[gentoo-dev] New email list and alias for the musl project --- a note for bug wranglers
Hi everyone, This one is mostly for the bug wranglers. There is a new email list and alias for the musl (sub?)project [1]. List: gentoo-m...@lists.gentoo.org alias: m...@gentoo.org musl is a new C standard lib [2]. It adheres scrictly to POSIX, XOPEN, SUSv3 standards. As a result, a number of packages break with musl. Usually these are small bugs, like missing headers mandated by POSIX, but still even a small error breaks a package. I don't want to burdon the maintainers with these bugs, so I'd like to ask bug wranglers that if they see a bug due to musl, to please assign it to me and cc the maintainer. I'll fix the bugs on the musl overlay [3] and upstream the patches, while keeping the maintainers informed about what's going on. Don't worry, I won't touch any packages. Bug wrangling usually proceeds via the metadata.xml, but there really is no structure there for communicating the above situation. Refs. [1] https://wiki.gentoo.org/wiki/Project:Hardened_musl [2] http://www.musl-libc.org/ [3] https://gitweb.gentoo.org/proj/musl.git -- Anthony G. Basile, Ph.D. Gentoo Linux Developer [Hardened] E-Mail: bluen...@gentoo.org GnuPG FP : 1FED FAD9 D82C 52A5 3BAB DC79 9384 FA6E F52D 4BBA GnuPG ID : F52D4BBA
Re: [gentoo-dev] New email list and alias for the musl project --- a note for bug wranglers
On 03/07/15 08:20 AM, Anthony G. Basile wrote: Hi everyone, This one is mostly for the bug wranglers. There is a new email list and alias for the musl (sub?)project [1]. List: gentoo-m...@lists.gentoo.org alias: m...@gentoo.org musl is a new C standard lib [2]. It adheres scrictly to POSIX, XOPEN, SUSv3 standards. As a result, a number of packages break with musl. Usually these are small bugs, like missing headers mandated by POSIX, but still even a small error breaks a package. I don't want to burdon the maintainers with these bugs, so I'd like to ask bug wranglers that if they see a bug due to musl, to please assign it to me and cc the maintainer. I'll fix the bugs on the musl overlay [3] and upstream the patches, while keeping the maintainers informed about what's going on. Don't worry, I won't touch any packages. Bug wrangling usually proceeds via the metadata.xml, but there really is no structure there for communicating the above situation. Refs. [1] https://wiki.gentoo.org/wiki/Project:Hardened_musl [2] http://www.musl-libc.org/ [3] https://gitweb.gentoo.org/proj/musl.git why not make a musl component in bugzilla? signature.asc Description: OpenPGP digital signature
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On 02.07.2015 23:39, Robin H. Johnson wrote: Hi all, The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Status 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again I've allocated time for an 8 hour freeze, but hope to be completed much sooner than that. Thanks to all who helped to make this possible! :-) Are there still any plans to use a code review system like gerrit that will avoid merges, rebases etc. to the tree by just accepting and serializing patches? Manuel signature.asc Description: OpenPGP digital signature
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Fri, Jul 03, 2015 at 06:34:41AM +, Robin H. Johnson wrote: On Thu, Jul 02, 2015 at 09:46:18PM -0400, Brian Evans wrote: Does this mean that https://wiki.gentoo.org/wiki/Gentoo_git_workflow is no longer draft or needs work or another document is meant to display the new flow? It does cover most of the things needed. It could use some revision regarding gkeys, and I'd like to also mandate signed pushes in addition to signed commits. A push doesn't create any data, it just uploads it to the repo, so how do you sign a push? William signature.asc Description: Digital signature
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Fri, Jul 03, 2015 at 12:24:42PM -0400, NP-Hardass wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Fri, 3 Jul 2015 11:19:13 -0500 William Hubbs willi...@gentoo.org wrote: On Fri, Jul 03, 2015 at 06:34:41AM +, Robin H. Johnson wrote: On Thu, Jul 02, 2015 at 09:46:18PM -0400, Brian Evans wrote: Does this mean that https://wiki.gentoo.org/wiki/Gentoo_git_workflow is no longer draft or needs work or another document is meant to display the new flow? It does cover most of the things needed. It could use some revision regarding gkeys, and I'd like to also mandate signed pushes in addition to signed commits. A push doesn't create any data, it just uploads it to the repo, so how do you sign a push? William Repoman may need to be adjusted. Git commit has support for a -S flag which signs the commit. No that is different. There are two signing things involved here. 1) git commit -S. ie sign the commit in the tree, and git log will show that signature later. 2) git push -S, this is signing the push itself. The client will sign everything that it pushes to the server. Then the server can verify that it was pushed by a dev (which is different from the commit since a dev might be pushing a commit that was made by a user). The server will save this push certificate so that it can also be verified later on. We'll want to have both of these on. It may require some repoman changes but should not be that much. -- Jason
