15:37:07 #startmeeting RELENG (2014-09-22) 15:37:07 Meeting started Mon Sep 22 15:37:07 2014 UTC. The chair is dgilmore. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:37:07 Useful Commands: #action #agreed #halp #info #idea #link #topic. 15:37:12 #meetingname releng 15:37:12 The meeting name has been set to 'releng' 15:37:12 #chair dgilmore nirik tyll sharkcz bochecha masta pbrobinson 15:37:12 Current chairs: bochecha dgilmore masta nirik pbrobinson sharkcz tyll 15:37:13 #topic init process 15:37:23 who alls here? 15:37:35 * bochecha_ is here 15:37:45 * sharkcz is here 15:37:54 * nirik waves. hola. 15:38:12 Hi there 15:39:20 lets get started :) 15:39:41 * pbrobinson is here 15:39:54 #topic #5931 [Proposal] Move new branch and unretire requests to pkgdb2 15:39:58 pingu? 15:40:33 i pinged pingu in #fedora-releng 15:40:43 lets give him a minute 15:41:24 I was AFK all last week, so nothing new compare to the week before for me 15:41:33 okay cheers 15:41:42 I still have some question and want to figure out some things 15:41:53 #info nothing new 15:41:55 I'll try to send an email about them this week 15:42:07 #topic #5967 Enable source repo generation 15:42:09 #action pingou seend an email about open questions 15:42:18 #undo 15:42:18 Removing item from minutes: ACTION by tyll at 15:42:09 : pingou seend an email about open questions 15:42:19 #undo 15:42:19 Removing item from minutes: 15:42:27 #action pingou seend an email about open questions 15:42:27 #action pingou seend an email about open questions 15:42:31 bahh 15:42:34 sorry 15:42:35 ^_^ 15:42:40 tyll: its okay :) 15:42:41 twice more work 15:42:45 thanks guys! :D 15:42:45 #topic #5967 Enable source repo generation 15:42:49 https://fedorahosted.org/rel-eng/ticket/5967 15:42:57 so i failed to ask extra questions here 15:43:09 #action dgilmore to actually ask questions 15:43:21 #topic #4071 Block pushes to origin/ in gitolite ACLs 15:43:27 https://fedorahosted.org/rel-eng/ticket/4071 15:43:53 I've attached a patch that adds the hook to ansible 15:44:09 #info < bochecha_> I've attached a patch that adds the hook to ansible 15:44:20 but it would add it to new repos only (i.e the ones created after we'd deploy the patch) 15:44:46 bochecha_: we would probably want to have a one off script to apply it to all repos 15:44:54 dgilmore, that was my question :) 15:45:18 I didn't wknow whether we wanted that, or something part of the ansible deployment that would check all hooks in all repos, making sure they have everything they need 15:45:33 #action bochecha_ write a script to add hook to all existing repos 15:45:42 if we go with a one off script, i'll start working on it tomorrow 15:45:46 tyll, thanks :) 15:46:07 in theory the script should be enough 15:46:51 bochecha_: i think a one off script to run is fine 15:46:55 alright 15:47:10 we have a script already that checks the repos 15:47:17 nirik, oh, any link to that? 15:47:23 weekly I think? might be good to just be in there? check the hooks and add if not. 15:47:32 nirik, definitely 15:47:42 I can dig it up. 15:47:42 thats probably fine also 15:48:03 #info there is already a script to check repos weekly 15:49:02 /usr/local/bin/git-check-perms I think is the one I was thinking of. 15:49:10 we added fedmsg hooks in there in the past. 15:49:16 #info /usr/local/bin/git-check-perms 15:50:16 alright, I'll have a look, thanks 15:50:24 cool 15:50:31 bochecha_: echo "${refname}" | grep -q 'origin/' && exit 1 || exit 0 15:50:49 bochecha_: shouldnt that be echo "${refname}" | grep -q '^origin/' && exit 1 || exit 0 15:50:58 nope 15:51:04 to make sure that it starts with origin/ 15:51:09 refname will be refs/head/origin/foobar 15:51:35 so it could be « grep -q '^refs/head/origin/' » eventually 15:51:35 okay we should fix up the grep then 15:51:45 but not '^origin/' 15:51:51 it might be always unintented to use origin/ in the refs 15:52:12 /origin/ might be an alternative 15:52:17 it would be silly if someone did but they could do foo/origin/ 15:52:19 sure 15:55:00 #info regex in hook needs to be adjusted to not block valid branch names 15:55:56 that's my only comment on it 15:56:31 * bochecha_ will fix tomorrow, along with working on the script 15:56:32 lets move on 15:57:00 #action bochecha to update the regex and provide script to do one