19:59:49 #startmeeting Fedora Infrastructure 20:00:08 #topic Who is here? 20:00:10 * lmacken 20:00:12 * onekopaka 20:00:13 * ricky 20:00:45 Fedora Infrastructure Meeting. I don't know how to 'Yell' in a channel my announcements will be a bit muted :) 20:00:50 smooge is here 20:01:07 * f13 20:01:12 * SmootherFrOgZ is around 20:01:17 * mdomsch is here for a short time 20:01:25 * abadger1999 stands up to be counted 20:01:29 * jpwdsm is here 20:01:31 okie dokie 20:01:39 Thank you all for showing up. 20:01:55 mmcgrath is in class this week. and I will try to run this quickly and clearly 20:02:00 We will start with Tickets 20:02:06 * fontana is here 20:02:21 #topic tickets (https://fedorahosted.org/fedora-infrastructure/query?status=new&status=assigned&status=reopened&group=milestone&keywords=%7EMeeting&order=priority) 20:02:23 * J5 is here 20:02:41 smooge: ick. make that into a tinyurl. 20:02:51 .tiny https://fedorahosted.org/fedora-infrastructure/query?status=new&status=assigned&status=reopened&group=milestone&keywords=%7EMeeting&order=priority 20:02:56 #link https://fedorahosted.org/fedora-infrastructure/query?status=new&status=assigned&status=reopened&group=milestone&keywords=%7EMeeting&order=priority 20:03:03 thank you onekopaka 20:03:12 * onekopaka hopes the #link worked 20:03:17 I forgot it was .tiny and not /tiny 20:03:30 #link https://fedorahosted.org/fedora-infrastructure/query?status=new&status=assigned&status=reopened&group=milestone&keywords=%7EMeeting&order=priority 20:03:55 #topic tickets -- 1503 Licensing. 20:04:05 abadger1999, you and spot have updates 20:04:14 So we got back a lot of good information from legal. 20:04:26 * abadger1999 thinks fontana might be here if we have furhter questions. 20:04:42 abadger1999: yes :) 20:04:53 * lmacken waves at fontana 20:05:04 Nice :-) 20:05:05 ok at this point we are looking at how we can best comply with the AGPL 20:05:09 fontana: oh, I left you a gift from the SFLC on your door frame btw :) 20:05:12 If we link to the srpms and the trac query for all hotfixes applied to fedora infrastructure apps, we should be covered. 20:05:13 * fontana waves back at lmacken 20:05:21 and its going to be about methodology to make sure that the source code is available to users 20:05:22 fontana: from ian sullivan 20:05:24 lmacken: got that, thanks (was wondering who put it there) 20:05:27 I think that's reasonable for production. 20:05:42 abadger1999, I thought the trac entries were NOT acceptable. 20:05:47 config files are not copyrightable so that should be fine. 20:05:52 * abadger1999 looks at hte email again 20:06:26 * sijis is here. 20:06:30 + links to base srpm and tickets in trac that have patches attached 20:06:32 * Red Hat Legal says that this is OK. 20:06:42 sounds like we need a HotfixSOP 20:06:54 So the mirrormanager example from last week that said what we changed but didn't provide a patch would not be okay. 20:06:56 For reference, hereis what the link woud look like: 20:06:57 .tiny https://fedorahosted.org/fedora-infrastructure/query?status=new&status=assigned&status=reopened&group=milestone&keywords=%7Ehotfix&order=priority 20:07:04 But if we have a patch we are okay. 20:07:04 lmacken, we will need a HotfixSOP and a testing/integration SOP 20:07:33 So if everyone else agrees that that's fine, it just leaves the question of staging and publictest. 20:08:29 yay more SOPs! 20:08:39 * herlo likes SOps 20:08:43 abadger1999, thanks. I misread and thought it was the next one down. 20:08:47 fontana: Did spot send you the followup questions? Whether we can avoid the AGPL requirment if we use Apache Basic Auth to limit who can access the staging and publictest instances? 20:09:06 abadger1999: I don't think spot sent me that, but I saw it in the mailing list archives anyway 20:09:35 basically we would like to limit who the "users" are that we intend to give the "code" to. 20:09:38 abadger1999: you're limiting it to members of the FI team? 20:09:45 darn, i knew i was forgetting something. :/ 20:09:57 * smooge pulls out greasy noodle to whip spot 20:10:00 spot: why hello. 