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Fri, 3 Jul 2015 11:19:13 -0500 William Hubbs willi...@gentoo.org wrote: On Fri, Jul 03, 2015 at 06:34:41AM +, Robin H. Johnson wrote: On Thu, Jul 02, 2015 at 09:46:18PM -0400, Brian Evans wrote: Does this mean that https://wiki.gentoo.org/wiki/Gentoo_git_workflow is no longer draft or needs work or another document is meant to display the new flow? It does cover most of the things needed. It could use some revision regarding gkeys, and I'd like to also mandate signed pushes in addition to signed commits. A push doesn't create any data, it just uploads it to the repo, so how do you sign a push? William Oh, you said push specifically, instead of commit. My apologies. I'm unaware of a means to do this. I guess you could theoretically sign and commit a list of the pushed commit hashes. - -- NP-Hardass -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIcBAEBCAAGBQJVlrnuAAoJEBzZQR2yrxj73C0P/003J46FmqXNYIk3cVoktvCj hJ74J9DcAC7ZvqJjAeASdWN83AWlUNFQQeA6eSkmtJXOot7VfrfVw/ZlWReEcq1p ZMFhUdawTDcfeH5fBx0vJLeLkyWHBIYoMBQchSzQpugEt7X378C1BL4ttrWYpOu1 Z494tvZVvZ9+hN17IT+A3wejsfWkDT2oFECXjZJuZQXR7b3qlUVZJsKAxrpZThBX ciifiy/84sHRx6fXpU7RtqsYJXLt8dAjppPDH7ci2sh+YjJqL1nj58QZprdlvNc/ R2EupWfphv7sKdN3/yPpT5RWjERKJqYkt15UzZceLEMjhpMxW2b3Rfcz4CE+MXS2 e1/MgvoMoJI7/7x9cg8bykkYa6NmTdQ7nXtqP9s/cADtPho7mllA+FVW7aH8CE46 LG2s0AsIWAV0rR1H+d77O2bhknczlPKgKDEO+sFwy+Y7I/2V37nEkSZR8LqWVmse RKPmxjimX0iSEUIiaX5LPR48hmkosSvIHkmwO7XIK5NCtIoMOjBXyIenYQi67+fs PV1+ZgBxWufn1BEDXDQc8TN9IvvRpRvv2O5lKYZ096pLon9ZVB/O0BscGjk7HeL0 JCpZ4fJ6d3o/4xlsmX9n++X1zbdJyMvrHBL6mZa6wcZPMMe1L0w2/zFo8sG8mKpD Ag/E/1m/6OXzsJCJOAbE =1FB0 -END PGP SIGNATURE-
Re: [gentoo-dev] openstack image update
Matthew Thode prometheanf...@gentoo.org writes: I've updated the openstack images to make them smaller, make them work with dynamic ethernet interface add/delete, and make the disk resize on first boot. I've also made nomultilib and hardened images. Good work on these images, prometheanfire. I've launched a few instances and they work nicely. I have some feedback: - root can log in at the console with no password. This may have been intentional but it's unusual in the industry. Consider a 'passwd -l root' to lock the account from any access (until a sudo'ed 'gentoo' user decides to set one). - I noticed there is a reboot during the first launch. I assume this is because of the disk resize. Consider these two other mechanisms for accomplishing the resize (I've implemented both at my job, but in other distros). 1) The initramfs has additional code that grows the / partition before it is mounted. Probably genkernel doesn't support this today, but it could. 2) / is on a small LVM logical volume. At early boot, an 'lvextend' grows the lv to use the full disk without requiring the kernel to re-read the partition table. This is the approach most distros take. Eliminating the reboot would shave some time off the launch. Also cloud-init would be able to execute its new-instance code on the system's final state (larger disk) instead of the intermediate (pre-reboot, small-disk) state. - I see the kernel sources are deleted (and a dangling symlink remains). What Rackspace has done with its Gentoo images (and I've appreciated it) is leave the kernel sources there. If I need some obscure module, I can quickly build the single module and modprobe it. I was able to make kernel adjustments by using /proc/config.gz, re-installing the sources, building, and rebooting. It just took longer. - The root disk is 5GB, and can grow from there. If it could fit into 1G, then m1.tiny's could be launched. This is probably a low-value activity since 1G is hard to achieve (no portage tree!) and m1.tiny's aren't useful generally. Thanks for considering these enhancements for future builds. I'd love to hear feedback on any of these suggestions. -- Erik Mackdanz
Re: Code Review Systems Was: [gentoo-dev] Git Migration: launch plan schedule
Robin H. Johnson posted on Fri, 03 Jul 2015 20:22:25 + as excerpted: On Fri, Jul 03, 2015 at 03:39:31PM +0200, Manuel Rüger wrote: Are there still any plans to use a code review system like gerrit [...] [T]he general discussion was that a code review system was not in the immediate future... I believe the general sense of previous discussion was that the git switch has been delayed too long already, and while code review, etc, might be nice, in this case it's the perfect being the enemy of the good, in that it would likely result in another half-decade of gentoo on cvs while these /additional/ things were worked out, and that was simply judged to be an unacceptable tradeoff to make. Which I (strongly!) agree with. The switch to git won't be perfect, but we /can/ do it now, and we should. If code review, etc, is to happen, once we're on git it can happen incrementally, but we're not losing anything we have already by not doing it with the switch to git, while just the switch to git alone is already a huge improvement, bringing us into the current era, at least. And there's always going to be one more thing we could change to make things better... at the cost of putting off the big switch yet again... ultimately indefinitely, letting the perfect be the enemy of the good, to the benefit of the otherwise generally agreed to be unacceptable status quo. -- Duncan - List replies preferred. No HTML msgs. Every nonfree program has a lord, a master -- and if you use the program, he is your master. Richard Stallman
