21:00:24 <tdawson> #startmeeting EPEL (2022-02-23)
21:00:24 <zodbot> Meeting started Wed Feb 23 21:00:24 2022 UTC.
21:00:24 <zodbot> This meeting is logged and archived in a public location.
21:00:24 <zodbot> The chair is tdawson. Information about MeetBot at https://fedoraproject.org/wiki/Zodbot#Meeting_Functions.
21:00:24 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic.
21:00:24 <zodbot> The meeting name has been set to 'epel_(2022-02-23)'
21:00:24 <tdawson> #meetingname epel
21:00:24 <tdawson> #chair nirik tdawson pgreco carlwgeorge salimma dcavalca
21:00:24 <tdawson> #topic aloha
21:00:24 <zodbot> The meeting name has been set to 'epel'
21:00:24 <zodbot> Current chairs: carlwgeorge dcavalca nirik pgreco salimma tdawson
21:00:33 <pgreco> .hi
21:00:34 <zodbot> pgreco: pgreco 'Pablo Sebastian Greco' <pablo@fliagreco.com.ar>
21:00:48 <dcavalca> .hi
21:00:48 <zodbot> dcavalca: dcavalca 'Davide Cavalca' <dcavalca@fb.com>
21:00:51 <tdawson> Hi pgreco
21:00:53 <carlwgeorge> .hi
21:00:55 <zodbot> carlwgeorge: carlwgeorge 'Carl George' <carl@redhat.com>
21:00:58 <tdawson> Hi dcavalca
21:01:01 <salimma> .hello
21:01:01 <zodbot> salimma: (hello <an alias, 1 argument>) -- Alias for "hellomynameis $1".
21:01:03 <tdawson> Hi carlwgeorge
21:01:05 <salimma> .hi
21:01:06 <zodbot> salimma: salimma 'Michel Alexandre Salim' <michel@michel-slm.name>
21:01:09 <tdawson> Hi salimma
21:01:11 <rsc> .hello robert
21:01:12 <zodbot> rsc: robert 'Robert Scheck' <redhat@linuxnetz.de>
21:01:24 <dherrera> .hi
21:01:25 <zodbot> dherrera: dherrera 'None' <dherrera@redhat.com>
21:01:26 <tdawson> Hi rsc
21:01:32 <tdawson> Hi dherrera
21:02:12 <Ebeneezer_Smooge> hllo
21:02:32 <tdawson> Hi Ebeneezer_Smooge
21:02:34 <nirik> morning
21:03:12 <tdawson> Morning nirik
21:04:46 <Ebeneezer_Smooge> so we are all wondering why you called us here together.. and why there is a knife sticking in the back of carlwgeorge
21:05:13 <tdawson> *laughs*
21:05:24 <tdawson> #topic EPEL Issues
21:05:24 <tdawson> https://pagure.io/epel/issues
21:05:24 <tdawson> https://pagure.io/epel/issues?tags=meeting&status=Open
21:06:04 <tdawson> I think carlwgeorge is tough enough to handle a knife or two in his back.
21:06:19 <tdawson> but lets start with what hopefully will be the shorter issue
21:06:23 <tdawson> .epel152
21:06:35 * carlwgeorge chuckles
21:06:52 <tdawson> https://pagure.io/epel/issue/152
21:07:15 <tdawson> last week this was able to be successfully tested.
21:07:34 <nirik> cool.
21:07:39 <tdawson> imagemagick built on all arches using the libRaw-epel build that was only for some arches
21:08:01 <nirik> so imagemagick on x86_64 installs the libraw from stream right?
21:08:51 <tdawson> nirik correct
21:09:09 <pgreco> builds from -epel, installs from the original one
21:09:18 <nirik> great. Glad it all works. I hope we don't cause too much work for rhel/stream maintainers. ;)
21:10:05 <tdawson> Getting imagemagick in epel9 unblocked two of my packages.  I was happy for that.
21:10:16 <salimma> if/when they want to ungate the devel packages I'm sure we're happy to retire libRaw-epel :)
21:10:28 <nirik> pgreco: it doesn't even build from epel one on x86_64
21:10:30 <Ebeneezer_Smooge> now I just need to work on getting pandoc in <cries>
21:11:00 <tdawson> Oh ... pandoc is the legend of nightmares ...