off migration 15:57:08 #topic #5329 RFE: Send branched report only when there is any change committed 15:57:15 https://fedorahosted.org/rel-eng/ticket/5329 15:57:24 so this would need to go into buildbranched 15:57:35 #info buildbranched needs to be adjusted for this 15:57:44 and I thionk there is value in still sending it to remind people to fix broken deps 15:58:09 however if people have fixed the deps and can't get them pushed stable due to freeze it is annoying 15:58:13 this sounds valid to not do it 15:58:24 to be a valid reason* 15:59:05 #info sending the branched reports reminds people of fixing broken deps 15:59:52 so im prettyu torn 15:59:58 pretty torn 16:00:09 hence why ive not looked at it at all 16:00:16 We might add information that there is nothing new to report, but then someone needs to do the work 16:00:33 it wouldn't be too hard to do 16:00:52 check the repodiff output and see if there was any difference 16:01:15 I think there's still value in the report, it might be useful to be able to put a flag for when we're frozen to print a message to that effect so people realise why though 16:01:46 it could even be always when there's 0 changed packages 16:01:48 #info to implement, check the repodiff output 16:01:55 there is a lot of value in it 16:02:12 ie, always say "0 changes today, we may be frozen for a milestone... ' 16:02:17 I have no plans to work on this 16:02:33 Is it an easyfix task? 16:02:55 tyll: probably, I really do not think we want to fix it 16:03:26 how about not sending the report if « there is no change AND there are no broken deps » ? :) 16:03:29 but changing the output to say we may be frozen or to give a bit more info could be valuable 16:03:45 yes, I meant adjusting the output 16:03:48 bochecha_: like that's ever going to happen :) 16:03:51 bochecha_: sure, but to date that's exactly never 16:04:16 « you don't want to recieve the email? fix your broken deps! » 16:04:53 #info highlighting that no changes happened or that there might be a freeze can be an alternative 16:05:35 #topic #5959 Enable keep-alive connections for koji (primary and secondaries) 16:05:41 https://fedorahosted.org/rel-eng/ticket/5959 16:05:54 pbrobinson: anyone else, have we notcied any breakages 16:06:01 tyll: did you check it works? 16:06:16 I did not get to do performance checks :-/ 16:06:38 okay 16:06:43 no, it appears to be running OK AFAICT 16:06:53 I know we hit timeoust much less often with mod_python 16:06:54 but TBH I've not been looking really closely 16:07:06 we started getting time out issues only when we moved to mod_wsgi 16:07:39 lets look at enabling everywhere after infra freeze is over tomorrow 16:08:08 we can always revert if we notice it causing problems 16:08:46 #info < dgilmore> lets look at enabling everywhere after infra freeze is over tomorrow 16:08:53 #info no problems noticed so far 16:09:05 #info no performance tests made 16:09:11 it would be wednesday that we can enable itr 16:09:12 it 16:10:23 #topic #5963 Orphaned vulnerable packages in EPEL 16:10:31 https://fedorahosted.org/rel-eng/ticket/5963 16:10:57 not sure what the status is here 16:11:06 there is not much for releng to do though 16:11:23 we either remove them, or they get a packager to update/fix them 16:11:35 . 16:11:44 I was just wondering, what we want to do here. Last time I started retiring some packages and it cause some discussion, because some depended on one 16:11:55 im pretty sure wordpress-mu was removed last week 16:12:12 These packages are all orphaned, FWIW. 16:12:19 I can just retire them all if we agree this is ok 16:12:28 But I didn't check for dependencies. 16:12:46 at least it will make people aware that they need to be taken care of 16:12:47 tyll: seems we maybe need a process to find packages with open security bugs, then make a report and notify owners 16:13:02 also notifying owners of packages that depend on them 16:13:08 find, notify, give some time for someone to fix or take, retire. ;) 16:13:16 it would be useful for fedora as well as epel 16:13:38 yes, this requires some more work to script this 16:13:49 yeah 16:14:17 also the packages were announced on epel-devel iirc 16:14:18 #action someone needs to write a script to pull info from bugzilla, look at package deps and do mass reporting 16:14:32 okay 