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Fri, 3 Jul 2015 11:19:13 -0500 William Hubbs willi...@gentoo.org wrote: On Fri, Jul 03, 2015 at 06:34:41AM +, Robin H. Johnson wrote: On Thu, Jul 02, 2015 at 09:46:18PM -0400, Brian Evans wrote: Does this mean that https://wiki.gentoo.org/wiki/Gentoo_git_workflow is no longer draft or needs work or another document is meant to display the new flow? It does cover most of the things needed. It could use some revision regarding gkeys, and I'd like to also mandate signed pushes in addition to signed commits. A push doesn't create any data, it just uploads it to the repo, so how do you sign a push? William Repoman may need to be adjusted. Git commit has support for a -S flag which signs the commit. - -- NP-Hardass -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIcBAEBCAAGBQJVlrdKAAoJEBzZQR2yrxj7XBIP/0rWguE1R0EueAdmI0ApY2Wg lvkkWkW0P4uJnHri522dvmIeiQ9j/2NFQy5uXCHXE+TQRszog03YwP2xu9lQnoMm OURcAUDNO1uCSUp+xYH6UDi9K/t19pkncLskNHs774ka6LLZvrnRPeU2MP6q5VuZ flK479q8LWIfArjh/Qqi5rZ5+0boyTS5SxKjlwIaj4kUd81ph1xNHX3pEJhPL7ZW sqt9sVmGQa+ucCWJ8zyyhNX3F8cVHQP43BPKMI51SsMo9X5xwqaccWQWoYioBoFM 9W0HwWQ/IsMxIG337KvqmCZXDQ+1CmYqWHV0f3FQScJk9DOxXpmSNBv16s2GuM5p n0GqL4wNhvQZDIczOaH87/2I5G3L2kFETLiMQ0mY9MKxji5TrCG7Hyy9jV+lhk2V tJS6HBHhU1wa5sayzNhxPly2W2Kw34hLbBQTscGl6hBK/hwzWrcWtLQoZO0kswWr OvlD58uDgIxX21sCftdLANTQ9l3zn7kqsFOV0Sb6oykrek+NQpYW6J5mZg3vDO86 4Pc4Cbiqy3D9vVGg5jNlP3J0gT1cN6VFnxaSydx0kSIMUq0OxSayz3Y290U5lieF ouCu6TaIZRFzzbTC9fyRPLROQmW/1AZOsbN7GLkFKWZ0A+T1zoTqU6zoWQPyHL5N kwc+xJ1ffAb6Mf745Sh7 =F2sd -END PGP SIGNATURE-
[gentoo-dev] Last rites: sci-biology/flower
# Michael Orlitzky m...@gentoo.org (3 Jul 2015) # Mask for removal in 30 days. Superseded by dev-haskell/biosff; # use that instead. Bug #553636. sci-biology/flower
Re: [gentoo-dev] NPM / NodeJS project
On 06/28/2015 11:09 PM, Andrew Udvare wrote: I would still find it useful to install CoffeeScript (among others like PhantomJS) via Portage for global use. Right now I hack on ~/node_modules/.bin to PATH in my shell (luckily that works). It doesn't look like anyone wants to get involved with this until upstream settles down a bit, so I've committed dev-lang/coffee-script a few minutes ago sans-eclass.
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Fri, 3 Jul 2015 21:40:50 + Robin H. Johnson wrote: On Sat, Jul 04, 2015 at 12:19:41AM +0300, Andrew Savchenko wrote: As I see from git docs only commits and tags may be signed. There is no way to sign a push. Moreover there is no need to sign each commit, see what Linux says on that: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html That was Linus's 2009 opinion, and he changed his mind since then, with the research into further attacks on SHA1. Git (since 2.2) DOES support signed push. Look at the manpage for git-push, for the --signed option: http://git-scm.com/docs/git-push We have a rule of one year compatibility period. ChangeLog shows that git-2.2.0 was introduced on 02 Dec 2014. So pushed commits can't be enforced before 02 Dec 2015. (And yes, my laptop still uses an older version, that's why I was unable to find --sign in the git-push manual.) Best regards, Andrew Savchenko pgpX34YRGtbiW.pgp Description: PGP signature
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Fri, Jul 3, 2015 at 5:40 PM, Robin H. Johnson robb...@gentoo.org wrote: On Sat, Jul 04, 2015 at 12:19:41AM +0300, Andrew Savchenko wrote: As I see from git docs only commits and tags may be signed. There is no way to sign a push. Moreover there is no need to sign each commit, see what Linux says on that: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html That was Linus's 2009 opinion, and he changed his mind since then, with the research into further attacks on SHA1. A few things. I agree with where you're going, Robin, but I do take issue with just one bit of your email. First, signing commits in no way protects against attacks on SHA1. The only thing that binds a commit record to the actual data in the tree is an SHA1 hash. If you are able to break SHA1 then all you need to do is tamper with a file in the tree however you want, then add or tamper with another file anywhere else in the tree such that the two changes cancel each other out and result in the same SHA1 hash. Then you swap out any blobs/trees you modified in the repository and nobody is the wiser, especially with something like Gentoo where you can stick something in a random filesdir anywhere in the tree where nobody will notice it for a long time. The commit record itself is not touched, so its signature verifies just fine. That said, I do support commit signing. It makes a lot more sense for a project like Gentoo than a project like Linux. With