21:11:00 <pgreco> nirik, right, on the specific arches only
21:11:14 <salimma> Ebeneezer_Smooge: you're my hero if you do that, several packages now have docs disabled because of missing pandoc
21:11:31 <Ebeneezer_Smooge> yeah.. most of the packages I have for auto require it
21:11:37 * nirik waves Ebeneezer_Smooge on from a safe distance. :)
21:11:53 <Ebeneezer_Smooge> that said.. I am probably going to just say 'yeah sorry'
21:12:27 <tdawson> So, to finish up the arch ticket, I'll leave the missing arch parts in the documentation.
21:12:29 <Ebeneezer_Smooge> like getting fedpkg in.. it looks like it might as well be its own repo
21:12:50 <tdawson> Wait ... what I just said came out wrong.  In the new draft, I will have the missing arch parts in.
21:14:19 <tdawson> Anyway ... let's move on to the other issue
21:14:35 <tdawson> .epel 159
21:14:36 <zodbot> tdawson: Issue #159: Follow up on EPEL CVEs - epel - Pagure.io - https://pagure.io/epel/issue/159
21:15:03 <salimma> oh fun
21:15:29 <tdawson> salimma: You did some work on this, do you think we are at a point that we can discuss it properly?
21:15:31 <salimma> so yeah, last week I didn't have time to crunch the data, so it got delayed to today. The EPEL 7 state is indeed quite bad
21:16:08 <pgreco> wondering how many of the nodejs ones will be easier with the new nodejs16 there
21:16:22 <salimma> I think we can start discussing it now. the only missing data I've not computed is average bug age (p50, p90) per release
21:16:22 <salimma> Also, for the next time we do this (whether weekly or monthly) I want to start doing diffs to see if we make progress
21:16:55 <tdawson> Ya ... For nodejs, stephen just cut his losses and retired the old nodejs ... but it looks like he didn't close the CVE's.
21:17:31 <nirik> fedora isn't in super shape either. ;( Sadly there's a policy there thats not been implemented yet to retire things...
21:17:43 <salimma> any volunteer for helping to triage this? we can probably close many of these
21:17:59 <salimma> also on related note... do we know if the security team looks at epel*-next?
21:18:20 <carlwgeorge> i can take a stab at the syncthing one, via go sig membership
21:18:27 <salimma> nirik: on the Fedora side - will this be a releng or FPC thing?
21:18:56 <nirik> there was a policy, releng hasn't implemented it... let me find the ticket/issue
21:19:14 <tdawson> salimma: Would you be able to put your bugzilla search in the issue.  I'm curious how I would look up all the nodejs CVE bugs, as well as the chromium ones.
21:19:25 <nirik> https://pagure.io/releng/issue/7793
21:19:27 <salimma> tdawson: yes, one sec
21:19:47 <salimma> I'll put up the scripts too once they're ready, and the raw data JSON, but the query is simple enough. ugh, on my other laptop
21:20:03 <tdawson> I'm in the nodejs-sig, so I sorta feel obligated to help with those ones.
21:20:30 <Ebeneezer_Smooge> carlwgeorge, I would be interested in helping on this but I think we are going to need the equivalent of an activity day to focus efforts
21:20:44 * salimma sent a code block: https://libera.ems.host/_matrix/media/r0/download/libera.chat/e07796b304acbb3aec846199ab602963ca1f00f6
21:21:24 <tdawson> salimma: Cool, thanks.
21:22:15 <salimma> Ebeneezer_Smooge: activity day sounds good. double-plus-good if it involves a drinking game
21:23:03 <nirik> ha ha ha
21:23:14 <Ebeneezer_Smooge> From years of experience drinking games and CVE's tend to lead to bigger CVE's and bad headaches
21:23:22 <tdawson> *laughs*
21:23:54 <salimma> Ebeneezer_Smooge: nah, you just need to stop before your Ballmer peak :)
21:24:03 <tdawson> Part of me wants to send the list to the -devel list, but another part of me wants to wait until we've had a chance to go through things.
21:24:04 <salimma> agreed on the bad headaches though
21:25:09 <salimma> yeah, I wasn't sure if I should send it out yet. I'm hoping we have time to take a pass, and I'll also make my reporter generate a human-readable version of the report, and then we can report and say "yeah, things look bad, but it already improved quite a bit since we started looking!"
21:25:18 <Ebeneezer_Smooge> agreed.
21:25:24 <salimma> esp since... I don't want to know what Phoronix will say about this
21:25:43 <tdawson> Yep
21:25:45 <salimma> any idea on whether RH security takes a look at epel-next?
