2026-03-09 19:00:06 <@alexsaezm:fedora.im> !startmeeting Go SIG meeting
2026-03-09 19:00:07 <@meetbot:fedora.im> Meeting started at 2026-03-09 19:00:06 UTC
2026-03-09 19:00:08 <@meetbot:fedora.im> The Meeting name is 'Go SIG meeting'
2026-03-09 19:00:10 <@alexsaezm:fedora.im> !topic Roll Call
2026-03-09 19:00:15 <@alexsaezm:fedora.im> Hi everyone! As always we'll wait ~5 minutes for everyone to join.
2026-03-09 19:00:38 <@alexsaezm:fedora.im> I hope we are not messing the schedule due to the DST changes 😄
2026-03-09 19:03:19 <@mikelolasagasti:matrix.org> !hi
2026-03-09 19:03:21 <@zodbot:fedora.im> Mikel Olasagasti Uranga (mikelo2)
2026-03-09 19:03:44 <@buckaroogeek:fedora.im> !hi
2026-03-09 19:03:48 <@zodbot:fedora.im> Brad Smith (buckaroogeek)
2026-03-09 19:04:08 <@alexsaezm:fedora.im> o/
2026-03-09 19:06:28 <@alexsaezm:fedora.im> Well, I think we can start. I don't see anything new in the tracker so we can move to the open floor
2026-03-09 19:06:35 <@alexsaezm:fedora.im> !topic Open Floor
2026-03-09 19:07:11 <@alexsaezm:fedora.im> PSA: Fedora 42 is now following 1.25 as Fedora 43. And Fedora 44 and Rawhide already have 1.26.
2026-03-09 19:07:14 <@mikelolasagasti:matrix.org> mm,m there are topics we can discuss I think
2026-03-09 19:07:23 <@alexsaezm:fedora.im> oh from the tracker?
2026-03-09 19:07:37 <@mikelolasagasti:matrix.org> https://pagure.io/GoSIG/go-sig/issue/61 for example I understand can be considered complete 
2026-03-09 19:08:14 <@mikelolasagasti:matrix.org> gotmax23: what do you think about closing that one?
2026-03-09 19:09:42 <@mikelolasagasti:matrix.org> mmm, let me start over
2026-03-09 19:09:59 <@mikelolasagasti:matrix.org> !topic Adopt go-vendor-tools and switch to vendoring by default - go-sig#61
2026-03-09 19:11:22 <@mikelolasagasti:matrix.org> the change to make vendoring itself was approved by FESCo 8 months ago and gotmax23 worked in the documentation changes. I know he plans to release go2rpm 2.0 making the vendoring the default option... and there might be something else, but I guess it can be closed.
2026-03-09 19:11:56 <@mikelolasagasti:matrix.org> as he is not here, I can take the action to ask him if he is OK to close it or document what's missing
2026-03-09 19:11:58 <@mikelolasagasti:matrix.org> ok?
2026-03-09 19:12:37 <@alexsaezm:fedora.im> By the description, I think it's done. Mostly because it's adopted and everyone is switching so fine by me. But yeah we should wait for gotmax
2026-03-09 19:14:06 <@mikelolasagasti:matrix.org> oh, look :D
2026-03-09 19:14:13 <@gotmax:matrix.org> /me is afk at the dentist
2026-03-09 19:14:38 <@alexsaezm:fedora.im> lol, I think that has higher priority 😄
2026-03-09 19:14:45 <@alexsaezm:fedora.im> we can wait 😄
2026-03-09 19:15:31 <@alexsaezm:fedora.im> we should move to another topic and close that later when we can, it's been there for months, not gonna hurt
2026-03-09 19:15:45 <@mikelolasagasti:matrix.org> en... enjoy it! 😅
2026-03-09 19:16:27 <@mikelolasagasti:matrix.org> would you like to continue with th eother ones? like #51 ?