16:14:41 it can be used for epel and fedora 16:15:01 I see a lot of value in this 16:15:06 dgilmore: We may already have tools for this within RH. 16:15:16 Sparks_too: if they are open great 16:15:17 dgilmore: Need to figure out licensing, etc. 16:15:43 dgilmore: Product Security uses them daily/hourly 16:16:03 #info for dependency checks we can use the find_unblocked_retired.py script 16:16:03 * Sparks_too will talk with his boss 16:16:27 #info there might be internal red hat scripts that might be used 16:16:52 #action Sparks_too check which internal red hat scripts can be used 16:17:34 So do we want to defer handling the packets mentioned in the ticket until we figured out the deps? 16:18:22 tyll: yeah. i know some have been removed 16:19:20 #info wait for dependency checks before moving on with the ticket 16:20:12 sure, it's waited this long. ;) 16:21:52 #topic #6000 automate creation of excludelist for koji-shadow 16:21:57 https://fedorahosted.org/rel-eng/ticket/6000 16:23:50 I think a cron job would do the work until better solution is found 16:23:50 this has been a long standing todo 16:23:51 some kind of cron job would be sufficent 16:23:51 maybe weekly or monthly? 16:23:51 thinsg shouldnt change often 16:23:51 I would prefer weekly 16:23:51 but when they do we kinda need to know 16:23:57 automating when people exclude or unexclude arches would be really useful 16:24:14 often people exclude arches and do not follow the policy and file bugs etc 16:24:25 detecting the changes would be good 16:24:25 correct :-( 16:24:30 could that be a fedmsg consumer? 16:24:42 bochecha_: NO 16:24:45 no 16:24:50 for all fedmsg about git pushes, check the diff, if it adds an exclude arch,... ? 16:24:54 opps sorry about that 16:25:25 bochecha_: need to know of it removes it also 16:25:33 sure, add/remove 16:25:39 same for ExclusiveArch 16:25:43 maybe analyze srpms from primary koji 16:25:53 when they are built 16:25:55 that's just searching for lines starting with "+" or "-" and containing "ExclusiveArch" or "ExcludeArch" 16:26:00 bochecha_: today we work it out by looking at teh srpms 16:26:53 sharkcz: i might look at adding it to buildbranched and build rawhide on primary 16:27:07 and just drop it nightly into files in teh logs dir 16:27:18 shouldn't take much 16:27:24 yeah, sounds as an option 16:27:34 #info maybe add a fedmsg watch to check for spec changes 16:28:04 #info check whether maintainers follow policy for excluded archs 16:28:07 but ideally catching when changes are made and making sure appropriate people are notified should happen alsdo 16:28:09 tyll: I'd rather analyze the srpms, it would be more precise 16:28:10 also 16:28:23 so really we have two things here 16:28:42 one is getting the lists of packages to exclude in koji-shadow 16:28:45 #undo 16:28:45 Removing item from minutes: INFO by tyll at 16:28:04 : check whether maintainers follow policy for excluded archs 16:28:47 #undo 16:28:47 Removing item from minutes: INFO by tyll at 16:27:34 : maybe add a fedmsg watch to check for spec changes 16:28:52 #info check whether maintainers follow policy for excluded archs 16:28:54 we can do that nightly with the compose 16:29:13 the other is making sure people are following the ExcludeArch policy 16:29:22 which effects all arches, primary included 16:29:35 ack 16:29:39 #info task one: get list of packages to exlucde in koji-shadow during nightly composes 16:29:49 #undo 16:29:49 Removing item from minutes: INFO by tyll at 16:29:39 : task one: get list of packages to exlucde in koji-shadow during nightly composes 16:29:51 #undo 16:29:51 Removing item from minutes: INFO by tyll at 16:28:52 : check whether maintainers follow policy for excluded archs 16:29:53 #info task one: get list of packages to exlucde in koji-shadow during nightly composes 16:30:02 #info task two: check whether maintainers follow policy for excluded archs 16:30:46 #info get notified by changes for packages by analysing SRPMs or analyse commit with fedmsg (less precise) 16:30:53 #action dgilmore to add to buildbranched and buildrawhide making the lists for koji-shadow 16:31:22 lets move on 16:31:29 #topic #5886 need method for distributing urgent fixes... urgently 16:31:35 https://fedorahosted.org/rel-eng/ticket/5886 16:31:45 so this came up after heartbleed 16:31:58 