20:00:20 <tdawson> #startmeeting EPEL (2022-05-25)
20:00:20 <zodbot> Meeting started Wed May 25 20:00:20 2022 UTC.
20:00:20 <zodbot> This meeting is logged and archived in a public location.
20:00:20 <zodbot> The chair is tdawson. Information about MeetBot at https://fedoraproject.org/wiki/Zodbot#Meeting_Functions.
20:00:20 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic.
20:00:20 <zodbot> The meeting name has been set to 'epel_(2022-05-25)'
20:00:20 <tdawson> #meetingname epel
20:00:20 <tdawson> #chair nirik tdawson pgreco carlwgeorge salimma dcavalca
20:00:20 <tdawson> #topic aloha
20:00:20 <zodbot> The meeting name has been set to 'epel'
20:00:20 <zodbot> Current chairs: carlwgeorge dcavalca nirik pgreco salimma tdawson
20:00:38 <carlwgeorge> .hi
20:00:39 <zodbot> carlwgeorge: carlwgeorge 'Carl George' <carl@redhat.com>
20:00:44 <tdawson> Hi carlwgeorge
20:00:46 <dherrera> .hi
20:00:47 <zodbot> dherrera: dherrera 'Diego Herrera' <dherrera@redhat.com>
20:00:53 <tdawson> Hi dherrera
20:00:57 <nirik> morning
20:01:13 <tdawson> Good Morning nirik
20:02:40 <salimma> .hello
20:02:40 <zodbot> salimma: (hello <an alias, 1 argument>) -- Alias for "hellomynameis $1".
20:02:46 <salimma> .hi
20:02:47 <zodbot> salimma: salimma 'Michel Alexandre Salim' <michel@michel-slm.name>
20:02:48 <tdawson> Hi salimma
20:03:23 <salimma> welcome back tdawson !
20:03:43 <tdawson> Thanks
20:03:56 <tdawson> I read last weeks meeting logs ... quick read. :)
20:03:57 <gotmax[m]> .hello gotmax23
20:03:58 <zodbot> gotmax[m]: gotmax23 'Maxwell G' <gotmax@e.email>
20:04:09 <tdawson> Hi gotmax
20:05:08 <tdawson> gotmax Is there anything specific you wanted to listed to and/or discuss?  I want to make we get to it if there is.
20:05:18 <tdawson> Or are you just here to listen?
20:05:32 <Eighth_Doctor> .hello ngompa
20:05:32 <zodbot> Eighth_Doctor: ngompa 'Neal Gompa' <ngompa13@gmail.com>
20:05:46 <tdawson> #topic EPEL Issues https://pagure.io/epel/issues
20:05:46 <tdawson> https://pagure.io/epel/issues?tags=meeting&status=Open
20:05:48 <gotmax[m]> I wanted to discuss python38
20:05:58 <Eighth_Doctor> I'm in two meetings at once right now
20:05:59 <gotmax[m]> on EPEL 8
20:06:12 <gotmax[m]> But mostly here just to listen :)
20:06:12 <tdawson> gotmax OK, we'll be sure to hit that when we get to the EPEL8 section.
20:06:12 <Eighth_Doctor> So tag me if you need me
20:06:59 <tdawson> We don't have any issues marked for the meeting ... although this is the CVE week of the month.
20:07:25 <tdawson> salimma: Did you want to go over the CVE stuff?  Or give it another month?
20:08:06 <salimma> I can give a quick TLDR - we have more EPEL 8 CVEs now, but seem to make a good progress closing old ones compared to 2 months ago (I didn't do a check last month) - the average bug is younger
20:08:23 <tdawson> With ImageMagick closing around 80 CVE's ... that certainly helped.
20:08:39 <salimma> the median bug is now 42 days old down from 562.5
20:08:52 <salimma> (for epel8). but we now have 48 bugs up from 17
20:08:53 <carlwgeorge> a new one came about for python-jwt, and i was able to close it quickly for epel9
20:08:59 <nirik> thats... definitely better. ;)
20:09:16 <carlwgeorge> closing it for epel8 would involve an incompat upgrade, and i'm not sure it's severe enough to justify it
20:09:27 <salimma> yeah, epel9 hasn't even made my stats yet (of course I only count high and critical severities)
20:09:40 <salimma> should I look into toddlers so we can get this auto-generated?
20:09:41 <carlwgeorge> s/epel8/epel7/ (in el8 it's in baseos)
20:11:46 <tdawson> Anything else for CVE's?
20:12:18 <tdawson> salimma: Sorry, I didn't realize I didn't answer ... I'd say ya, if you can get it auto-generated, that would be great.