2026-03-09 19:16:54 <@alexsaezm:fedora.im> sure
2026-03-09 19:17:14 <@alexsaezm:fedora.im> !topic  Recurring security updates  - go-sig#51
2026-03-09 19:17:20 <@alexsaezm:fedora.im> !link https://pagure.io/GoSIG/go-sig/issue/51
2026-03-09 19:17:31 <@alexsaezm:fedora.im> 3 years old, yay
2026-03-09 19:17:53 <@alexsaezm:fedora.im> we now have the tools to perform it better with mass prebuild, so I could automate this
2026-03-09 19:18:03 <@alexsaezm:fedora.im> at least for testing
2026-03-09 19:18:26 <@alexsaezm:fedora.im> for the idea is for updating the package that was use to build the other packages in the repository
2026-03-09 19:19:12 <@alexsaezm:fedora.im> We have scripts for doing this but I can't run them because I'm not a proven packager so or someone else does this or we ask fesco about it
2026-03-09 19:19:15 <@mikelolasagasti:matrix.org> do always Go minors fix CVEs? I guess mainly yes
2026-03-09 19:19:24 <@alexsaezm:fedora.im> yes, mainly yes
2026-03-09 19:19:39 <@alexsaezm:fedora.im> sometimes it's not a CVE but most of the cases are security updates
2026-03-09 19:19:49 <@mikelolasagasti:matrix.org> but maybe some packages are not affected by the fixed module (a CVE in net/http not affecting binaries that don't require net/http)
2026-03-09 19:20:02 <@mikelolasagasti:matrix.org> is the tooling you mention able to fitler that out?
2026-03-09 19:20:10 <@alexsaezm:fedora.im> no
2026-03-09 19:20:16 <@alexsaezm:fedora.im> AFAIK no, it's brute force 😄
2026-03-09 19:20:42 <@alexsaezm:fedora.im> which doesn't hurt that much given the fact that now we have less packages thanks to the vendoring
2026-03-09 19:21:06 <@alexsaezm:fedora.im> and it doesn't hurt also to rebuild everything with the same version to avoid potential issues
2026-03-09 19:21:41 <@mikelolasagasti:matrix.org> ok. Could you try it with the next minor?
2026-03-09 19:21:57 <@mikelolasagasti:matrix.org> or being a "mini mass-rebuild" we would need to ask for permission ?
2026-03-09 19:22:15 <@mikelolasagasti:matrix.org> I guess you can do it in copr to test, but in case we want to perform in current branches we need to ask for approval?
2026-03-09 19:22:30 <@alexsaezm:fedora.im> I think so, or at least, make FESCo aware of this idea
2026-03-09 19:23:10 <@alexsaezm:fedora.im> I think it should be automated, but not sure how
2026-03-09 19:24:13 <@alexsaezm:fedora.im> !action reach out fesco to ask about performing mass rebuilds for security reasons on an schedule
2026-03-09 19:25:58 <@gotmax:matrix.org> I don't think we need permission to do rebuilds per se
2026-03-09 19:26:47 <@gotmax:matrix.org> The issue is just that it's very disruptive to have to make rebuild bump commits to every package, especially on stable branches that may or may not diverge from rawhide
2026-03-09 19:27:27 <@gotmax:matrix.org> Neal was working on making this easier to do (i.e., not require bump commits) but not sure about the status of that
2026-03-09 19:27:28 <@alexsaezm:fedora.im> I think that was the reason why we though about a middle life rebuild
2026-03-09 19:27:49 <@conan_kudo:matrix.org> Getting to it hopefully soon
2026-03-09 19:28:14 <@mikelolasagasti:matrix.org> how do we get rebuilds without bump commits? 🤔
2026-03-09 19:28:38 <@conan_kudo:matrix.org> !hi
2026-03-09 19:28:39 <@zodbot:fedora.im> Neal Gompa (ngompa) - he / him / his
2026-03-09 19:29:08 <@conan_kudo:matrix.org> Basically the build system keeps track of the number of times a commit is built and sets a per-package build macro value
2026-03-09 19:29:27 <@conan_kudo:matrix.org> similar in principle to what rpmautospec was originally envisioned to support
2026-03-09 19:29:41 <@conan_kudo:matrix.org> Basically the build system keeps track of the number of times a commit is built and sets a per-package build macro value to `%buildrelease` for it
2026-03-09 19:30:04 <@conan_kudo:matrix.org> Basically the build system keeps track of the number of times a commit or base NVR is built and sets a per-package build macro value to `%buildrelease` for it
2026-03-09 19:30:36 <@mikelolasagasti:matrix.org> nice
2026-03-09 19:30:52 <@gotmax:matrix.org> I'd say we table this issue until that's done
2026-03-09 19:31:20 <@gotmax:matrix.org> It's just not practical to do rebuilds on stable branches on a regular basis without a better solution
2026-03-09 19:31:59 <@gotmax:matrix.org> If there was some really serious security bug that impacted every go package, we could do a one off mass rebuild on stable branches
2026-03-09 19:32:08 <@gotmax:matrix.org> But otherwise...
