How Debian Uses Devotee for Secret Voting

The Debian Project governs its decentralized community through a rigorous democratic process defined by the Debian Constitution, using automated software called Devotee (Debian VOTing MachinE). Devotee conducts project-wide elections, such as Debian Project Leader (DPL) races and General Resolutions, by receiving digitally signed email ballots, validating voter eligibility against the project's cryptographic web of trust, anonymizing ballot choices to protect voter privacy, and calculating results via the Condorcet/Schulze voting method.

The Role of Devotee

Devotee is an open-source voting engine designed specifically to handle the electoral needs of Debian. Administered by the Debian Project Secretary, the software automates the process of distributing ballot templates, collecting incoming votes, validating identity credentials, computing the outcome, and publishing the mathematical proofs of the election.

Identity Verification via OpenPGP

Debian does not rely on traditional web portals, passwords, or centralized accounts for voting. Instead, the voting system is anchored in Debian’s GnuPG/OpenPGP keyring:

  1. Voter Eligibility: Only official Debian Developers (DDs) whose public keys reside in the active Debian keyring are eligible to vote.
  2. Receiving the Ballot: When a vote is called, the Project Secretary sends a Call for Votes over email, including an automated ballot template.
  3. Casting the Vote: The developer fills in the ballot—ranking options from most preferred to least preferred—and digitally signs the plain text email with their official OpenPGP key.
  4. Submission: The signed message is emailed directly to the Devotee mail robot. Devotee inspects the message, validates the OpenPGP signature against the official keyring, ensures the voter has not already voted (or replaces an earlier vote from the same voter if cast before the deadline), and sends a signed confirmation email back to the voter acknowledging receipt.

Implementing Ballot Secrecy

Historically, Debian operated under fully public tallies where every developer's signed ballot was published at the conclusion of the vote, allowing independent verification of the entire voting pool. However, following a General Resolution in 2022 to amend the Debian Constitution, the project transitioned to secret ballots to prevent voter coercion, peer pressure, and tactical voting.

Devotee was adapted to enforce ballot confidentiality while maintaining cryptographic validation:

  • Separation of Verification and Ballot Content: When an incoming vote is received, Devotee verifies the cryptographic signature to confirm that the ballot came from an authorized Debian Developer and that the signature matches the message contents.
  • Anonymization: Once the identity is validated and recorded on the list of developers who have participated (preventing double voting), the voter's identity is decoupled from the actual ranking of preferences.
  • Receipt Token Generation: Devotee generates a unique, pseudonymous cryptographic hash or receipt associated with the submitted ballot and emails it back to the developer. This allows the individual voter to verify that their specific ballot was included in the final raw tally without revealing their choices to the broader public.

The Schulze Counting Algorithm

Debian uses the Condorcet method with the Schulze algorithm (also known as Cloneproof Schwartz Sequential Dropping) to evaluate preferences. In this system:

  • Voters rank options sequentially (e.g., 1 > 2 = 3 > 4). Unranked options are automatically ranked below all explicit choices.
  • Every option is paired against every other option head-to-head.
  • An option that beats every other option in one-on-one matchups is declared the Condorcet winner.
  • If cyclic preferences occur (e.g., Option A beats B, B beats C, and C beats A), the Schulze algorithm drops the weakest pairwise defeats sequentially until a single definitive winner emerges.
  • A default option ("Further Discussion") is always included on the ballot to ensure that an initiative or candidate only passes if preferred over continuing debate.

Auditing and Election Conclusion

When the voting window closes, the Project Secretary commands Devotee to finalize the tallies. Devotee compiles the anonymized list of cast ballots, the pairwise comparison matrix, and the mathematical resolution of the Schulze algorithm.

The software then generates a final signed report sent to the debian-devel-announce mailing list. The report lists the total number of participants, confirms quorum requirements were satisfied, and provides the full anonymized dataset, enabling any developer to independently run alternative Condorcet calculation scripts and verify the accuracy of the result.