#meeting-1:fedoraproject.org log

<@alexsaezm:fedora.im>

19:00:06

!startmeeting Go SIG meeting

<@meetbot:fedora.im>

19:00:07

Meeting started at 2026-03-09 19:00:06 UTC

<@meetbot:fedora.im>

19:00:08

The Meeting name is 'Go SIG meeting'

<@alexsaezm:fedora.im>

19:00:10

!topic Roll Call

<@alexsaezm:fedora.im>

19:00:15

Hi everyone! As always we'll wait ~5 minutes for everyone to join.

<@alexsaezm:fedora.im>

19:00:38

I hope we are not messing the schedule due to the DST changes 😄

<@mikelolasagasti:matrix.org>

19:03:19

!hi

<@zodbot:fedora.im>

19:03:21

Mikel Olasagasti Uranga (mikelo2)

<@buckaroogeek:fedora.im>

19:03:44

!hi

<@zodbot:fedora.im>

19:03:48

Brad Smith (buckaroogeek)

<@alexsaezm:fedora.im>

19:04:08

<@alexsaezm:fedora.im>

19:06:28

Well, I think we can start. I don't see anything new in the tracker so we can move to the open floor

<@alexsaezm:fedora.im>

19:06:35

!topic Open Floor

<@alexsaezm:fedora.im>

19:07:11

PSA: Fedora 42 is now following 1.25 as Fedora 43. And Fedora 44 and Rawhide already have 1.26.

<@mikelolasagasti:matrix.org>

19:07:14

mm,m there are topics we can discuss I think

<@alexsaezm:fedora.im>

19:07:23

oh from the tracker?

<@mikelolasagasti:matrix.org>

19:07:37

https://pagure.io/GoSIG/go-sig/issue/61 for example I understand can be considered complete

<@mikelolasagasti:matrix.org>

19:08:14

gotmax23: what do you think about closing that one?

<@mikelolasagasti:matrix.org>

19:09:42

mmm, let me start over

<@mikelolasagasti:matrix.org>

19:09:59

!topic Adopt go-vendor-tools and switch to vendoring by default - go-sig#61

<@mikelolasagasti:matrix.org>

19:11:22

the change to make vendoring itself was approved by FESCo 8 months ago and gotmax23 worked in the documentation changes. I know he plans to release go2rpm 2.0 making the vendoring the default option... and there might be something else, but I guess it can be closed.

<@mikelolasagasti:matrix.org>

19:11:56

as he is not here, I can take the action to ask him if he is OK to close it or document what's missing

<@mikelolasagasti:matrix.org>

19:11:58

ok?

<@alexsaezm:fedora.im>

19:12:37

By the description, I think it's done. Mostly because it's adopted and everyone is switching so fine by me. But yeah we should wait for gotmax

<@mikelolasagasti:matrix.org>

19:14:06

oh, look :D

<@gotmax:matrix.org>

19:14:13

/me is afk at the dentist

<@alexsaezm:fedora.im>

19:14:38

lol, I think that has higher priority 😄

<@alexsaezm:fedora.im>

19:14:45

we can wait 😄

<@alexsaezm:fedora.im>

19:15:31

we should move to another topic and close that later when we can, it's been there for months, not gonna hurt

<@mikelolasagasti:matrix.org>

19:15:45

en... enjoy it! 😅

<@mikelolasagasti:matrix.org>

19:16:27

would you like to continue with th eother ones? like #51 ?

<@alexsaezm:fedora.im>

19:16:54

sure

<@alexsaezm:fedora.im>

19:17:14

!topic Recurring security updates - go-sig#51

<@alexsaezm:fedora.im>

19:17:20

!link https://pagure.io/GoSIG/go-sig/issue/51

<@alexsaezm:fedora.im>

19:17:31

3 years old, yay

<@alexsaezm:fedora.im>

19:17:53

we now have the tools to perform it better with mass prebuild, so I could automate this

<@alexsaezm:fedora.im>

19:18:03

at least for testing

<@alexsaezm:fedora.im>

19:18:26

for the idea is for updating the package that was use to build the other packages in the repository

<@alexsaezm:fedora.im>

19:19:12

We have scripts for doing this but I can't run them because I'm not a proven packager so or someone else does this or we ask fesco about it

<@mikelolasagasti:matrix.org>

19:19:15

do always Go minors fix CVEs? I guess mainly yes

<@alexsaezm:fedora.im>

19:19:24

yes, mainly yes

<@alexsaezm:fedora.im>

19:19:39

sometimes it's not a CVE but most of the cases are security updates

<@mikelolasagasti:matrix.org>

19:19:49

but maybe some packages are not affected by the fixed module (a CVE in net/http not affecting binaries that don't require net/http)

<@mikelolasagasti:matrix.org>

19:20:02

is the tooling you mention able to fitler that out?