2026-03-09 19:32:45 <@conan_kudo:matrix.org> we still need auto reverse dep rebuilds
2026-03-09 19:33:04 <@conan_kudo:matrix.org> this is just a stepping stone for that
2026-03-09 19:34:47 <@mikelolasagasti:matrix.org> I guess then we need to check the importance of each update
2026-03-09 19:35:50 <@alexsaezm:fedora.im> We can use the score if you want
2026-03-09 19:36:08 <@alexsaezm:fedora.im> for a simple metric
2026-03-09 19:36:13 <@alexsaezm:fedora.im> but in general I read the reports
2026-03-09 19:36:22 <@mikelolasagasti:matrix.org> fine for me
2026-03-09 19:36:48 <@alexsaezm:fedora.im> sometimes the score means not that much from the perspective of a package
2026-03-09 19:37:28 <@alexsaezm:fedora.im> well, in any case, until we have a better solution, I will keep an eye in case the minor release requires a rebuild (because it's critical)
2026-03-09 19:38:40 <@gotmax:matrix.org> I also requested that prodsec stop filing bugs against every single Go package for every single CVE
2026-03-09 19:38:53 <@gotmax:matrix.org> And just file it once against the golang package
2026-03-09 19:39:09 <@zodbot:fedora.im> mikelo2 has already given cookies to gotmax23 during the F43 timeframe
2026-03-09 19:39:28 <@gotmax:matrix.org> There's a larger discussion about the CVE bugs happening in https://pagure.io/fesco/issue/3512
2026-03-09 19:40:02 <@mikelolasagasti:matrix.org> indeed, I've been following it... not an easy one 
2026-03-09 19:40:07 <@gotmax:matrix.org> So hopefully we can cut down the number of unactionable bugs we get
2026-03-09 19:40:17 <@gotmax:matrix.org> Yep...
2026-03-09 19:41:08 <@mikelolasagasti:matrix.org> I guess also that alexsaezm as RH employee could help with prodsec if required
2026-03-09 19:41:20 <@mikelolasagasti:matrix.org> and me, but he is better positionated 😅
2026-03-09 19:42:14 <@alexsaezm:fedora.im> I basically send them emails from time to time to fill up the bug trackers when something happen, and pretty much that's it, but yeah I can reach them out.
2026-03-09 19:42:20 <@alexsaezm:fedora.im> I basically send them emails from time to time to fill up the bug trackers when something happens, and pretty much that's it, but yeah I can reach them out.