Linux, the distributed repositories everybody actually uses have only one committer each for the most part. The only person who commits to mainline is Linus himself. Then there is a release process where all the commits for the week go out with a git tag, which is signed. Linus basically does the final QA on the mainline kernel before it is released, and he assumes responsibility for every commit that went into it. In contrast, Gentoo has numerous committers and changes go right from the dev's repository to every user's desktop. When I make a commit I'm only responsible for my own change - I don't do QA on the last 47 commits other random devs have made. So, if the last commit doesn't interact with mine in any way, chances are I won't do any testing of it at all before I add my own signature - I won't even run repoman on the entire tree. So, a dev's commit signature is really a stamp of quality on the diff between their commit and the last, not the tree as a whole. So, it really makes sense to the signing at the commit level, and not at some higher level. In fact, to do the signing at a higher level really does amount to rubber-stamping changes in a way that commit signing does not, based on how we assign responsibility. If we were a release-based distro then tag signing would be much more important. Finally, signing commits is really cheap, so why not just do it? -- Rich
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On 07/03/2015 05:19 PM, Andrew Savchenko wrote: As I see from git docs only commits and tags may be signed. There is no way to sign a push. This was new to me, but check out the --signed flag of git-push (1). Moreover there is no need to sign each commit, see what Linux says on that: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html '' Btw, there's a final reason, and probably the really real one. Signing each commit is totally stupid. It just means that you automate it, and you make the signature worth less. It also doesn't add any real value, since the way the git DAG-chain of SHA1's work, you only ever need _one_ signature to make all the commits reachable from that one be effectively covered by that one. So signing each commit is simply missing the point. '' I think the next sentence is relevant: IOW, you don't _ever_ have a reason to sign anything but the tip. My interpretation is that it doesn't make sense to sign commits one through nine if you're going to sign the tenth before pushing. But most of our commits are small and self-contained so it's probably easier to automate the signing with repoman than it would be to come up with a to-sign-or-not-to-sign guide a mile long.
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Fri, Jul 3, 2015 at 7:10 PM, Andrew Savchenko birc...@gentoo.org wrote: We have a rule of one year compatibility period. ChangeLog shows that git-2.2.0 was introduced on 02 Dec 2014. So pushed commits can't be enforced before 02 Dec 2015. (And yes, my laptop still uses an older version, that's why I was unable to find --sign in the git-push manual.) In general we try to avoid breaking the upgrade path for user systems that only upgrade annually, but no such limitation applies to developers. I don't think it is too much to expect a developer to use a recent version of git. Users don't need git push signing support to use Gentoo. By all means debate the importance of the feature/etc, but I don't see a need to freeze any new git feature for a year before making use of it with the gentoo repository. If it really bothers you, do your pushes from a chroot. It isn't like I close any gcc-5 bugs with can't be bothered to look at gcc-5 - give me a call in a year or two. -- Rich
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
Hi, On Fri, 3 Jul 2015 11:19:13 -0500 William Hubbs wrote: On Fri, Jul 03, 2015 at 06:34:41AM +, Robin H. Johnson wrote: On Thu, Jul 02, 2015 at 09:46:18PM -0400, Brian Evans wrote: Does this mean that https://wiki.gentoo.org/wiki/Gentoo_git_workflow is no longer draft or needs work or another document is meant to display the new flow? It does cover most of the things needed. It could use some revision regarding gkeys, and I'd like to also mandate signed pushes in addition to signed commits. A push doesn't create any data, it just uploads it to the repo, so how do you sign a push? As I see from git docs only commits and tags may be signed. There is no way to sign a push. Moreover there is no need to sign each commit, see what Linux says on that: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html '' Btw, there's a final reason, and probably the really real one. Signing each commit is totally stupid. It just means that you automate it, and you make the signature worth less. It also doesn't add any real value, since the way the git DAG-chain of SHA1's work, you only ever need _one_ signature to make all the commits reachable from that one be effectively covered by that one. So signing each commit is simply missing the point. '' Best regards, Andrew Savchenko pgp3IuIWwuwJv.pgp Description: PGP signature