20:10:05 I'd be fine with apache auth, or requiring vpn/ssh tunnels to get to publictest* 20:10:21 fontana, it would be limited to Fedora Infrastructure and "Service Owners". 20:10:24 or staging.. even though it would be a little annoying 20:10:32 fontana: Yes. My proposal was the same group that has access to the servers -- sysadmin-test for publictest instances, for instance. 20:10:33 smooge: what's a Service Owner? 20:10:37 "Service Owners" being the sub-group that is asking for the application 20:10:41 ok 20:10:54 fontana: But the more inclusive we can be and still satisfy the requirements the better. 20:11:05 so if Fedora Marketing is wanting the AGPL blog, we would limit it to people with that group. 20:11:08 fontana: As that lets more people within Fedora test edge cases. 20:11:44 abadger1999: I think this is ok 20:12:02 In this way, the people who are requesting a service are able to see/use that code, and they would know how to get the source code 20:12:06 bkuhn from sflc is not here to tell me I am wrong 20:12:11 fontana: Cool. Would all of sysadmin also be okay? 20:12:12 :-) 20:12:17 fontana: =) 20:12:39 smooge: right 20:13:10 * abadger1999 sees smooge's proposal already had that. 20:13:39 i proposed something? I forgot ... turning 40 is like the new 80. 20:13:52 err.. limited to Fedora Infrastructure and "Service Owners". 20:13:59 ah yes. 20:14:03 smooge: nah, it's not. 20:14:03 Slightly different than what I thought up on the lsit. 20:14:35 abadger1999, it comes from all my ITIL brainwashing 20:14:52 ok do we have any other questions on particulars of the license? 20:15:29 if not we can move onto either the next topic or spend 5 minutes on what SOP's would be needed, who is writing them, and when we can have some drafts? 20:15:39 One note is that FAS auth in stating/testing will be a pain 20:15:56 ricky: In what way? 20:16:06 * smooge repeats abadger1999 20:16:16 We don't like to mix testing, prod, and staging, so using mod_auth_postgres to handle restricting access to staging/testing instances is not allowed 20:16:32 It'd suck to make exceptions for this (especially with testing) 20:16:36 smooge: How about 5 minutes of implementation talk and then I'll write up the changes we'll need to make for next meeting. 20:17:06 So that's how it'll be a pain. 20:17:07 abadger1999, noted 20:17:14 ricky: Ah... fasClient currently hits the production fas anyway, right? 20:17:33 In testing, yes, in staging, no 20:17:45 But staging has hosts entries to point to the staging db 20:17:51 And publictest servers have no access to the db by design 20:19:15 * ianweller rolls in 20:19:27 PAM auth is an option, but I just wanted to make it clear that mod_auth_postgres is probably not 20:19:37 ianweller: did you lose your jetpack? 20:20:00 At least not for publictest machines - if you ignore the outdated auth info, it's usable in staging 20:20:09 20:20:13 which we already do ignore that problem for the most part :-( 20:20:44 ricky: Could we stick the publictest servers behind a proxy? 20:21:31 Then the proxy does the bsaic Auth and tlaking to mod_auth_postgres. 20:21:41 We could. It'd be highly annoying, but doable 20:21:46 k 20:22:06 In a sense, it'd be something that needs to be done when something gets deployed to production anyway 20:22:07 So that's a sticky point. 20:22:31 But it'd cause AGPL compliance to burden people testing non-AGPL apps, which I really want to avoid 20:22:38 Any other problems people can identify? 20:22:50 oh one second. Thank you fontana, and spot is there anything you wanted to add? 20:23:19 nope. :) 20:24:02 ricky: also note, we'll have to figure out something whether we switch infrastructure over to AGPL or not. 20:24:02 ricky, abadger1999 it looks like we will need to work out a testing/staging SOP/network design 20:24:19 Since we have one AGPL app that people need to test and collaborate on. 20:24:44 abadger1999: Well, doing painful configuration one time for fcomm/moksha is fine with me, as long as it won't affect other stuff 20:25:55 ricky I think we should not lookinat at as one-time .. long term there will be other apps etc that will need it even if they aren't AGPL. 20:26:09 ok I am at 10 minutes for technical discussion. 