we had the fix ready quickly 16:32:01 we got testing and karma quickly 16:32:20 we had issues with bodhi at the time and it took over 24 hours to get it pushed out 16:32:48 * nirik isn't against the idea of a urgent repo, but will need work and we likely won't use it too often 16:32:53 so one of teh proposals was to add a repo in fedora-release (now fedora-repos) thats always enabled 16:33:12 where we could manually put signed rpms and get fixes out of band out quickly 16:33:29 to date we would have used it once in 10 years 16:34:07 we could do something like we do with the bleed repo for TC and RC composes 16:34:23 we could use it for all/more security updates 16:34:33 hopefully also bodhi2 improvements might allow for faster pushes in any case. 16:34:34 and by not using it often it will invariably break when you need it the most ;-) 16:34:47 by using it more, we ensure that it actually works 16:34:49 tyll: well we would likely flush the repo after a week 16:35:00 once updates got out via the regular channels 16:35:29 tyll: using it all the time is cumbersome 16:35:30 dgilmore: so this urgent repo wouldn't use bodhi then? or it would? 16:35:46 the only way to really use it is a mostly manual out of band process 16:36:00 nirik: from what i understood it wouldnt 16:36:23 once we have it manual, it should be easy to make it automatic and e.g. also create it when we push regular updates 16:36:25 bodhi is a roadblock to getting hings out quickly 16:36:33 tyll: not really no 16:36:38 we would still have to deal with things like updateinfo tho... or people with the security yum plugin might not see the updates. 16:36:55 nirik: updateinfo is something entirely in bodhi 16:37:08 right, which is why it could be difficult. 16:37:25 so the problem is this 16:37:34 that being said, for bodhi 2 there are talks of having a kind of « monthly bundle » update stream (aka « Patch Tuesday »), so if we can do that, maybe we could have the exact opposite : an urgent update stream? 16:37:38 say we just started a f19 and f20 push 16:37:45 and we get something like heartbleed 16:37:58 we cant use bodhi to push it for likely 8-12 hours 16:38:21 with bodhi2 hopefully we have parallel mashing... so it takes a lot less time. 16:38:29 where out of band we could likely get a build pushed out in about 15-20 minutes of it being completed 16:38:45 but the out of band process doesnt scale 16:39:14 also sometimes "urgent push this fix now" updates are borken/not fully tested right. 16:39:26 we would need to be carefull to make sure it doesn't make things worse. 16:39:32 nirik: rigth 16:39:33 like the dbus security update long ago 16:39:34 right 16:40:07 I do not think we can fix this today 16:40:15 so it is a question whether this is something that should be enabled by default or can be enabled by interested users 16:40:35 but if we are going to add an urget fixes repo would be nice to have it in f21 from day 1 16:40:49 tyll: it would be enabled by default 16:40:53 or again have two repos with a testing and non-testing updates 16:41:02 its more a question of how do we set it up and make it work 16:41:53 tyll: i think it would be just one repo where we push things if the nature of the security fix deemed an urgent reponse 16:42:03 like heartbleed 16:42:22 using it as a regular security update repo is messy and ugly 16:42:52 because you get to a point where security fixes rely on non security fixes 16:45:07 the more that goes into the repo the harder it is to manage and longer ittakes to get out 16:47:18 any other thoughts here? 16:47:41 I guess we need to decide what exactly is wanted 16:47:50 and work out how to make it work 16:48:11 yes, I guess this needs to be cleared 16:48:17 from my point of view something light weight and well understood would work best. to only be used in an emergency 16:48:35 #info < dgilmore> I guess we need to decide what exactly is wanted 16:48:43 #info < dgilmore> from my point of view something light weight and well understood would work best. to only be used in an emergency 16:49:05 I am kinda thinking that we put it under /pub/fedora/linux/updates/emergency/ 16:49:24 #info < dgilmore> I am kinda thinking that we put it under /pub/fedora/linux/updates/emergency/ 16:49:31 and use a process similliar to how we make the bleed repo 