20:12:35 <nirik> auto would be nice... of course it would be nice to generate for fedora too...
20:13:08 <tdawson> I've got my raw CVE numbers on Will-It, but having the severity, and average age is much better.
20:13:19 <salimma> oh yeah, I just want to get this limited to EPEL first
20:13:22 <salimma> but on related news
20:13:31 <salimma> JT is looking at resurrecting the Fedora security SIG
20:13:57 <salimma> so once we work out some logistics (when to meet etc) we should certainly bring this up there
20:14:08 * nirik nods.
20:14:09 <tdawson> That would be nice.
20:14:32 <salimma> the current meeting time (10 AM ET / 8 AM PT) is bad for me, but fingers crossed I'll be moving to a more suitable time zone not long from now
20:14:40 * salimma done
20:14:55 <tdawson> Thank you salimma.
20:15:02 <tdawson> #topic Old Business
20:15:22 <tdawson> I don't have any Old Business.
20:15:34 <tdawson> Did I miss anything?
20:16:07 <tdawson> #topic EPEL-7
20:16:07 <tdawson> CentOS 7 will go EOL on 2024-06-30
20:16:42 <gotmax> I have something
20:16:50 <tdawson> I feel like there some something epel7, but can't remember
20:16:54 <tdawson> gotmax Go for it.
20:17:03 <gotmax> There is a containerd package in EPEL 7 that's effectively unmaintained
20:17:26 <gotmax> I have been helping out as a member of the go-sig on the Fedora package, but I'm not interested in keeping it going for EPEL 7
20:17:50 <gotmax> There's 5 CVEs
20:18:25 <gotmax> I submitted a PR to update, but the main maintainer (whom is unrepsonsive) hasn't looked at it
20:18:42 <gotmax> I think it makes sense to retire it if possible
20:18:53 <carlwgeorge> would 1.2.14 to 1.4.12 be considered incompatible?
20:19:42 <gotmax> I'm not 100% sure. The way containerd does versioning is a bit weird.
20:19:56 <gotmax> carlwgeorge: Didn't you maintain the package at some point?
20:20:11 <carlwgeorge> many moons ago, but i intentionally never put it into epel
20:21:12 <carlwgeorge> someone from the red hat containers team asked me to add it to fedora, but then they bailed on helping co-maintain it, and i eventually orphaned it.  it was later adopted by another maintainer.
20:21:44 <gotmax> I suppose I can try to contact the maintainer and ask if he's willing to maintain it in EPEL 7 and retire it if I don't hear back.
20:22:17 <carlwgeorge> yes, i would say the options are retire or possibly incompat upgrade, if someone has the appetite to drive it
20:22:36 <salimma> we probably need the same notice period for retiring or incompat anyway, right?
20:22:54 <salimma> so it can be 'hey we're going to retire this, unless someone steps up'
20:22:57 <gotmax> I thought notices weren't needed for retirements
20:22:59 <carlwgeorge> with the older el7 kernel i can't imagine it's terribly useful for container workloads anyways, so my guess is retiring would be better
20:23:03 <gotmax> But it's suggested
20:23:10 <gotmax> Yeah
20:23:13 <salimma> hmm. isn't that a loophole though?
20:23:22 <carlwgeorge> https://docs.fedoraproject.org/en-US/package-maintainers/Package_Retirement_Process/
20:23:22 <salimma> you can retire and reintroduce a package faster than the notice period
20:23:26 <tdawson> That's actually something we should put into our documentation.  It seems a bit silly that we have to have two weeks notice for an update, but you can retire something with no notice.
20:23:35 <salimma> thoguh releng will probably look at you funny
20:23:44 <salimma> tdawson: yeah, I thought the same
20:24:19 <carlwgeorge> for an outright retirement, i agree with an announce email.  for a retirement due to the package being added to rhel, i don't think it's necessary.
20:24:36 <salimma> right. those seem very different as far as end users are concerned
20:24:40 <gotmax> Makes sense
20:24:41 <tdawson> carlwgeorge: Correct ... so we'd have to word it for those types of exceptions.
20:25:25 <tdawson> gotmax I agree with carlwgeorge on your options.  Retire (if you don't want to maintain it anymore) or update.   Maybe talk to the go-sig and see what they think.
20:26:20 <gotmax> Alright. Thanks for the advice.
20:26:47 <tdawson> Anyone want to volunteer to write a draft on clarifying our retirement policy?
20:27:05 <gotmax> Hopefully, I can at least get in touch with the primary maintainer before retiring it.