2026-03-09 19:43:03 <@alexsaezm:fedora.im> Sounds like I'm the CTO or something 😄
2026-03-09 19:43:59 <@alexsaezm:fedora.im> jokes aside, yes, I can reach them out
2026-03-09 19:44:24 <@mikelolasagasti:matrix.org> I'm closer to him in the chain than you 😆
2026-03-09 19:44:34 <@alexsaezm:fedora.im> my point 😄
2026-03-09 19:44:42 <@mikelolasagasti:matrix.org> (just checked... but doesn't mean anything)
2026-03-09 19:46:37 <@mikelolasagasti:matrix.org> ok, so gotmax23 let us know if we can help
2026-03-09 19:46:48 <@mikelolasagasti:matrix.org> and I think we can move to next topic
2026-03-09 19:47:24 <@alexsaezm:fedora.im> !topic  go-sig new membership policy - go-sig#60
2026-03-09 19:47:29 <@alexsaezm:fedora.im> !link https://pagure.io/GoSIG/go-sig/issue/60
2026-03-09 19:48:09 <@alexsaezm:fedora.im> Any takes?
2026-03-09 19:50:35 <@mikelolasagasti:matrix.org> I think what's written makes sense
2026-03-09 19:51:28 <@alexsaezm:fedora.im> I guess we should vote on it and add it to some place?
2026-03-09 19:52:12 <@mikelolasagasti:matrix.org> can we ask in the Golang room and give two weeks until next meeting? based on the votes we can add it to the Go-SIG wiki 
2026-03-09 19:52:24 <@alexsaezm:fedora.im> Sure
2026-03-09 19:52:58 <@alexsaezm:fedora.im> !action notify in the Fedora Golang room about https://pagure.io/GoSIG/go-sig/issue/60 and request a vote
2026-03-09 19:53:45 <@alexsaezm:fedora.im> !topic  #64 Create GoSIG organization within the new forge 
2026-03-09 19:53:51 <@alexsaezm:fedora.im> !link https://pagure.io/GoSIG/go-sig/issue/64
2026-03-09 19:53:57 <@alexsaezm:fedora.im> Last but not least...
2026-03-09 19:54:19 <@alexsaezm:fedora.im> I recall we talked about this at some point but I'm not sure where we left it
2026-03-09 19:55:08 <@alexsaezm:fedora.im> I don't see an organization, so it's still open to discussion
2026-03-09 19:55:16 <@alexsaezm:fedora.im> !link https://forge.fedoraproject.org/explore/organizations?q=Go
2026-03-09 19:56:01 <@gotmax:matrix.org> We'll need to move the tracker that's on Pagure eventually
2026-03-09 19:56:29 <@gotmax:matrix.org> I'd also like to move our Gitlab projects, but that's blocked on Packit support for Fedora Forge
2026-03-09 19:56:50 <@alexsaezm:fedora.im> It would be cool to have everything on one place for sure
2026-03-09 19:56:53 <@gotmax:matrix.org> And also Gitlab calls issues work items now which is... weird
2026-03-09 19:57:06 <@gotmax:matrix.org> Yeah, that's the thinking
2026-03-09 19:57:25 <@alexsaezm:fedora.im> well I guess we can say we want the sig group
2026-03-09 19:57:32 <@alexsaezm:fedora.im> at least as a first step
2026-03-09 19:57:54 <@gotmax:matrix.org> I can file the issue to create the group at least
2026-03-09 19:58:01 <@gotmax:matrix.org> Can you !action me?
2026-03-09 19:58:10 <@alexsaezm:fedora.im> of course
2026-03-09 19:58:51 <@alexsaezm:fedora.im> !action gotmax23 fill request to create Go SIG organization within the new forge
2026-03-09 19:59:05 <@alexsaezm:fedora.im> thanks
2026-03-09 19:59:25 <@alexsaezm:fedora.im> and with that... we are done with the list of open issues
2026-03-09 19:59:44 <@alexsaezm:fedora.im> right on time for the hour!
2026-03-09 20:00:00 <@alexsaezm:fedora.im> anyone has anything to talk about in the open floor or want to call it?