16:49:42 with proper spelling 16:51:16 anything else here? 16:51:51 we are over time, and i would like to go over secondary arches since we have not gotten to them for awhile 16:52:16 im going to take that as a no 16:52:18 #topic Secondary Architectures updates 16:52:19 #topic Secondary Architectures update - ppc 16:52:26 pbrobinson: you're up amigo 16:55:32 hrrm guess we lost him 16:56:02 #topic Secondary Architectures update - s390 16:56:07 sharkcz: you're up 16:56:10 * pbrobinson is here 16:56:13 sorry 16:58:07 I'm over the rebuilds required for the ABI revert, so builds in f212 continue again 16:58:45 sharkcz: okay 16:58:59 sharkcz: have you tried to compose anything at all? 16:59:08 as far as install trees go? 16:59:14 not yet 16:59:55 okay 16:59:56 can try after the current (or next) shadow run ends, there are still some builds missing 17:00:09 cool, hopefully they go okay 17:00:16 will you just do a server compose? 17:00:23 yes 17:00:26 okay 17:00:33 lets go back to ppc 17:00:42 unless you have something else to add 17:00:51 nope 17:00:51 #topic Secondary Architectures update - ppc 17:00:57 pbrobinson: take 2 ;) 17:01:09 so sharkcz probably know better the states of builds there, I'm going through the first round of composes now 17:01:25 but I think builds are looking pretty good 17:01:44 builds are quite fine - http://ppc.koji.fedoraproject.org/koji/serverstatus - no major immediate issues 17:01:57 hoping to get a RC Alpha compose out the door this evening 17:02:17 would be great 17:02:31 okay 17:02:41 and for now at least ppc will be server only? 17:03:01 sharkcz: be aware of this issue depending on how you run mock https://bugzilla.redhat.com/show_bug.cgi?id=1140886 17:04:15 pbrobinson: thx 17:05:41 dgilmore: you want aarch64 update? 17:06:05 pbrobinson: im waiting on my previous ppc question to be answered 17:06:27 17:02 < dgilmore> and for now at least ppc will be server only? 17:07:09 yes 17:07:11 do we not know that yet? 17:07:16 okay 17:07:20 * bochecha_ really has to go 17:07:26 i had heard that cloud may be an option on ppc 17:07:31 there is potential for cloud too 17:07:32 thanks bochecha_ 17:07:46 ah, yes for now ppc will be server only 17:07:50 if thats wanted it should be worked on now and not later in teh cycle 17:08:01 okay 17:08:04 #topic Secondary Architectures update - arm 17:08:13 pbrobinson: you're up again 17:08:20 well by cloud it'll be a qcow image... so really a tiny subset of cloud... 17:08:40 so builds for both f21/22 are only a little way behind 17:08:46 pbrobinson: that involves a cloud install tree and other bits 17:09:11 yep, I realise that, what I mean is there will be no docker/ec2 etc 17:09:13 anyway we can deal with that out of band 17:09:18 okay 17:09:40 pbrobinson: I know we need to get a compose box setup in phx2 for aarch64 17:09:52 there's some issue with the sync of new packages over to at least arm.koji so it believes there's about 97 odd new packages that aren't packages 17:10:01 do we want to do a Workstatsion compose along with server? 17:10:05 and then I was going to look at composes this week 17:10:13 I think we start with server and expand out from there 17:10:23 need to debug owner-sync-pkgdb 17:11:01 yea, I need to find the repos where that is and then I was going to look.... once I have ppc composes in some definition of work state 17:11:21 its in puppet which is only on lockbox 17:11:31 pingou: any chance you have some time to look 17:11:46 pingou: it seems owner-sync-pkgdb is not syncing to at least arm koji 17:12:33 I need to go, too 17:14:10 tyll: thanks 17:14:15 will be wrapping up soon 17:17:08 okay lets move on 17:17:19 #topic Open Floor 17:17:26 anyone have anything to bring up? 17:18:05 I am going to take off at least Wednesday though Friday 17:18:10 maybe a little longer 17:19:02 good plan. ;) 17:19:12 can I commit a script I crafted for the rebuilds on s390 to rel-eng git? I might be useful for someone in the future? 17:19:17 ive had one day this year 17:19:25 sharkcz: sure 17:20:02 ok, will probably add it to some "misc" dir 17:20:13 that is fine 17:20:36 ok, it's really meant as one off helper, but not to be forgotten :-) 17:20:36 probably should look to clean up scripts a bit 17:21:50 okay if nothing else lets close up 17:22:03 ok 17:22:10 #endmeeting