over the default) achieved the necessary margin.

After calculation, the Debian Project Secretary publishes the complete matrix, the winning result, and an anonymized list of all submitted ballots identified only by the cryptographic receipts. This allows any developer to independently recalculate the outcome and verify that their own ballot was counted correctly without revealing their individual voting preferences to the public.