18:00:03 #startmeeting FESCO (2015-05-27) 18:00:03 Meeting started Wed May 27 18:00:03 2015 UTC. The chair is nirik. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:00:03 Useful Commands: #action #agreed #halp #info #idea #link #topic. 18:00:03 #meetingname fesco 18:00:03 The meeting name has been set to 'fesco' 18:00:04 #chair ajax dgilmore jwb mitr nirik paragan rishi thozza sgallagh 18:00:04 #topic init process 18:00:04 Current chairs: ajax dgilmore jwb mitr nirik paragan rishi sgallagh thozza 18:00:15 .hello sgallagh 18:00:16 sgallagh: sgallagh 'Stephen Gallagher' 18:01:07 well perhaps we won't have quorum. ;) 18:01:17 i'm kind of here. not feeling well 18:01:21 hi 18:01:23 hi all 18:01:25 :( sorry to hear it jwb 18:01:49 Hi 18:01:54 Hi 18:02:12 hi there 18:02:18 * rishi is here 18:02:19 ok, so I guess we do have quorum. :) lets go ahead then... 18:02:26 #topic #1441 Packaging: Practices for Migration of cron jobs to systemd timer units 18:02:26 .fesco 1441 18:02:26 .fesco 1446 18:02:28 nirik: #1441 (Packaging: Practices for Migration of cron jobs to systemd timer units) – FESCo - https://fedorahosted.org/fesco/ticket/1441 18:02:31 nirik: #1446 (packaging guidelines - default-on services vs. "public network socket") – FESCo - https://fedorahosted.org/fesco/ticket/1446 18:02:54 there's two tickets here, but I guess it's clarification needed really. 18:03:30 Right, I may have misinterpreted the original meaning and clarified incorrectly (or at least inconsistently) 18:04:01 The main question here is whether we require FESCo approval for a service to autostart if it only listens on localhost TCP 18:04:22 i don't see a reason to treat that differently from a unix socket really 18:04:23 I personally don't see a meaningful distinction between localhost and UNIX sockets 18:04:25 hi all 18:04:54 ajax: There are a small number of differences: UNIX sockets can be protected with UNIX permissions 18:05:04 I think they can both be constrained by SELinux though 18:05:13 sgallagh: sure, and tcp sockets actually obey network namespaces and unix sockets don't 18:05:20 /me nods 18:05:27 what is/was the existing policy. 18:05:29 * nirik reads up 18:05:41 I think the policy states that if the service is listening on a socket it may not be enabled by default without approval 18:05:47 "If a service does not require configuration to be functional and does not listen on a network socket" 18:06:04 where I added "public" before "network socket" 18:06:09 yeah, doesn't really define "network socket" 18:06:42 well its a pretty much defined term 18:06:42 ahh, ok... now I see the problem 18:07:04 does not mean that whoever wrote that meant local as well or not though 18:07:32 drago01: Right, which is why I attempted to remove the ambiguity as to how I interpreted it (and how it has realistically been treated up to now) 18:07:51 sgallagh: *nod* 18:08:25 this sounds tedious. next week we'll get into a discussion on what local means in light of containers, etc 18:08:40 jwb: indeed 18:09:16 just add "common sense is required to understand this document" 18:09:17 ... 18:09:17 jwb: Well, if we can agree that the intent is that "services that are accessible from a different physical machine" may not auto-start, we can phrase that appropriately. 18:09:25 s/physical/physical or virtual/ 18:09:30 Are there are real examples of services that only use a localhost socket? Just curious. 18:09:39 postgresql by default? 18:09:40 rishi: tog-pegasus by default 18:09:43 local dns cache i imagine 18:09:43 database servers? 18:09:44 rishi: elasticsearch 18:09:48 unbound yeah 18:09:54 So... yes :) 18:10:03 rishi: by default sendmail and postfix 18:10:19 rishi: DNS resolvers in general 18:10:23 in Fedora 18:10:23 ajax: does X listen on tcp by default? 18:10:24 Right. 18:10:48 drago01: by default default yes, but it's been run with -nolistentcp for ages 18:10:50 i'd rather just require "if you use a socket, you must get approval to auto-start" 18:11:06 * nirik was busy with release and hasn't had too much time to ponder on this. I don't know that it's something we can't adjust moving forward either 18:11:08 zbyszek: ah ok 18:11:18 Proposal: Rephrase this line as "If a service does not require configuration to be functional and does not listen on a network socket for connections originating on a separate physical or virtual machine" 18:11:27 jwb: some service may use the local socket just for runtime configuration 18:11:32 i don't care 18:11:35 jwb: That would be extremely tedious. 