21:26:01 <salimma> in Bugzilla they're lumped together, so I'm not sure if that's already happening or not.
21:26:10 * nirik has no idea.
21:26:14 <tdawson> I have no idea
21:26:32 <tdawson> The good thing is that epel-next is fairly small.
21:26:40 <salimma> yeah
21:27:50 <nirik> seems like perhaps working on fedora and epel both could be a good thing...
21:28:03 <nirik> some things might need fixing in both, or the like
21:28:20 <nirik> but it's a big job I am sure.
21:28:25 <salimma> yeah, true. should I just change the script to also report on Fedora too?
21:28:30 <salimma> no reason it's EPEL only, after all
21:28:43 <salimma> probably report separately though
21:28:53 <tdawson> Ugg ... just looking at one of the nodejs bugs, all it has is the CVE, no extra information about even what version of nodejs it's against.
21:29:06 <salimma> on the Fedora side, I think more of the CVEs would actually just be mistriaged (maintainer upgrading without closing the bug, for instance)
21:29:33 <salimma> yeah, the CVE bugs are normally quite bad, for the ones assigned to me I normally look up the CVE on mitre
21:29:51 <salimma> the newer ones are quite good though. we just have a lot of super old bugs to clean up :(
21:31:07 <tdawson> Anything else on this?   Do people think bringing it up once a month is a good thing?  See how we do?
21:31:24 <Ebeneezer_Smooge> not from me. time to move on?
21:31:37 <tdawson> OK, old business
21:31:51 <tdawson> #topic Old Business
21:32:02 <salimma> yeah, once a month seems fine
21:32:13 <tdawson> pgreco: macros ... how are they coming?
21:32:26 <pgreco> I think I addressed Eighth_Doctor's comments today
21:32:38 <pgreco> waiting on re-review, progresss...
21:32:42 <tdawson> salimma: OK, I think I can do that.
21:32:50 <Eighth_Doctor> 👋
21:32:50 <tdawson> pgreco: awesome
21:33:46 <tdawson> That's getting close.
21:34:07 <Eighth_Doctor> pgreco: I left feedback that hasn't been addressed
21:34:12 <Eighth_Doctor> also left some new feedback just now
21:34:53 <pgreco> ack, I'll take a look
21:35:11 <tdawson> The only other old business I have is documentation ... I'm almost done with my second draft of the missing packages documentation.  I (hopefully) have gotten everyones comments addressed.
21:35:34 <tdawson> pgreco: Sorry, didn't mean to cut you off, anything else for the macros?
21:36:34 <tdawson> #topic EPEL-7
21:36:34 <tdawson> CentOS 7 will go EOL on 30 June, 2024
21:36:55 <pgreco> tdawson: no, that was it ;)
21:37:10 <tdawson> pgreco: Cool.  Thanks for your work on that.
21:37:22 <tdawson> Other than the CVE's, do we have anything for EPEL7 ?
21:38:12 <Ebeneezer_Smooge> not from me
21:38:14 <tdawson> #topic EPEL-8
21:38:43 <tdawson> I know that CVE's in epel8 came up the past couple of days, but I believe that package is now being addressed.
21:39:19 <tdawson> I'm also trying to get the epel8-playground repo cleared out.
21:39:42 <tdawson> I should have untagged everything before having the tags and targets removed ...
21:40:29 <nirik> do we really want to remove it entirely?
21:40:32 <tdawson> I've got a releng ticket open for that, but things would have been simpler if I did it in the other way around.
21:40:38 <nirik> shouldn't we archive it in case someone wants something from it?
21:40:44 <tdawson> nirik Well, I really just want an empty repo.
21:41:18 <tdawson> Yep, archiving would be good.
21:41:27 <nirik> I wonder how many people will show up and ask what happened...
21:41:28 <tdawson> right now it's sorta stuck in limbo.
21:41:36 <nirik> probibly not many
21:42:15 <Ebeneezer_Smooge> if they ask they get the same answer .. please subscribe to our newsletter to keep up with what is going on
21:42:36 <tdawson> Which reminds me ... I still need to send that email about saying it's gone.
21:43:05 <tdawson> I said I'd get that out yesterday, and didn't make it.
21:43:23 <Ebeneezer_Smooge> well you have until tomorrow. its only a day a waaaaaaay
21:43:47 <tdawson> tomorrow ... tomorrow ... it's always ... tomorrow ..