20:26:19 sorry 20:26:25 Cool. move on to the next one. 20:26:31 next topic 20:26:48 #topic tickets #1573 20:26:58 back to you abadger1999 20:27:01 .ticket 1573 20:27:18 This one's somewhat of a FYI. 20:27:32 We have "All rights reserved" i nthe footer of pretty much every Fedora page. 20:27:53 And there is a problem with that? Oh wait.. I don't work for a University any more. 20:28:02 are our right becoming first-come-first-serve? 20:28:08 rights* 20:28:09 That's misleading since we're actually licensing everything in one way or another (the trademark license for the logo is the most restrictive one we have) 20:28:11 ;) 20:28:21 abadger1999: "All rights reserved" is evil and should be eliminated 20:28:24 So we should remove it. 20:28:26 * hiemanshu is here now 20:28:39 what is the proper rights we should have? CC All rights reserved ? 20:29:02 spot, fontana: Couple questions: Do we need to talk to other groups when we make changes 20:29:04 (like docs) 20:29:05 all the fedora docs are currently OPL, and will be moving to CC BY-SA 20:29:10 abadger1999, as you said this is FYI. Who will be working on it? 20:29:57 2) Should we list the actual license in use? (GPLv2/AGPLv3+ for web apps, OPL to be replaced by CC-BY-SA for docs and wiki) ? 20:30:17 How urgently should we treat this? 20:30:25 Like is it worth live-patching FAS for? 20:30:30 abadger1999: you probably should let them know you're doing it, but you don't have to get their approval 20:30:32 smooge: Depends on the answer to #1. I'm hoping I can submit patches for all the web apps after thismeeting. 20:30:47 AndI'm hoping ricky hasaccess to all the others :-) 20:30:50 ricky no I don't believe its that urgent. regular relaease cycle 20:31:04 abadger1999: and you don't have to list the license in use, but it would not be incorrect to do so 20:31:10 FAS is unlikely to have a release in quite some time 20:31:28 ricky: yeah, it doesn't need changing. 20:31:53 ricky, ok.. regular rollout of code versus hot-patch 20:31:56 :) 20:32:23 Regular rollout i suggest 20:32:23 to me hot-patch means your typing in another window during this meeting... regular rollout is it goes through testing 20:32:50 Excellent -- so the FYI portion is "don't use "All rights reserved" in the future and if you see more of that footer in the future, let me know so I can make sure it gets fixed. 20:33:08 should we just report those to that ticket? 20:33:11 All I'm saying is that regular rollout could potentially be months away for all I know vs. a trivial string change. 20:33:17 ianweller: Yep. that would be best. 20:33:18 Anyway, if it's not urgent, I'll leave it alone 20:34:02 I think as long as we get it into version control soon it's fine. Deployment can wait. 20:34:20 ricky, months away sounds passable. 20:34:47 ok anything else? 20:34:52 Cool. So that's all I have for that one. 20:35:13 #topic Other tickets 20:35:26 Er, one more thing 20:35:32 waits... 20:35:34 While the legal people are around - should that copyright line not be translated? 20:35:53 (As in should it remain in English on all translated versions of the page) 20:36:12 Right now, it's marked as text that can be translated 20:36:42 spot, fontana question for you. 20:37:06 The text I'm talking about is "Copyright (c) 2009 Red Hat, Inc. and others. All Rights Reserved. For comments or queries, please contact us" 20:37:22 * ricky imagines the contact stuff can remain translated 20:37:39 ricky: You mean translate "Copyright © 2009 Red Hat, Inc. and others. All Rights Reserved. For comments or queries, please contact us. "? 20:37:45 Yup 20:37:53 well, without the "All Rights Reserved."... 