<@alexsaezm:fedora.im>

19:20:10

<@alexsaezm:fedora.im>

19:20:16

AFAIK no, it's brute force 😄

<@alexsaezm:fedora.im>

19:20:42

which doesn't hurt that much given the fact that now we have less packages thanks to the vendoring

<@alexsaezm:fedora.im>

19:21:06

and it doesn't hurt also to rebuild everything with the same version to avoid potential issues

<@mikelolasagasti:matrix.org>

19:21:41

ok. Could you try it with the next minor?

<@mikelolasagasti:matrix.org>

19:21:57

or being a "mini mass-rebuild" we would need to ask for permission ?

<@mikelolasagasti:matrix.org>

19:22:15

I guess you can do it in copr to test, but in case we want to perform in current branches we need to ask for approval?

<@alexsaezm:fedora.im>

19:22:30

I think so, or at least, make FESCo aware of this idea

<@alexsaezm:fedora.im>

19:23:10

I think it should be automated, but not sure how

<@alexsaezm:fedora.im>

19:24:13

!action reach out fesco to ask about performing mass rebuilds for security reasons on an schedule

<@gotmax:matrix.org>

19:25:58

I don't think we need permission to do rebuilds per se

<@gotmax:matrix.org>

19:26:47

The issue is just that it's very disruptive to have to make rebuild bump commits to every package, especially on stable branches that may or may not diverge from rawhide

<@gotmax:matrix.org>

19:27:27

Neal was working on making this easier to do (i.e., not require bump commits) but not sure about the status of that

<@alexsaezm:fedora.im>

19:27:28

I think that was the reason why we though about a middle life rebuild

<@conan_kudo:matrix.org>

19:27:49

Getting to it hopefully soon

<@mikelolasagasti:matrix.org>

19:28:14

how do we get rebuilds without bump commits? 🤔

<@conan_kudo:matrix.org>

19:28:38

!hi

<@zodbot:fedora.im>

19:28:39

Neal Gompa (ngompa) - he / him / his

<@conan_kudo:matrix.org>

19:29:08

Basically the build system keeps track of the number of times a commit is built and sets a per-package build macro value

<@conan_kudo:matrix.org>

19:29:27

similar in principle to what rpmautospec was originally envisioned to support

<@conan_kudo:matrix.org>

19:29:41

Basically the build system keeps track of the number of times a commit is built and sets a per-package build macro value to `%buildrelease` for it

<@conan_kudo:matrix.org>

19:30:04

Basically the build system keeps track of the number of times a commit or base NVR is built and sets a per-package build macro value to `%buildrelease` for it

<@mikelolasagasti:matrix.org>

19:30:36

nice

<@gotmax:matrix.org>

19:30:52

I'd say we table this issue until that's done

<@gotmax:matrix.org>

19:31:20

It's just not practical to do rebuilds on stable branches on a regular basis without a better solution

<@gotmax:matrix.org>

19:31:59

If there was some really serious security bug that impacted every go package, we could do a one off mass rebuild on stable branches

<@gotmax:matrix.org>

19:32:08

But otherwise...

<@conan_kudo:matrix.org>

19:32:45

we still need auto reverse dep rebuilds

<@conan_kudo:matrix.org>

19:33:04

this is just a stepping stone for that

<@mikelolasagasti:matrix.org>

19:34:47

I guess then we need to check the importance of each update

<@alexsaezm:fedora.im>

19:35:50

We can use the score if you want

<@alexsaezm:fedora.im>

19:36:08

for a simple metric

<@alexsaezm:fedora.im>

19:36:13

but in general I read the reports

<@mikelolasagasti:matrix.org>

19:36:22

fine for me

<@alexsaezm:fedora.im>

19:36:48

sometimes the score means not that much from the perspective of a package

<@alexsaezm:fedora.im>

19:37:28

well, in any case, until we have a better solution, I will keep an eye in case the minor release requires a rebuild (because it's critical)