20:27:33 <tdawson> gotmax That would be best, I agree.
20:27:59 <salimma> I can try doing that
20:28:10 <tdawson> salimma: OK, thank you.
20:28:18 <salimma> on a related note, speaking of documentation, our stalled process docs still says 1 week + 1 week it seems
20:28:30 <gotmax> > <salimma> I can try doing that
20:28:38 <gotmax> You're talking about the policy update?
20:28:51 <tdawson> Doh!! ... that's me.
20:28:57 <salimma> gotmax: yeah, we agreed on extending it to be 2 weeks + 1 week
20:29:01 <salimma> or was it 1+2?
20:29:08 <tdawson> 1+2
20:29:30 <tdawson> My KDE stuff is finally cleared up ... I should be able to get to it this week.
20:30:13 <tdawson> OK, put it back on my list of things to do, should have a pull request in a day or two.
20:30:51 <tdawson> I'm going to move on to epel8 now, so we can get to gotmax's other issue.
20:30:58 <tdawson> #topic EPEL-8
20:30:59 <tdawson> CentOS Stream 8 goes EOL in 2024-05-31
20:30:59 <salimma> I'll write down doing the retirement doc or I'll forget too
20:31:31 <gotmax> So I wanted to bring up packaging python38 modules for EPEL 8
20:31:50 <nirik> modules? or packages?
20:32:12 <gotmax> I was talking about Python modules not dnf modules
20:32:16 <gotmax> It's a bit confusing :D
20:32:26 <gotmax> This is more of an issue now that ansible-core is packaged for python38
20:32:30 <nirik> ok, just making sure... I hear modules and it puts me on edge. ;)
20:32:44 <salimma> ha same too
20:33:20 <gotmax> As you might have seen, orionp is working on some docs for the process
20:33:37 <gotmax> And I also submitted a PR to epel-rpm-macros to make the process either
20:34:13 <tdawson> So others can see the email discussing this - https://lists.fedoraproject.org/archives/list/epel-devel@lists.fedoraproject.org/thread/CECLJH3QPXWNZGNTG3KIQHFZB4WFVOAN/
20:34:19 <gotmax> Thanks tdawson
20:34:29 <nirik> yep. thanks for all that. :)
20:34:46 <gotmax> But we're having an issue where packages from the python38-devel module (e.g. python38-pytest) are not available in the EPEL buildroot
20:34:47 * nirik has only had to build 3 or so so far... but would be nice to have those in epel
20:34:58 <gotmax> https://pagure.io/releng/issue/10679
20:35:15 <nirik> yeah, I can look again, but I couldn't figure it out last time I tried. They should really be there. ;(
20:35:33 <gotmax> I'm a bit ignorant about how we handle this in koji
20:35:50 <gotmax> but I thought we enabled and flattened all of them?
20:36:00 <nirik> we flatten them all.
20:36:09 <nirik> and ignore modular repodata/info
20:36:16 <gotmax> FTR, it's not just python38-pytest
20:36:26 <gotmax> It seems to be every package from that dnf module
20:36:41 <gotmax> I'm specifying dnf module now :)
20:37:09 <nirik> I can see them fine directly... it's just they don't appear in the repodata when koji merges them.
20:37:29 <tdawson> Yep ... dnf modules are messing up the python modules.
20:38:51 <tdawson> nirik gotmax Is there anything that we can do to help with this?
20:39:15 <tdawson> smooge might have an idea, but he's not here this week.
20:39:28 <nirik> make me smarter? ;) I dunno. I guess I can trace it out and find out exactly where it fails if I can find enough free time.
20:39:56 <tdawson> Although I think smooge's idea might involve burning and fire.
20:40:13 <gotmax> Well, I think it would make sense to get that doc into the epel docs.
20:40:29 <tdawson> https://fedoraproject.org/wiki/EPEL/Python3X
20:40:30 <gotmax> The epel-packagers-sig might be interested in maintaining some of them
20:40:40 <gotmax> Mainly, I just wanted to bring attention to it and get feedback
20:40:56 <tdawson> Yep.  I know orion wrote it on the wiki, but once he's got it stable, it's not too hard to port over.
20:42:28 <tdawson> I've been reading it, and following it, but I've found that everytime I try to help with python stuff, I find I'm out of my depth.
20:42:38 <tdawson> So I've been keeping quiet.
20:43:33 <tdawson> gotmax Thank you for bringing it up, and for your work on this.
20:43:48 <gotmax> No problem!
20:44:11 <tdawson> I think right now (at least for me) I have to say, keep at it, and let us know when you need an extra hand or two.