18:11:55 i'm -1 to the proposal. vote away 18:12:42 * jwb notes that nobody is actually going to be checking for this in terms of enforcement anyway 18:12:43 sgallagh: Yes, +1. Sounds sane to me. 18:12:53 sgallagh: +1 18:13:26 * nirik would be fine with that, but also jwb's more restrictive one. We can always adjust if we get too many requests or figure out if they fit in some new category. 18:13:28 jwb: I believe that the security team runs semi-regular portscans of Fedora to keep an eye on this stuff 18:13:33 sgallagh: by "separate" you mean not running locally? e.g. VM 18:13:41 or what it means? :) 18:13:55 thozza: A VM running locally is functionally a separate entity as far as I am concerned. 18:14:28 right, we should just make sure everyone thinks that 18:14:32 ;) 18:14:47 thozza: It says "separate physical or virtual machine". 18:14:56 thozza: I'm not going to get so pedantic that we start defining the word "the"... 18:14:57 That should be clear enough. 18:15:36 it's clear enough for me, but was already before ;) 18:15:41 so thats +4/-1 I guess? (counting me as +1, and sgallagh +1 to his own proposal). 18:15:48 sgallagh: +1 18:15:51 Yes, +1 to my own proposal 18:15:55 I'm not against the clarification 18:16:35 dgilmore: ? anyone else not vote? 18:16:45 nirik: I just did ;) 18:16:50 I have no real opinion right now 18:16:58 not had enough time to take it all in 18:17:22 #agreed Rephrase this line as "If a service does not require configuration to be functional and does not listen on a network socket for connections originating on a separate physical or virtual machine" (+5,-1,1) 18:17:29 #topic #1444 updates deliverables 18:17:30 .fesco 1444 18:17:31 nirik: #1444 (updates deliverables) – FESCo - https://fedorahosted.org/fesco/ticket/1444 18:17:36 dgilmore: you want to talk about this? 18:17:41 nirik: sure 18:18:26 along the vein of defining what we are going to ship as part of a release 18:18:58 there is a desire for more to be part of the updates process than just a repo of rpms 18:19:52 knowing before a release what things are expected of updates, and if they are every updates push or some time or specific update based criteria for triggering them to be made 18:20:04 some concrete examples we have today 18:20:09 the atomic installer 18:20:23 does this ticket mean we are planning to release updated iso for released Fedora versions? 18:20:24 the change owners want the nstaller iso to be regullary updated 18:20:48 so that when you do an install you do not have to update the install post install as you already have the current update 18:20:48 paragan, no, not really 18:21:06 paragan, only for some subset of things (like the atomic example dgilmore is talking about) 18:21:21 paragan: depends on what you define as updates iso 18:21:39 installer I do not xpect updates 18:21:42 expect 18:21:57 but docker base image, potentially layered images, 18:22:02 cloud images 18:22:10 atomic pieces 18:22:33 jwb: One might potentially want the workstation ISOs to be updated? 18:22:49 okay 18:22:51 So my request is to ensure that along with defining what we ship with the release we define what is to be updated 18:23:04 rishi: right, updated live images maybe 18:23:09 so, aside releng time and disk space, etc, there's the matter of QA on these. 18:23:13 rishi, it's a possibility. how realistic it is, i have no idea. frankly, i don't think it is, but that is why were talking about this :) 18:23:20 rishi: i think the only thing no one has ever wanted is updated installer images 18:23:39 dgilmore: which may be because anaconda seldom/never updates after release. 18:23:40 nirik: right 18:23:48 dgilmore, lots of people have wanted updated installer images 18:24:01 nirik: I guess also do we tightly couple with updates pushes or do them seperate also 18:24:09 Which is also to the good: if we disallow anaconda updates post-release, the vast majority of release validation tests will remain the same 18:24:12 jwb: okay, I have never been asked 18:24:19 jwb: yeah, like that Linus Torvalds guy a while back. ;) 18:24:23 (If we wanted to do these updated releases) 18:24:31 dgilmore, that's because fedora unity has been providing them for a long time. whether they still do, i don't know 18:24:40 jwb: only lives 18:24:48 jwb: Southern_Gentlem does lives. 18:25:22 sgallagh, i don't think that follows 18:25:40 but we're arguing about a specific case. the general idea in this ticket is good 18:25:42 jwb: Sorry, I phrased that poorly. 