21:43:51 <nirik> The future moves into the past, with only a moment between. ;)
21:44:19 <tdawson> Anyway .... summary, -playground isn't quite dead yet.
21:44:27 <salimma> yesterday....
21:44:27 <tdawson> Anything else for EPEL8 ?
21:44:31 <salimma> is it undead?
21:44:39 <salimma> or mostly dead
21:44:45 <tdawson> mostly dead
21:44:56 <salimma> oh, not sure if we discussed this, but gflags has landed in cs8
21:45:04 <salimma> so it's unblocking some of my packages
21:45:07 <tdawson> But nobody better give it a chocolate covered pill.
21:45:14 <tdawson> salimma: Ya!!!
21:46:08 <tdawson> I'm going to move on to epel9 so we have time for open floor.
21:46:16 <tdawson> #topic EPEL-9
21:46:18 * nirik misread that as bzflag. :)
21:46:23 <carlwgeorge> by this time next week the c9s mirror that epel9 builds against will be frozen
21:46:37 <nirik> carlwgeorge: nice. :)
21:47:12 <tdawson> Here's hoping that my final missing package requests make it in before that freeze.
21:47:38 <salimma> ouch, time flies
21:47:52 <carlwgeorge> if it hasn't by now, i doubt it will make it, and thus probably not make it into rhel 9.0 either
21:48:32 <tdawson> carlwgeorge I'm the person who's putting those packages in .... there has been quite the flurry this past week.
21:48:39 <tdawson> Although, I don't touch CRB
21:48:39 <carlwgeorge> oh nice
21:49:04 <carlwgeorge> maintainers getting stuff in in the 11th hour
21:49:12 <Ebeneezer_Smooge> well good luck future-week tdawson. be kind to past tdawson who needs those packages
21:49:53 <salimma> it will be annoying if we can get packages in epel9-next (because the dependency is in c9s) but not in epel9
21:49:54 <tdawson> I just found one that needs to go into AppStream ... today  ... it has been very hard to not just put it in, but follow the documentation.
21:50:35 <tdawson> Anyway ... sorry for detracting.  Thanks for letting us know carlwgeorge
21:50:45 <carlwgeorge> salimma: no more than epel8-next and c8s today, so not a unique or even long lived issue :P
21:50:46 <tdawson> Anything else for epel9 ?
21:51:06 <carlwgeorge> i added caddy if anyone likes to use that
21:51:57 <tdawson> cool
21:52:06 <tdawson> #topic EPEL-Packaging-SIG
21:52:26 <dcavalca> I filed stalled package tickets for a bunch more things and got them built
21:52:34 <tdawson> Ya!!
21:52:36 <dcavalca> tpm-tools in epel9 is probably the most interesting/useful
21:52:50 <tdawson> I saw that there were quite a few stalled tickets that went through.
21:53:02 <dcavalca> this process seems to be working fairly well fwiw
21:53:18 <dcavalca> I also ended up filing a bunch of CRB tickets due to missing dependencies
21:53:28 <dcavalca> see https://bugzilla.redhat.com/show_bug.cgi?id=2057005 for a recent example
21:53:29 <nirik> I wish we could make it less manual, but it's a complex workflow
21:53:52 <dcavalca> salimma is working on automating some of the toil at least
21:54:32 <dcavalca> one package I was looking at is azure-cli, as we have an internal user that needs it
21:54:45 <dcavalca> but it looks particularly painful due to the large web of dependencies and the use of the new pyproject macros
21:54:53 <dcavalca> so I haven't filed a ticket for it yet
21:54:57 <tdawson> Yep.  Although the process is manual ... at least there is now a process.  Before it was alot of waiting, and pinging, and waiting some more.
21:55:15 * nirik nods
21:55:28 <dcavalca> oh also, I meant to ask, what should we do for cases like https://bugzilla.redhat.com/show_bug.cgi?id=2041315 where the maintainer engages but then just stops?
21:56:18 <tdawson> dcavalca: You can file a rel-eng ticket for that.   That's why we changed the wording to "no action" instead of "no resonse"
21:56:31 <dcavalca> got it, thanks tdawson
21:56:39 <carlwgeorge> dcavalca: i'm curious what's painful about the pyproject macros?  if anything would think they make things more robust, making sure no runtime deps are missing (as they are added as buildrequires automatically).