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Sat, 4 Jul 2015 00:19:41 +0300 Andrew Savchenko birc...@gentoo.org wrote: Hi, On Fri, 3 Jul 2015 11:19:13 -0500 William Hubbs wrote: On Fri, Jul 03, 2015 at 06:34:41AM +, Robin H. Johnson wrote: On Thu, Jul 02, 2015 at 09:46:18PM -0400, Brian Evans wrote: Does this mean that https://wiki.gentoo.org/wiki/Gentoo_git_workflow is no longer draft or needs work or another document is meant to display the new flow? It does cover most of the things needed. It could use some revision regarding gkeys, and I'd like to also mandate signed pushes in addition to signed commits. A push doesn't create any data, it just uploads it to the repo, so how do you sign a push? As I see from git docs only commits and tags may be signed. There is no way to sign a push. Moreover there is no need to sign each commit, see what Linux says on that: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html ... Best regards, Andrew Savchenko Newer version(s) of git do have git push --sign capability. Sorry, I don't know the versions that it applies to. It was recently added as a feature. It also makes the push sig and data readily available for hook use. -- Brian Dolbec dolsen
Re: [gentoo-dev] Celebration subthread: Re: Git Migration: launch plan schedule (2015/Aug/08-09)
That's really really great. Thanks to all who contrinuted. On 07/03/2015 09:02 AM, Duncan wrote: [Let this be the celebratory subthread, so people can post if they feel the need, but others can safely skip if they so desire...] NP-Hardass posted on Thu, 02 Jul 2015 17:42:46 -0400 as excerpted: [Reordered to quote/reply order.] On July 2, 2015 5:39:52 PM EDT, Robin H. Johnson robb...@gentoo.org wrote: The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Status 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again Three cheers! Glad to see it happening. Thank you to everyone who helped to make this happen. I doubt I'm the only one who assigned a well under 50% chance of actually seeing it happen, believing gentoo was ultimately destined to become a Linux historical footnote due to failure to switch to git! I've been on gentoo over a decade, now, and stuck on CVS, I honestly didn't know if it'd last another. Obviously, I'm VERY glad to see the git switch actually scheduled! =:^) Thanks... just isn't a sufficient word to convey my gratitude to all the folks that have been working on this. Seriously. This switch to git puts you up with the gentoo greats such as DRobbins, in my book. Because without it, let's face it, gentoo /was/ slipping ever so slowly into history, and this really does, I believe, give us a chance to turn that around. signature.asc Description: OpenPGP digital signature
Code Review Systems Was: [gentoo-dev] Git Migration: launch plan schedule
(Breaking the thread, because I believe this topic needs further discussion). On Fri, Jul 03, 2015 at 03:39:31PM +0200, Manuel Rüger wrote: Are there still any plans to use a code review system like gerrit that will avoid merges, rebases etc. to the tree by just accepting and serializing patches? Merges are a fact of life, they will be happening. This was included on: https://wiki.gentoo.org/wiki/Gentoo_git_workflow Rebases of already published commits must be avoided. But beyond that, the general discussion was that a code review system was not in the immediate future... If the merge workflow becomes too problematic due to the high rate of change, then we can revisit those systems, to take advantage of their auto-merging functionality, but probably only in combination with the QA testsuites. -- Robin Hugh Johnson Gentoo Linux: Developer, Infrastructure Lead E-Mail : robb...@gentoo.org GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Sat, Jul 04, 2015 at 12:19:41AM +0300, Andrew Savchenko wrote: As I see from git docs only commits and tags may be signed. There is no way to sign a push. Moreover there is no need to sign each commit, see what Linux says on that: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html That was Linus's 2009 opinion, and he changed his mind since then, with the research into further attacks on SHA1. Git (since 2.2) DOES support signed push. Look at the manpage for git-push, for the --signed option: http://git-scm.com/docs/git-push The point of signed commits is to authenticate the creator of each commit. The point of signed pushes is to authenticate who introduced a commit (it might NOT be the person who signed the commits) and intended it to be on a specific branch. A slightly out of date, but good backgrounder on signed commits is here: http://mikegerwitz.com/papers/git-horror-story The StackOverflow asking about signed push is a good reference as well: http://stackoverflow.com/questions/27299355/why-does-git-need-signed-pushes -- Robin Hugh Johnson Gentoo Linux: Developer, Infrastructure Lead E-Mail : robb...@gentoo.org GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Thursday 02 July 2015 21:39:52 Robin H. Johnson wrote: Hi all, The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Status 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again I've allocated time for an 8 hour freeze, but hope to be completed much sooner than that. So dev-vcs/git now by default in stage3?