<@gotmax:matrix.org>

19:38:40

I also requested that prodsec stop filing bugs against every single Go package for every single CVE

<@gotmax:matrix.org>

19:38:53

And just file it once against the golang package

<@zodbot:fedora.im>

19:39:09

mikelo2 has already given cookies to gotmax23 during the F43 timeframe

<@gotmax:matrix.org>

19:39:28

There's a larger discussion about the CVE bugs happening in https://pagure.io/fesco/issue/3512

<@mikelolasagasti:matrix.org>

19:40:02

indeed, I've been following it... not an easy one

<@gotmax:matrix.org>

19:40:07

So hopefully we can cut down the number of unactionable bugs we get

<@gotmax:matrix.org>

19:40:17

Yep...

<@mikelolasagasti:matrix.org>

19:41:08

I guess also that alexsaezm as RH employee could help with prodsec if required

<@mikelolasagasti:matrix.org>

19:41:20

and me, but he is better positionated 😅

<@alexsaezm:fedora.im>

19:42:14

I basically send them emails from time to time to fill up the bug trackers when something happen, and pretty much that's it, but yeah I can reach them out.

<@alexsaezm:fedora.im>

19:42:20

I basically send them emails from time to time to fill up the bug trackers when something happens, and pretty much that's it, but yeah I can reach them out.

<@alexsaezm:fedora.im>

19:43:03

Sounds like I'm the CTO or something 😄

<@alexsaezm:fedora.im>

19:43:59

jokes aside, yes, I can reach them out

<@mikelolasagasti:matrix.org>

19:44:24

I'm closer to him in the chain than you 😆

<@alexsaezm:fedora.im>

19:44:34

my point 😄

<@mikelolasagasti:matrix.org>

19:44:42

(just checked... but doesn't mean anything)

<@mikelolasagasti:matrix.org>

19:46:37

ok, so gotmax23 let us know if we can help

<@mikelolasagasti:matrix.org>

19:46:48

and I think we can move to next topic

<@alexsaezm:fedora.im>

19:47:24

!topic go-sig new membership policy - go-sig#60

<@alexsaezm:fedora.im>

19:47:29

!link https://pagure.io/GoSIG/go-sig/issue/60

<@alexsaezm:fedora.im>

19:48:09

Any takes?

<@mikelolasagasti:matrix.org>

19:50:35

I think what's written makes sense

<@alexsaezm:fedora.im>

19:51:28

I guess we should vote on it and add it to some place?

<@mikelolasagasti:matrix.org>

19:52:12

can we ask in the Golang room and give two weeks until next meeting? based on the votes we can add it to the Go-SIG wiki

<@alexsaezm:fedora.im>

19:52:24

Sure

<@alexsaezm:fedora.im>

19:52:58

!action notify in the Fedora Golang room about https://pagure.io/GoSIG/go-sig/issue/60 and request a vote

<@alexsaezm:fedora.im>

19:53:45

!topic #64 Create GoSIG organization within the new forge

<@alexsaezm:fedora.im>

19:53:51

!link https://pagure.io/GoSIG/go-sig/issue/64

<@alexsaezm:fedora.im>

19:53:57

Last but not least...

<@alexsaezm:fedora.im>

19:54:19

I recall we talked about this at some point but I'm not sure where we left it

<@alexsaezm:fedora.im>

19:55:08

I don't see an organization, so it's still open to discussion

<@alexsaezm:fedora.im>

19:55:16

!link https://forge.fedoraproject.org/explore/organizations?q=Go

<@gotmax:matrix.org>

19:56:01

We'll need to move the tracker that's on Pagure eventually

<@gotmax:matrix.org>

19:56:29

I'd also like to move our Gitlab projects, but that's blocked on Packit support for Fedora Forge

<@alexsaezm:fedora.im>

19:56:50

It would be cool to have everything on one place for sure

<@gotmax:matrix.org>

19:56:53

And also Gitlab calls issues work items now which is... weird

<@gotmax:matrix.org>

19:57:06

Yeah, that's the thinking

<@alexsaezm:fedora.im>

19:57:25

well I guess we can say we want the sig group

<@alexsaezm:fedora.im>

19:57:32

at least as a first step

<@gotmax:matrix.org>

19:57:54

I can file the issue to create the group at least

<@gotmax:matrix.org>

19:58:01

Can you !action me?