21:56:48 <tdawson> #topic General Issues / Open Floor
21:57:02 <dcavalca> carlwgeorge: https://bugzilla.redhat.com/show_bug.cgi?id=2044692 is the problem
21:57:08 <salimma> carlwgeorge: epel8 compatibility I think
21:57:26 <carlwgeorge> ah, yeah pyproject is epel9 only at this point
21:57:29 <dcavalca> the macros themselves are great, but we can't use them for epel8
21:57:29 <salimma> Miro was against it for the same reason the Rust macros also don't work on epel8
21:57:48 <salimma> IIRC even in epel9 there are slight issues with pyproject macros, though I think they're getting fixed (an older version got imported)
21:57:59 <tdawson> I do have one Open Floor item.   I won't be around for the next two weeks.  So I was wondering if someone would be willing to run the meeting ?
21:58:29 <carlwgeorge> i can if someone has a cheatsheet of the special commands i can follow
21:58:56 <tdawson> Yep, I can mail them, or paste them to you.
21:59:03 <carlwgeorge> or i'll read the logs from this one and reverse engineer them
21:59:40 <tdawson> Speaking of meetings ... carlwgeorge did you find a time for our "open door" meeting, or whatever we were calling it?
21:59:59 <carlwgeorge> oh yes, meant to bring that up
22:00:18 <carlwgeorge> my tentative plan is 1st wednesday of each month at 1700 UTC
22:00:39 <salimma> fixed to UTC, or with daylight saving?
22:01:10 * salimma just moved an internal meeting from 2nd wed to 1st wed because post-DST it will clash with Stream office hour, but looks like now it might clash with this :p
22:01:49 <Eighth_Doctor> I'm fine with that time
22:02:18 <pgreco> salimma: side note on the CVEs, looks like with a few tweaks, libvncserver from rawhide can be ported into epel7, if there is no soname bump
22:02:27 <tdawson> I'm fine with that time too.
22:02:48 <carlwgeorge> sorry salimma, that time seems popular :P
22:02:51 <salimma> so preferably for me we switch it to 1600 UTC once there's daylight saving (so it's fixed at 1200 ET / 900 PT), but I can also move my internal meeting
22:03:06 <salimma> yeah, it's the first slot that's not annoyingly early for me :)
22:03:17 <carlwgeorge> 1600 UTC won't work for us CPE folks
22:03:23 <salimma> pgreco: nice, want to do that?
22:03:39 <salimma> carlwgeorge: ah, your meetings are pinned to UTC, not allowing for DST?
22:03:41 <pgreco> I'm trying to minimize the tweaks and I'll ping you
22:04:06 * salimma wishes DST dies
22:04:24 <carlwgeorge> i think that CPE weekly meeting follows dst, but currently occurs at 1600 utc
22:04:31 <nirik> yeah, we have a team meeting at 16utc
22:04:52 <salimma> carlwgeorge: oh if it follows DST then no biggie
22:04:56 <carlwgeorge> it's probably pinned to ireland dst too, not usa
22:05:11 <carlwgeorge> so slight wrinkle, as if dst wasn't already annoying enough
22:05:17 <salimma> yeah, but that's only off by a week or so, so for monthly meetings hopefully we'll get lucky
22:05:22 <salimma> blame Bush :)
22:05:32 <tdawson> The joys of finding a good time
22:05:58 <pgreco> salimma: https://paste.centos.org/view/801f2a80
22:06:10 <carlwgeorge> for the most part, 1st wednesdays works pretty well with other community meetings
22:06:19 <carlwgeorge> time could slide back a bit but not really earlier
22:06:32 <carlwgeorge> and we can always adjust later if necessary
22:06:33 <tdawson> carlwgeorge Just go for what you have already planned this month.  Send out an email, blog, or whatever is appropriate.  and thank you.
22:06:46 <carlwgeorge> yup, blog incomming, will spam in the normal places
22:07:08 <tdawson> I'm needing to close this meeting.   Not really meaning to cut you off.
22:07:30 <tdawson> Thanks everyone for comming this week, for the good disucssions, and for carlwgeorge willing to run the meeting for the next two weeks.
22:07:36 <Ebeneezer_Smooge> thanks
22:07:44 <pgreco> thanks guys
22:07:50 <tdawson> I'll talk to ya'll in a few weeks.
22:07:52 <Ebeneezer_Smooge> have a good vacation tdawson
22:07:53 <nirik> thanks everyone
22:07:58 <tdawson> #endmeeting