18:25:47 sgallagh: problem is the shifting sands of tools anaconda uses. 18:26:19 specifics I imagine would be sorted out while working out if we accept a change or not 18:26:49 as in the change would say we want to have updated versions of our deliverable during the life of the release 18:26:57 yes the anaconda no changes accept at for releases has benn a long running issue 18:26:57 The big attraction of a respun workstation ISO would be fixes to installation path bugs. 18:27:41 If that is not going to happen, then it is mostly "reduce amount of updates to download after release" versus "reduced quality due to lack of QA". 18:27:53 dgilmore: as part of a deliverables matrix, yeah... so it would say: "this is the input" "This is the exact output thing" "yes, we want updated thing when X happens" 18:28:00 And at that point, it is probably not worth the trouble. 18:28:08 i think once you start (frequently) updating any and every possible image, you really start to blur the lines of what a "release" means and move towards more of a rolling release style 18:28:12 * rishi is speaking from the workstation point of view 18:28:25 call it F22.1 F22.2 etc 18:28:34 nirik: right. 18:28:53 jwb: yeah, that too indeed. 18:29:09 jwb: indeed, some newer techs do not fit into the old distribution method 18:29:27 rishi i will continue doing updated lives which takes care of that as well for new installs 18:29:27 jwb: nirik: I don't think it blurs the importance of a "release". 18:29:34 and things like updated docker base images and cloud images are kinda necessary 18:29:37 maybe the old distribution method isn't valid any longer 18:29:40 more so docker than cloud 18:29:48 jwb: perhaps 18:29:49 this looks like a similar concept we are going to implement for RHEL7 (starting with Docker images) 18:29:59 How this whole thing affects QA is my big concern. 18:30:12 QA resources, to be precise. 18:30:13 I am just trying to set expections clearly for what releng will be doing 18:30:14 rishi, yes. qa needs to weigh in here 18:30:34 but it does heavily effect QA also 18:30:37 rishi: test automation would help not sure how far things are there though 18:30:53 right. 18:31:09 drago01: People keep saying "test automation", yet we keep seeing stable Fedora updates cause regressions. 18:31:19 so, actions here? ping qa folks about it? should we start a discussion on devel? or wait until we have more concrete proposals? 18:31:37 nirik, a combination of the first 2 18:31:46 nirik: I think we need to be fairly agressive in working things out 18:31:57 so reach out to QA and start a discussion on devel 18:32:00 We should have been gating updates and batching them long ago, but that battle is lost. 18:32:11 it would also help here to have deliverables worked out or at least somewhat worked out 18:32:17 rishi: might be because we do *not* have test automation yet? 18:32:21 or what's your point? 18:32:23 also, one possibly solution is very much "if you want updated images, please tell us which people are volunteering to QA those" 18:32:32 nirik: I would say ping QA first. It is basically QA and rel-eng who will bear the brunt of this. 18:32:47 jwb: yeah, but I am somewhat leary of that unless we also say "and if they don't we won't release the images" 18:33:03 nirik, the implication is heavily present, yes. we can make it clear 18:33:06 dgilmore: can you start a discussion on the qa list? 18:33:25 its kind of lame that you install fedora a few months after relase and have to download a few tb of updates 18:33:26 drago01: My point is whatever test automation we have is not robust enough. 18:33:36 jwb: yeah, a lot of teh requests are coming from the cloud wg, I think they need to get more people signed up to do qa, and we need a way to sign off on updates deliverables 18:33:46 nirik: sure. I can 18:33:52 rishi: we don't really have any. ;) But people are working on it... it might happen someday. ;) 18:33:58 drago01, hyperbole much? 18:34:12 jwb: the "t" yes otherwise no 18:34:22 nirik: Yes, I know. I don't want to disparage the Taskotron guys. 18:34:27 Sorry if it came out that way. 18:34:28 #action dgilmore to open discussion on the qa/test list about testig updated deliverables. 