<@alexsaezm:fedora.im>

19:58:10

of course

<@alexsaezm:fedora.im>

19:58:51

!action gotmax23 fill request to create Go SIG organization within the new forge

<@alexsaezm:fedora.im>

19:59:05

thanks

<@alexsaezm:fedora.im>

19:59:25

and with that... we are done with the list of open issues

<@alexsaezm:fedora.im>

19:59:44

right on time for the hour!

<@alexsaezm:fedora.im>

20:00:00

anyone has anything to talk about in the open floor or want to call it?

<@gotmax:matrix.org>

20:00:46

!info Migration from Gitlab to Fedora Forge is blocked on Packit support (https://github.com/packit/packit-service/issues/2855)

<@gotmax:matrix.org>

20:01:54

!info We need to move the SIG tracker that's currently in Pagure to Fedora Forge before Pagure is shutdown

<@gotmax:matrix.org>

20:02:18

For open floor:

<@alexsaezm:fedora.im>

20:02:33

!topic open floor (again)

<@gotmax:matrix.org>

20:02:58

I just wanted to encourage people to orphan FTI or FTBFS old golang-* packages if they're not planning to fix them

<@gotmax:matrix.org>

20:03:20

Then they will get automatically retired more quickly

<@alexsaezm:fedora.im>

20:04:23

that reminds me I need to double check mines

<@alexsaezm:fedora.im>

20:04:38

I'm pretty sure I have an "interesting" list of them

<@mikelolasagasti:matrix.org>

20:05:39

I've been orphaning leave packages as they become leaves

<@mikelolasagasti:matrix.org>

20:06:42

but yeah, makes sense to orphan those in FTI/FTBFS

<@mikelolasagasti:matrix.org>

20:08:09

not sure what happened yesterday, but many packages that were reporting missing dependencies are OK now https://gitlab.com/fedora/sigs/go/package-data/-/commit/800600dfb700acb7dd643b7b48668dbbf2c424be

<@conan_kudo:matrix.org>

20:11:06

I wound up orphaning a couple recently, I think

<@mikelolasagasti:matrix.org>

20:13:55

Neal Gompa (Fedora): could https://src.fedoraproject.org/rpms/golang-github-allan-simon-singleinstance and https://src.fedoraproject.org/rpms/golang-github-joshuarubin-sway be orphaned also? they're reported as leaves so shoould be safe, but rather ask

<@gotmax:matrix.org>

20:14:36

If you're sure something is a leaf and are the main admin, retiring the package yourself should also be fine

<@mikelolasagasti:matrix.org>

20:15:41

yes, that's what i've been doing, but as neal appears as co-maintainer and he has been working on sway, just want to make extra sure

<@gotmax:matrix.org>

20:17:24

I'd also like to explore ways to more quickly orphan the existing FTBFS packages

<@gotmax:matrix.org>

20:17:48

Currently, there are 421 open F44 FTBFS bugs for golang packages

<@mikelolasagasti:matrix.org>

20:18:15

non-binary ones?

<@gotmax:matrix.org>

20:18:45

I didn't do that filtering yet, but 400 of those are for packages that start with golang-

<@conan_kudo:matrix.org>

20:19:22

mikel: feel free

<@gotmax:matrix.org>

20:20:14

275 of them only contain source code -devel packages

<@gotmax:matrix.org>

20:20:30

Not sure how many of those will be retired as part of the upcoming long-term FTBFS

<@gotmax:matrix.org>

20:21:00

I thought that was supposed to happen last week but not sure if it did

<@gotmax:matrix.org>

20:21:06

Not sure how many of those will be retired as part of the upcoming long-term FTBFS retirement

<@mikelolasagasti:matrix.org>

20:21:12

I think we can close the call and move the conversation to the group?

<@mikelolasagasti:matrix.org>

20:21:51

I think most of them were orphaned, but not retired

<@mikelolasagasti:matrix.org>

20:21:53

could it be?

<@gotmax:matrix.org>

20:22:26

Yeah, we can close the meeting for now

<@gotmax:matrix.org>

20:22:37

And move further discussion to #golang:fedoraproject.org or the lsit

<@gotmax:matrix.org>

20:22:40

*list

<@alexsaezm:fedora.im>

20:22:50

Sure

<@alexsaezm:fedora.im>

20:22:59

Thanks everyone for joining! See you next time!

<@alexsaezm:fedora.im>

20:23:07

!endmeeting