Re: [gentoo-dev] [RFC] New Project: MATE
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 07/02/2015 12:40 PM, NP-Hardass wrote: Greetings all, Looking for some feedback on creating a new project and herd for the MATE Desktop environment. The goal, like many other DE based projects, is to provide up to date packaging and as complete an offering of the DE's packages as possible. Currently, the packages of the MATE Desktop DE are listed as maintained by TomWij (who is on long term devaway). Prior to acceptance into the Gentoo repo, it was worked on by lxnay and steev. All 3 have either not responded to inquiries, or have expressed limited interest in maintaining the DE. As a result, I felt the best way to support users was to move support of MATE away from any individual, and create a project and associated herd to manage the packages, thus allowing any developer that is interested in helping out an easy means of doing so. I've created a prospective Wiki project page: https://wiki.gentoo.org/wiki/Project:MATE and intend to have a mail alias, m...@gentoo.org, and an email channel for Gentoo support and development, #gentoo-mate. Any feedback regarding the aforementioned would be greatly appreciated. The wiki page says Gentoo Gnome Project in the description. Typo? I also think you mean an IRC channel, not an e-mail channel. Nitpicks aside, I think it's an overdue change. Each DE should have a project attached to it IMO. - -- Daniel Campbell OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net fpr: AE03 9064 AE00 053C 270C 1DE4 6F7A 9091 1EA0 55D6 -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIbBAEBCAAGBQJVlknFAAoJEAEkDpRQOeFwjIMP9AuYaBTgP96q93iwCjUyjrPz M+j9jXUWtJixNFs0iNTfivTeVLtggTQExVSmTUfodxZYKEl1RqYPktaUS6R4QUct 8kZz+7FRbPBElaGOUTcQR9OLrVhkClrnV8FLPCsviJFDTwQQZeDw8GSKLUDuFoet 7saDfVUi9RIs1FztkjWNDeB3Oj1mmuJ+xUFkcD92elMQxTw9hEkItvuwbuIDNARF k1NTTIGZk8yBBsGRB58SIhOjrY6i4vG+MTlQUED+rXgikFWN8SI7jNqhO0908ps9 uIk7P5C+CH9U57WpE9kO8p79i7+6UmL2xwiRfVTtSHvBsDtY/a0alEyRHvdEvcwS ffQKzj22KW2ybBRc0o2IZlA5TGeXR5JRmki87FpQ3Yvc9pwkyfKFe8qmQSAcbqeS FTyiK/ReTL4nRxtP7qU1P6xj6pvQGE/5UIwc3D25oQNKOrCx86rTpJeXtuIH7CaQ UYE3/lplCHxZx7HaOViVjWF3vFTRSf7b/UELhIb8/ZaTBtV9WFG/sIjjphZ2dRss 4DPcjiTCeIqqhn6ka7tWuoRbi3DjmiCpFYXZPctQ6jsxRqbG0MjBjrC3iYSVXOCl sz/5TUvnJg487EIEIG4gYUX9kdYJllaLCB7nK7cj9KuLnmxaTvDtVMEr4Jfjqx9d 94g0WtTqih+CBsgWA3Q= =Nqnd -END PGP SIGNATURE-
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 07/02/2015 02:39 PM, Robin H. Johnson wrote: Hi all, The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Stat us 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again I've allocated time for an 8 hour freeze, but hope to be completed much sooner than that. This is great news! I assume docs have been written for git-commit standards as well? - -- Daniel Campbell OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net fpr: AE03 9064 AE00 053C 270C 1DE4 6F7A 9091 1EA0 55D6 -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIcBAEBCAAGBQJVlkrrAAoJEAEkDpRQOeFwxooP/iKN3RvNrITSwvihcIG4B8e8 w7acqsgCfIQTTza9sq+SQ5HXsmVadC+u702RSa5CqfgYw9JXSAdwhPVksGCt0iiL 9WdhVsRm8LE3O8B8gqGZLvG7+8OB19RCsbPN+fy0aQi+R2rtyQItibdpLLfzHw90 qfsw/JdI09ndRLh21gpmJnrC/fgelafQE0o/Z8Sl6akjwl44+dkAtPTDOroev3IF xDs1FyhSS2gzfAKcrXFoTetdmccUs/rQcCNzB3VeqciwfDvmJvAXtnN50VefpNt0 yID2ud7DDAPDTBH74gZEteARv6abQTqdToCEiczzaDSggiJGD/mS/F4jRgeWTeOP zgUcNyaLcjXIbb1QoBIEgBQHFXsOaiHegkuoGlNqCTCpffKBblDD38rBq/GBssce Y4cG8jvmapXKjph0c4BC+1V3p3Slj4AcnKfIk/Rkoc+YeLcGr5VUcOJXNHvJ85ZG M9c9kEW2X8/cscuRiS5tBMOROzculEAdEOOJZB6RJm2qk+yJ64MaiZVBd7Z6aUIx QmJvAenWeVZcw9Pz6MSmOCszLMD6MJOWx9tUCSUiiXEd9KoSAeKrXUraZpj76fOV Qv8jpCUd045RHTWvBqWs9g+ZPvb28rRoDzi5Xu+XU4FiTn9m079LJ5GUZvhsVFHn exhczY0a0hFXJaExF5R7 =MoQS -END PGP SIGNATURE-
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
03.07.2015 00:39, Robin H. Johnson пишет: Hi all, The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Status 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again I've allocated time for an 8 hour freeze, but hope to be completed much sooner than that. Thanks Robbin and whole the Infrastructure team! Great and i'd even say historical news!