18:34:32 drago01, right. the problem is bad. let's not make it intractable 18:34:41 jwb: ok fair enough 18:35:11 shall we keep the ticket open and discuss feedback from qa next time? 18:35:15 sure 18:35:18 sure 18:35:41 yes 18:35:45 ok 18:35:49 +1 18:36:00 #info will keep ticket open and discuss qa folks feedback next time 18:36:11 #topic #1445 F23 Self Contained Changes 18:36:12 .fesco 1445 18:36:13 nirik: #1445 (F23 Self Contained Changes) – FESCo - https://fedorahosted.org/fesco/ticket/1445 18:36:36 +1 18:36:39 We have two requests for new Spins 18:36:47 Cinnamon look fine for me 18:36:57 I am a bit unsure regarding the Netizen 18:37:04 +1 to cinnamon 18:37:07 I see somewhere asked again should we consider spins as a self-contained or system wide change 18:37:20 +1 to Cinnamon. Not sure whether we need a Netizen spin. 18:37:24 the netizen one I would like it to be a bit clearer what it actually is 18:37:26 definitely fine with cinnamon +1. There was still some discussion on the other one. 18:37:47 yeah +1 to cinnamon spin 18:37:54 +1 to Cinnamon as well 18:38:02 I think the idea is nice, but they seem to just provide the privacy/etc tools, but not really any integration work. 18:38:07 presumably it comes with a mail client that refuses to top-post 18:38:17 ajax: :D 18:38:20 ha. 18:38:31 nirik: exactly, it is my feeling as well 18:38:34 it has basically tor/privoxy/keepassx/etc... 18:38:52 +1 to cinnamon 18:39:17 Netizen seems to me like it should be a process and an educational effort rather than a product 18:39:18 so, what would we like to do on it? defer and engage with owner some more on list? 18:39:33 the netizen thing seems more like a product? 18:39:38 I would have been happier if they signed up add a "certificate pinning" UI to seahorse instead. Just a random example. 18:39:47 the distinguishing feature of spins at this point seems to be "hey check out my default desktop" 18:39:56 sgallagh: well, I think it could be a showcase... "here's how to setup things to be more private" 18:40:11 nirik: A youtube video could handle that more easily, I think 18:40:11 but that would take actually doing that config... 18:40:14 ajax, basically. i'm not convinced this is at all worthwhile 18:40:18 ajax: there is two types of spins 18:40:24 the desktop ones 18:40:29 ajax: Actually I got it the other way round. Netizen, to me, looks like a bunch of packages installed by default. 18:40:43 and then the things like security, games, scientifc, design suite 18:40:56 Cinnamon, to me, is more like a finished cohesive entity. 18:41:10 the new websites divide them into 'spins' (the desktops) and 'labs' (the other collections of stuff) 18:41:13 dgilmore: huh, so there's the kind mentioned on spins.fp.o, and the kind not mentioned on spins.fp.o. 18:41:15 dgilmore, the latter is "stuff i install after on my machine so i might as well make a spin" 18:41:29 ajax: labs.fp.o 18:41:39 http://labs.fedoraproject.org/ 18:41:41 jwb: kinda yeah 18:41:42 But, but ... 18:41:51 I don't like KDE, but I like games. 18:41:55 So what spin do I use? 18:42:12 I never understood the point of the "labs". 18:42:13 they are more like 'you just want to do X and we have a X spin, just use that' 18:42:15 see, choice sucks. 18:42:15 labs would be AMAZING if it was just a "build me a spin from this supplied kickstart" tool 18:42:18 told you. 18:42:18 Those are just stuff that I can install. 18:42:19 rishi: you make your own, or put the games on prefered desktop 18:42:20 otherwise, it's kind of pointless 18:42:21 ajax: ;) 18:42:26 webrevisor! 18:42:33 nirik, basically. 18:42:49 most of the 'labs' are also comps groups. 18:43:07 while i may hold an unpopluar opinion, i don't think having spin images for everything is wonderful for the project 18:43:23 you are not alone. ;) 18:43:31 jwb: I agree with you. 18:43:44 jwb: +1 18:43:44 so i'm -1 to netizen. i'm probably -1 to cinnamon too 18:43:49 anyhow, proposal: revisit netizen next week and discuss more on list. 18:43:58 jwb: I do not disagree, some users really like the spins. 18:44:02 nirik: +1 18:44:18 nirik, +1 18:44:32 * jwb goes to create a "kernel developer" spin 18:44:47 I think we were at +6/-1 on cinnamon then? 18:44:47 jwb: the joke is it installs debian? 18:45:01 ajax: freebsd kernel. ;) 18:45:05 jwb: microEMACS as default text editor! 18:45:08 jwb: make sure you include a copy of the fedora kernel source in it 18:45:08 ajax, no, because debian moved to systemd too 18:45:13 nirik: +1 revisit 18:45:29 jwb: right, my bad, i didn't mention which version of debian 18:45:41 nirik: I believe so for cinnamon 18:45:44 #agreed cinnamon spin approved (+6,-1,0) 18:45:45 uh, whichever one was libc5 i guess 18:45:46 ajax, i mean, if we're going for the stereotype, we might as well be specific 18:46:08 ajax, i'll call it the akpm spin and it will literally just be FC6 18:46:11 any other votes for revist netizen next week (we are at +4 for that now) 18:46:23 jwb: go the new world version, make it a kernel developer vagrant box 18:46:26 nirik: +1 revisit 18:46:50 Yes, revisit netizen. 