2026-03-09 20:00:46 <@gotmax:matrix.org> !info Migration from Gitlab to Fedora Forge is blocked on Packit support (https://github.com/packit/packit-service/issues/2855)
2026-03-09 20:01:54 <@gotmax:matrix.org> !info We need to move the SIG tracker that's currently in Pagure to Fedora Forge before Pagure is shutdown
2026-03-09 20:02:18 <@gotmax:matrix.org> For open floor:
2026-03-09 20:02:33 <@alexsaezm:fedora.im> !topic open floor (again)
2026-03-09 20:02:58 <@gotmax:matrix.org> I just wanted to encourage people to orphan FTI or FTBFS old golang-* packages if they're not planning to fix them
2026-03-09 20:03:20 <@gotmax:matrix.org> Then they will get automatically retired more quickly
2026-03-09 20:04:23 <@alexsaezm:fedora.im> that reminds me I need to double check mines
2026-03-09 20:04:38 <@alexsaezm:fedora.im> I'm pretty sure I have an "interesting" list of them
2026-03-09 20:05:39 <@mikelolasagasti:matrix.org> I've been orphaning leave packages as they become leaves
2026-03-09 20:06:42 <@mikelolasagasti:matrix.org> but yeah, makes sense to orphan those in FTI/FTBFS
2026-03-09 20:08:09 <@mikelolasagasti:matrix.org> not sure what happened yesterday, but many packages that were reporting missing dependencies are OK now https://gitlab.com/fedora/sigs/go/package-data/-/commit/800600dfb700acb7dd643b7b48668dbbf2c424be
2026-03-09 20:11:06 <@conan_kudo:matrix.org> I wound up orphaning a couple recently, I think
2026-03-09 20:13:55 <@mikelolasagasti:matrix.org> Neal Gompa (Fedora): could https://src.fedoraproject.org/rpms/golang-github-allan-simon-singleinstance and https://src.fedoraproject.org/rpms/golang-github-joshuarubin-sway be orphaned also? they're reported as leaves so shoould be safe, but rather ask
2026-03-09 20:14:36 <@gotmax:matrix.org> If you're sure something is a leaf and are the main admin, retiring the package yourself should also be fine
2026-03-09 20:15:41 <@mikelolasagasti:matrix.org> yes, that's what i've been doing, but as neal appears as co-maintainer and he has been working on sway, just want to make extra sure
2026-03-09 20:17:24 <@gotmax:matrix.org> I'd also like to explore ways to more quickly orphan the existing FTBFS packages
2026-03-09 20:17:48 <@gotmax:matrix.org> Currently, there are 421 open F44 FTBFS bugs for golang packages
2026-03-09 20:18:15 <@mikelolasagasti:matrix.org> non-binary ones?
2026-03-09 20:18:45 <@gotmax:matrix.org> I didn't do that filtering yet, but 400 of those are for packages that start with golang-
2026-03-09 20:19:22 <@conan_kudo:matrix.org> mikel: feel free
2026-03-09 20:20:14 <@gotmax:matrix.org> 275 of them only contain source code -devel packages
2026-03-09 20:20:30 <@gotmax:matrix.org> Not sure how many of those will be retired as part of the upcoming long-term FTBFS
2026-03-09 20:21:00 <@gotmax:matrix.org> I thought that was supposed to happen last week but not sure if it did
2026-03-09 20:21:06 <@gotmax:matrix.org> Not sure how many of those will be retired as part of the upcoming long-term FTBFS retirement
2026-03-09 20:21:12 <@mikelolasagasti:matrix.org> I think we can close the call and move the conversation to the group?
2026-03-09 20:21:51 <@mikelolasagasti:matrix.org> I think most of them were orphaned, but not retired
2026-03-09 20:21:53 <@mikelolasagasti:matrix.org> could it be?
2026-03-09 20:22:26 <@gotmax:matrix.org> Yeah, we can close the meeting for now
2026-03-09 20:22:37 <@gotmax:matrix.org> And move further discussion to #golang:fedoraproject.org or the lsit
2026-03-09 20:22:40 <@gotmax:matrix.org> *list
2026-03-09 20:22:50 <@alexsaezm:fedora.im> Sure
2026-03-09 20:22:59 <@alexsaezm:fedora.im> Thanks everyone for joining! See you next time!
2026-03-09 20:23:07 <@alexsaezm:fedora.im> !endmeeting