20:38:10 So that line with "All Rights Reserved" is fine to be translated, then? 20:38:28 * spot defers to fontana 20:38:30 ricky: I wouldn't translate the 'Copyright' part. 20:38:32 ricky: as long as it doesn't have "All Rights Reserved" ;) 20:38:40 OK, I'll leave that out, thanks for clarifying 20:38:51 ricky: I guess you could translate the contact part, if you want. 20:39:00 So from "For comments or queries..." will be the only part translatable 20:39:02 AFAIK Copyright part is never translated any where 20:39:36 ricky: You could make the copyright part non-language-specific by just using the copyright symbol without "Copyright", I suppose 20:39:51 © 20:39:55 right 20:39:59 hiemanshu: It is at http://fedoraproject.org/zh_TW/ for example 20:40:20 ricky: it should not be translated 20:40:43 © 20:40:44 OK, so (c) 2009 Red Hat, Inc. and others can be translated, or does it stay in English? 20:40:54 ricky: it depends on which country the company or project is located, USA in our case so it should be English 20:41:04 * ricky would be happy to ask all of this after the meeting if you'll still be around. 20:41:39 ricky: it should stay in English 20:41:54 ricky: legally the "and others" probably doesn't mean anything so I don't think it matters 20:42:00 ricky, lets put this into email. I believe that they are saying the For comments ... should be translated but licensing should not 20:42:02 Cool, thanks 20:42:03 we could take this offline and post the 'results' to the list. 20:42:17 okie dokie 20:42:19 It'll show up in list via the meeting logs, so I'm happy as is 20:42:29 Any other tickets we are looking at? 20:42:46 ricky and dgilmore updated BIND on the servers last night. 20:43:21 yep 20:43:24 I am working on getting a trip to Az to upgrade backup hardware. 20:43:27 I heard of that story. 20:44:04 not the trip story 20:44:08 the BIND updatign 20:44:11 updating* 20:44:30 there was a story involved? Beyond where the f* is smoogen and why isn't he doing it? 20:44:53 smooge: of course. 20:45:28 Alright I think that means we are on open floor 20:45:35 #topic openfloor 20:45:43 sorry im late 20:45:50 blogs.fedoraproject.org 20:45:58 f13: How is the signing server going? 20:46:10 jwb is using it right now 20:46:15 so far so good 20:46:17 Cool :-) 20:46:30 We've discovered a number of issues with the first setup, that we'll need to resolve and do a clean re-deployment 20:46:42 and then write up some good SOPs in case I get eaten by a raptor 20:46:44 ok cool. let me know when you need that 20:46:48 and then we'll be able to go "live" with it 20:46:53 I need to rebuild the RAID 20:47:19 I've been (slowly) working on learning the hosted setup enough to expand the SOPs and create an improved hosted-setup script to do the dirty work for us. 20:47:48 today I'm wondering if we have any working examples of svn commit notifications. 20:48:07 tmz: I think aplaws might be a project with an example of that - not sure if it got broken with noexec or not though 20:48:08 tmz, what does that mean? rebuild of fedora hosted 20:48:11 THanks for working on that by the way 20:49:04 ricky: yeah, I know aplaws is one of them, but it uses a post-commit in /srv/svn, so I'm thinking it's likely to be broken. but I don't honestly know yet. 20:49:20 Ah, I think I tried to debug that at some point with no luck - maybe noexec was the culprit 20:49:44 smooge: nah, no rebuilds needed. just a smarter and more comprehensive hosted-setup script for creating new projects. 20:49:53 ah ok 20:49:55 thanks 20:50:03 Update on mirrors: 20:50:25 The i2 mirror is up, but we're getting slower speeds on than we'd expect from i2 20:50:32 So we opened a ticket with the networking people today 20:50:46 Otherwise, things seem to have cooled down significantly since last meeting 20:52:00 thanks ricky 20:53:02 blogs.fedoraproject.org? 20:53:12 ok what about blogs :)? 20:53:24 so. 20:53:30 It's on production servers 20:53:38 but we're trying to work on SSL login. 20:54:04 One thing I'd like you guys to do is make it clear on the front page that it's not 100% in production yet - otherwise there might be some confusion 20:54:06 thing is, HAProxy isn't going over SSL 20:54:12 ricky: will do 20:54:19 Then you can make an announcement post and everything when it's 100% ready 20:54:34 and so value1 & value2 aren't seeing that the request is SSL 20:54:59 and that's confusing WPMU. 20:55:20 oh so there needs to be an SSL proxy? 