18:47:03 nirik: +1 revisit 18:47:03 #agreed Further discuss netizen on the list and revisit next week (+6,0,0) 18:47:04 Although I might still vote "no" next week. :) 18:47:12 dgilmore: kidding aside, a kernel developer vagrant that has the fedora config pre-built on it (so modifications are a smaller build) would be fantastic 18:47:21 #topic #1435 Approving exceptions to the package review process 18:47:21 .fesco 1435 18:47:23 nirik: #1435 (Approving exceptions to the package review process) – FESCo - https://fedorahosted.org/fesco/ticket/1435 18:47:33 vagrant implies virtualbox? 18:47:46 jwb: no, works with libvirt also 18:47:47 jwb: there's a libvirt backend now apparently 18:48:08 oh good. because there is no measure to how far i would tell people to ... well, nevermind 18:48:12 for f22 we made virtualbox and libvirt versions 18:48:14 jwb: Yeah, libvirt works quite well. I just built one for SSSD development today. Quite easy. 18:48:37 so, this is basically the FPC wanting the power to except reviews in rare cases they deem it's ok to do so... 18:49:12 Well, it was them wanting to know if that power is sensible and if so, who decides when to use it. 18:49:30 I'm fine delgating that to them... if they do something we don't like we can always revisit. 18:49:59 Yeah. Let's delegate to FPC. 18:50:07 so I honestly would be okay, if we made sure we had some tooling that produced things sanely. the texlive srpm is a monstrosity, and its often updated for minor changes, spliting it up into 1800 odd srpms makes so much sense 18:50:08 yes FPC is good for this 18:50:17 although as far as I know the SCL guidelines are stalled and unlikely to ever really happen. 18:50:29 Although the way we do package reviews leaves a lot to be desired. Review it once and then let the crazies take over. :/ 18:50:40 dgilmore: even fewer would help. 18:50:52 even 10 would be better than 1 we have now 18:50:57 Not sure how to practically fix that, though. 18:50:58 if we say FPC decide its okay, or ot has to come to FESCo, I am okay either way 18:51:22 proposal: delegate authority over exceptions to the package review process to FPC 18:51:26 +1 18:51:30 +1 18:51:33 nirik: +1 18:51:41 +1 18:51:44 rishi: we fix it by having automated checking of things and bugging people when they make mistakes 18:51:49 +1 18:51:53 +1 18:52:03 +1 18:52:16 rishi: as in run rpmlint, etc automatically after every build 18:52:32 #agreed delegate authority over exceptions to the package review process to FPC (+7,0,0) 18:52:37 dgilmore: Presumably only that that is not good enough. Otherwise we could have automated the initial review too. 18:52:39 nirik: That implies but does not explicitly state that mass-imports are acceptable. 18:52:45 +1 btw 18:52:56 sgallagh: well, 'exception' I thought covered it? 18:53:16 do you want to add a patch or counterproposal? 18:53:20 Nah. 18:53:21 #undo 18:53:21 Removing item from minutes: AGREED by nirik at 18:52:32 : delegate authority over exceptions to the package review process to FPC (+7,0,0) 18:53:21 rishi: I think its good enoough to detect undesired changes 18:53:26 #agreed delegate authority over exceptions to the package review process to FPC (+8,0,0) 18:53:27 nirik: It's probably fine. 18:53:34 #topic Next week's chair 18:53:39 who wants the chair next week? 18:53:41 I'll take it; it's been a while 18:53:50 #action sgallagh to chair next week 18:53:51 thanks. 18:53:54 #topic Open Floor 18:53:58 anything for open floor? 18:54:09 I have nothing 18:54:23 #info Congratulations on the Fedora 22 release! 18:54:38 actually I do 18:54:41 Yeah, great work from everyone. ;) Congrats. 18:55:00 I will not be here next week, I will be busing in meetings and prep for the releng fad next weekend 18:55:08 busy 18:55:36 ok. 18:55:41 the plan is by the end of next weekend rawhide will look very different 18:55:42 Hope it's a great FAD. ;) 18:55:57 nirik: indeed 18:56:18 #info releng FAD next weekend. 18:56:35 dgilmore: Sounds like fun. 18:56:52 if nothing else will close out in a random number of seconds. 18:56:56 rishi: hopefully it is, along with productive 18:57:10 Looking forward to what you come up with. 18:57:19 nirik: Nothing from me. 18:57:46 ok, thanks for coming everyone! 18:57:49 #endmeeting