20:44:30 <gotmax> Sounds good
20:44:34 <gotmax> Also, I'm planning to push ansible-5 at the end of this week
20:44:40 <tdawson> Ya!!!
20:44:44 <Eighth_Doctor> 👌
20:44:47 <Eighth_Doctor> Yay
20:44:57 <rcallicotte> :)
20:45:13 <nirik> cool.
20:45:14 <carlwgeorge> maybe sgallagh could be of assistance
20:45:26 * carlwgeorge is looking at the contributor list for grobisplitter
20:45:48 <gotmax> I got a +1 on the ansible update with a caveat that the user had to install some missing modules from PyPI
20:45:58 <sgallagh> What's up?
20:46:09 <nirik> it's fine after splitting as far as I can tell.
20:46:41 <carlwgeorge> python38-pytest isn't showing up in the epel8 buildroot, but we think it should be after being grobisplit
20:47:02 <tdawson> gotmax Ahh ... and that's why the whole python module thing came up.
20:47:11 <gotmax> python38-pytest nor any other package from python38-devel
20:47:20 <carlwgeorge> sgallagh: https://pagure.io/releng/issue/10679 is the issue with full details
20:48:04 <gotmax> nirik: Is this the c8s mirror that epel8-next uses: https://infrastructure.fedoraproject.org/repo/centos/stream8-kojitarget/2022-05-25T10/x86_64/CS-8-001/
20:49:04 <sgallagh> Sounds to me like the modulemd-defaults is missing.
20:49:18 <carlwgeorge> that but `latest` instead of the date stamp
20:49:36 <tdawson> Hmm ... ya.   On my RHEL8 system, I don't see python38-pytest ... or python38-devel
20:49:36 <sgallagh> Where can I view the metadata in the public repo?
20:49:37 <carlwgeorge> here is the external repo https://koji.fedoraproject.org/koji/externalrepoinfo?extrepoID=47
20:49:37 <nirik> gotmax: normally no, should be latest there
20:50:34 <nirik> sgallagh: module stuff should not matter here.
20:50:51 <nirik> unless mergerepo_c is trying to do something with it.
20:51:02 <sgallagh> I may be missing something important
20:51:16 <sgallagh> Is the issue occurring only in the buildroot?
20:51:18 <gotmax> FWIW "sudo dnf install --repofrompath=a,https://infrastructure.fedoraproject.org/repo/centos/stream8-kojitarget/latest/x86_64/CS-8-001/ python38-pytest" seems to work fine
20:51:39 <carlwgeorge> we're about out of time for the meeting, do we want to pick up the python38-devel talk after the  meeting in #epel or #fedora-devel/releng?
20:51:53 <tdawson> carlwgeorge: Thanks ... ya. I need to move on.
20:52:00 <tdawson> #topic EPEL-9
20:52:01 <gotmax> WFM
20:52:10 <carlwgeorge> we're a bunch of engineers, we tend to latch onto problems and try to solve them :D
20:52:12 <nirik> sgallagh: yes
20:52:30 <tdawson> Looks like epel9 is now building off real RHEL 9.0
20:52:54 <tdawson> nirik I am going to thank you, because I'm assuming you did that.  Is there anyone else that should be thanked?
20:53:18 <carlwgeorge> mboddu helped
20:53:35 <carlwgeorge> i was present but didn't do anything other than words of encouragement
20:53:41 <tdawson> :)
20:53:59 <tdawson> Well, thank you nirik and mboddu ... and you too carlwgeorge for your words of encouragement.
20:54:49 <tdawson> From an end user point of view, it was seamless and I didn't notice any change.
20:55:10 <tdawson> Anything else for epel9?
20:55:44 <gotmax> I think Eighth_Doctor had a docs PR
20:55:50 <tdawson> #topic General Issues / Open Floor
20:55:51 <gotmax> Not sure if we need to talk about that here
20:56:14 <tdawson> Oh, I thought I looked through ( and merged) all his doc PR's.
20:56:40 <gotmax> Oh maybe you did already
20:57:07 <gotmax> Oh, it looks like you did
20:57:10 <gotmax> Nevermind
20:57:16 <tdawson> not a problem.
20:57:26 <tdawson> Anything else for open floor?
20:57:29 <gotmax> I think that's all from me :D
20:58:26 <tdawson> Thank you all for comming, and for the good discussions.  And for all you all do for the EPEL community.
20:58:41 <tdawson> I'll talk to you next week, if not sooner.
20:58:47 <gotmax> Thanks for running the meeting, tdawson!
20:58:47 <tdawson> #endmeeting