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On 02/07/15 23:39, Robin H. Johnson wrote: Hi all, The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Status 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again I've allocated time for an 8 hour freeze, but hope to be completed much sooner than that. That's cool, so we are much closer than my latest information was!!! Thanks for your great work, Justin signature.asc Description: OpenPGP digital signature
[gentoo-dev] Celebration subthread: Re: Git Migration: launch plan schedule (2015/Aug/08-09)
[Let this be the celebratory subthread, so people can post if they feel the need, but others can safely skip if they so desire...] NP-Hardass posted on Thu, 02 Jul 2015 17:42:46 -0400 as excerpted: [Reordered to quote/reply order.] On July 2, 2015 5:39:52 PM EDT, Robin H. Johnson robb...@gentoo.org wrote: The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Status 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again Three cheers! Glad to see it happening. Thank you to everyone who helped to make this happen. I doubt I'm the only one who assigned a well under 50% chance of actually seeing it happen, believing gentoo was ultimately destined to become a Linux historical footnote due to failure to switch to git! I've been on gentoo over a decade, now, and stuck on CVS, I honestly didn't know if it'd last another. Obviously, I'm VERY glad to see the git switch actually scheduled! =:^) Thanks... just isn't a sufficient word to convey my gratitude to all the folks that have been working on this. Seriously. This switch to git puts you up with the gentoo greats such as DRobbins, in my book. Because without it, let's face it, gentoo /was/ slipping ever so slowly into history, and this really does, I believe, give us a chance to turn that around. -- Duncan - List replies preferred. No HTML msgs. Every nonfree program has a lord, a master -- and if you use the program, he is your master. Richard Stallman
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Thu, Jul 02, 2015 at 09:46:18PM -0400, Brian Evans wrote: Does this mean that https://wiki.gentoo.org/wiki/Gentoo_git_workflow is no longer draft or needs work or another document is meant to display the new flow? It does cover most of the things needed. It could use some revision regarding gkeys, and I'd like to also mandate signed pushes in addition to signed commits. -- Robin Hugh Johnson Gentoo Linux: Developer, Infrastructure Lead E-Mail : robb...@gentoo.org GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On Friday 03 July 2015 11:08:16 Justin wrote: On 03/07/15 10:51, Igor Savlook wrote: On Thursday 02 July 2015 21:39:52 Robin H. Johnson wrote: Hi all, The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Status 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again I've allocated time for an 8 hour freeze, but hope to be completed much sooner than that. So dev-vcs/git now by default in stage3? Why that? rsync is and will be the default sync method. We are switching for development not the sync clients. Justin Ahhh i see. Thx for info.
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
On 03/07/15 10:51, Igor Savlook wrote: On Thursday 02 July 2015 21:39:52 Robin H. Johnson wrote: Hi all, The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Status 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again I've allocated time for an 8 hour freeze, but hope to be completed much sooner than that. So dev-vcs/git now by default in stage3? Why that? rsync is and will be the default sync method. We are switching for development not the sync clients. Justin signature.asc Description: OpenPGP digital signature
Re: [gentoo-dev] [RFC] New Project: MATE
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Fri, 3 Jul 2015 01:37:26 -0700 Daniel Campbell (zlg) z...@gentoo.org wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 07/02/2015 12:40 PM, NP-Hardass wrote: Greetings all, Looking for some feedback on creating a new project and herd for the MATE Desktop environment. The goal, like many other DE based projects, is to provide up to date packaging and as complete an offering of the DE's packages as possible. Currently, the packages of the MATE Desktop DE are listed as maintained by TomWij (who is on long term devaway). Prior to acceptance into the Gentoo repo, it was worked on by lxnay and steev. All 3 have either not responded to inquiries, or have expressed limited interest in maintaining the DE. As a result, I felt the best way to support users was to move support of MATE away from any individual, and create a project and associated herd to manage the packages, thus allowing any developer that is interested in helping out an easy means of doing so. I've created a prospective Wiki project page: https://wiki.gentoo.org/wiki/Project:MATE and intend to have a mail alias, m...