20:55:52 i would think so. 20:55:53 smooge: yes, but I haven't figured out how to do such a thing, and ricky doesn't want us to use SSL on value1 & value2. 20:56:01 It's the app servers that wordpress-mu needs to think is SSL, but we'd rather avoid that, even if it takes patches sent upstream to fix it 20:56:17 One resource to try is asking people who run wordpress.com how they do it 20:56:25 Assuming that they have separate proxy/app servers 20:56:29 probably hardware :) 20:56:44 ricky: their infrastructure is largely based on nginx 20:57:14 ricky: which is kinda like haproxy, but it can also serve static HTML, and run FCGI apps. 20:57:36 OK, so on the backend, is it http or https? 20:57:43 ricky: not sure. 20:58:10 ok 2 minutes til hardstop 20:58:25 It might be good to find out and see if they can maybe help with the setup. 20:58:26 ricky: the front end you can request with SSL, and in your Profile, choose to use SSL on your dashboard 20:59:10 yeah, not sure who does the infrastructure at Automattic. 20:59:42 (Automattic is the company that oversees wp.com, and WP/WPMU development, FYI) 20:59:55 oh I see. 20:59:59 http://automattic.com/about/ 21:00:25 ok lets wrap this up 21:00:27 Barry Abrahamson would most likely be the guy to talk to. 21:00:32 smooge: I'm not done. 21:00:49 are we going to run over into someone elses meeting? 21:01:01 smooge: I don't believe so. 21:01:01 I don't think so. 21:01:10 ok sorry I misread 21:01:24 continue on please and apologies for interrupting 21:01:33 I'll see if I can get in touch with Barry. 21:02:02 #action onekopaka to attempt to contact Barry Abrahamson, Systems Wrangler at Automattic. 21:03:10 He might also be able to help us with them MySQL queries ;) 21:03:41 wp.com is a big site, and they most likely have a way to back it up. 21:03:45 so I think we're done.. 21:04:25 #action onekopaka to attempt to contact Barry Abrahamson, Systems Wrangler at Automattic. 21:04:34 they also apparently have a big "deploy" button to deploy the latest WPMU code to wp.com 21:04:56 * onekopaka needs to go get lunch 21:05:10 ok sorry for taking a while to get to you 21:05:21 smooge: it's okay. 21:05:57 woah, new admin bar on wp.com. it has my gravatar even.. 21:06:18 do we have a time line? 21:06:30 smooge: for blogs.fp.o? 21:07:13 * onekopaka is hitting up the contact page on Barry's WP.com blog 21:07:26 yes? just as in where you think you might be in a couple of weeks 21:07:36 well 21:07:56 another note is that we would like to upgrade our WPMU 21:08:30 so that we can enable plugins sitewide (specificially "Bad Behavior" the anti-spam plugin we chose) 21:09:00 ok this is in the 'testing' stage correct? 21:09:13 so it would not impact users? 21:09:16 it's on prod. servers, but not quite there. 21:09:22 and the packages aren't in any repo 21:09:49 * onekopaka digs up his el5 package he made via Koji 21:09:59 http://oks.verymad.net/~onekopaka/wordpress-mu-2.8.2-1.fc11.src.rpm 21:10:13 hmm 21:10:19 that's the f11 one. 21:10:40 http://oks.verymad.net/~onekopaka/yumrepo/wordpress-mu-2.8.2-1.el5.noarch.rpm is the final one 21:11:11 I should rebuild them, I didn't put a changelog 21:11:19 ok so we need to have that built/signed/etc for the infrastructure correct? 21:11:34 Only if we actually do decide that it's worth upgrading to something not in EPEL/Fedora 21:11:39 ideally, we'd want them in epel & fedora 21:11:41 but. 21:11:43 but. 21:11:45 BUT! 21:12:21 bretm, the owner of the package says after wordpress-mu 2.7, there's a "missing feature" 21:13:03 but I have yet to hear what feature that is 21:13:11 which is annoying. 21:13:30 ah ok. we need to get that pinned down I think. 21:13:34 yep 21:14:06 hiemanshu was going to bug bretm about it, but I haven't any thing from him 21:14:42 so I'm pretty much done here... 21:14:49 and so I think we can #endmeeting. 21:15:03 unless anyone else has something to say. 21:15:32 I'm going to count from 5 21:15:35 5 21:15:37 4 21:15:39 3 21:15:41 2 21:15:45 1 21:15:47 0 21:15:49 ok 21:15:53 mmkay, time's up. 21:15:59 #endmeeting