@gentoo.org, and an email channel for Gentoo support and development, #gentoo-mate. Any feedback regarding the aforementioned would be greatly appreciated. The wiki page says Gentoo Gnome Project in the description. Typo? I also think you mean an IRC channel, not an e-mail channel. Nitpicks aside, I think it's an overdue change. Each DE should have a project attached to it IMO. - -- Daniel Campbell OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net fpr: AE03 9064 AE00 053C 270C 1DE4 6F7A 9091 1EA0 55D6 -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIbBAEBCAAGBQJVlknFAAoJEAEkDpRQOeFwjIMP9AuYaBTgP96q93iwCjUyjrPz M+j9jXUWtJixNFs0iNTfivTeVLtggTQExVSmTUfodxZYKEl1RqYPktaUS6R4QUct 8kZz+7FRbPBElaGOUTcQR9OLrVhkClrnV8FLPCsviJFDTwQQZeDw8GSKLUDuFoet 7saDfVUi9RIs1FztkjWNDeB3Oj1mmuJ+xUFkcD92elMQxTw9hEkItvuwbuIDNARF k1NTTIGZk8yBBsGRB58SIhOjrY6i4vG+MTlQUED+rXgikFWN8SI7jNqhO0908ps9 uIk7P5C+CH9U57WpE9kO8p79i7+6UmL2xwiRfVTtSHvBsDtY/a0alEyRHvdEvcwS ffQKzj22KW2ybBRc0o2IZlA5TGeXR5JRmki87FpQ3Yvc9pwkyfKFe8qmQSAcbqeS FTyiK/ReTL4nRxtP7qU1P6xj6pvQGE/5UIwc3D25oQNKOrCx86rTpJeXtuIH7CaQ UYE3/lplCHxZx7HaOViVjWF3vFTRSf7b/UELhIb8/ZaTBtV9WFG/sIjjphZ2dRss 4DPcjiTCeIqqhn6ka7tWuoRbi3DjmiCpFYXZPctQ6jsxRqbG0MjBjrC3iYSVXOCl sz/5TUvnJg487EIEIG4gYUX9kdYJllaLCB7nK7cj9KuLnmxaTvDtVMEr4Jfjqx9d 94g0WtTqih+CBsgWA3Q= =Nqnd -END PGP SIGNATURE- Fixed the wiki page. And tes, correct about the email/irc blunder. I'll promptly fire my editor :P Thanks for pointing out issues -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIcBAEBCAAGBQJVllEXAAoJEBzZQR2yrxj7IdcP/3G5HvwDpKQ839GdbQu/oXhI LQrF0NWqZ80x5lEWxRIhwDr292SV6H2RCqU89+Qd7xxjHHSxBkkyaFM7rL7Ns81U 1TUffhfFxyjnyr5ECShzegzHsYIZSM/Tn4AJf9AVqRLmzj3QxtzlB4P1lJBBZJdP ZpQds5eFT4tpqwXHIrwiEr9IzLLdIwOxouFZ0iaTO34OFYUzVBYBUNNizZ5KidaG VOuj2ENnFAuyGFFNzVs2yJiH4/5mdV7BMjSzoW2+FdKSeCoDCNbWo2oXdvCUNfyq M8ugXP6wzjVpuyId9Z15aW2/tqJeu5mNHpufAH7MmPCM7N+TeI5g1nhZfiQzBstO x9WQmIOLf/G+q4C5DNuGV6c4KYhFVGkoPkZOZmMyn0ilEBSMj1gSMowJc4ZCOKYM +C/ZrwSLoho9Kv7KdJI4UmBxZjZUuqshdCJ8vpDJKcIPsd2YSv4s5y6Y5XZmVZp2 Fcb18WcMetbuvPPFUPoK5Yag9nL2bP6pQ4aVOSfdfSXvi6OocfByrBI/aR7WATV4 KhXPws4KmXB9BkXghyGFttFF3E8sZvGdcIGoP4ESsnwuw70iI2ig5qRjYCZg+42p 9TzKF3h2g2FBz3DHeoGFRcSQqTbKLRsNs1JKcHm+3lAkU7PrCNoTD18i1E9Dxd8+ 9w/Ahc7ufFF3z0bEo4dh =GEZz -END PGP SIGNATURE-
Re: [gentoo-dev] Git Migration: launch plan schedule (2015/Aug/08-09)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Am Donnerstag, 2. Juli 2015, 23:39:52 schrieb Robin H. Johnson: Hi all, The Git migration is moving forward, and I'd like to announce a tentative schedule for that end. https://wiki.gentoo.org/wiki/Project:Infrastructure/Git_migration#Status 2015/08/08 15:00 UTC - Freeze 2015/08/08 19:00 UTC - Git commits open for developers 2015/08/09 01:00 UTC - Rsync live again (with lagged changelog) 2015/08/11 - History repo available to graft 2015/08/12 - rsync mirrors carry up-to-date changelogs again I've allocated time for an 8 hour freeze, but hope to be completed much sooner than that. That's excellent news- thanks a lot for your work! - -- Andreas K. Huettel Gentoo Linux developer (council, perl, libreoffice) dilfri...@gentoo.org http://www.akhuettel.de/ -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIcBAEBCgAGBQJVlntdAAoJEB9VdM6hupKV6y8QAIT9Y7Qn0kTXezAsqs0lVyg2 V/urjQiCa0lVwxTyvTNe3vO075D4nCHSUM0VkR0MsBSESlDBboswMwRcBvUyw0jC g7v11t9R4yQKC59Tw7aZPkQRaTcWjOkEcICTQKr4pOf0hxLribwIbUHsWDtU4iOs fQK9XKdPnJNBFm7/j//Nodon6Ruez4Zv6jgYl2zDZbFJJzP0KykfBrH0/NNxwWXr jRze2B6P279znRhho3sEL6hAnlYFFxzJt8CjVq3k0RfF4rqxQiyOY7EkRzOsjyHd efj40dvsa9WwZR+hR2B0w8IZrUBlBoV0oUfoXlNlGgWs6hGVEXxG0FxY4uq6W1sL nok8Ny2MHT8p3Z0FMViy/PfLUD7udcP8qCf93EPYLoqGvZ8+QEz/9hJlmP0FQ9W3 agWmdUnFxA0q3SwAB6nLDxHozfE4bZXKVeXs8Y6gjk1A9MKOc+wo33dGmSAF04d1 vS+s7AqNwQRO9Uq7v2QhaB8T4NSkAM+Xp7X7KmhwaJDeEgM8Xz3bT0p8HP42zCEx X1mDVrkP+sCfCKrTti3CRdTfa7PgIi2qcnYYmVq7AVZWqqLQAcx+cxnPczsunuBt xDWIng5wjRHrBFP9/fywzeHfv7EC4x5PQWiovlMBvH9bnKLoPYFxttojY4EzvyBM UvqcO4hanUVjDxa13RJC =+TyC -END PGP SIGNATURE-
