[gentoo-dev] Last rites: obsolete acct-* packages

[gentoo-dev] Last rites: obsolete acct-* packages

[Florian Schmaus]

[-- Attachment #1.1.1: Type: text/plain, Size: 1151 bytes --]

# Florian Schmaus <flow@gentoo.org> (2023-07-17)
# Obsolete acct-* packages which became leaf packages.
# Removal on 2023-08-17.
acct-user/artifactory
acct-group/artifactory
acct-user/cinder
acct-group/cinder
acct-user/glance
acct-group/glance
acct-user/heat
acct-group/heat
acct-user/keystone
acct-group/keystone
acct-user/litecoin
acct-group/litecoin
acct-user/logcheck
acct-group/logcheck
acct-user/minbif
acct-group/minbif
acct-user/minio
acct-group/minio
acct-user/netbox
acct-group/netbox
acct-user/neutron
acct-group/neutron
acct-user/nova
acct-group/nova
acct-user/placement
acct-group/placement
acct-user/quagga
acct-group/quagga
acct-user/rplayd
acct-group/rplayd
acct-user/rstudio-server
acct-group/rstudio-server
acct-user/rundeck
acct-group/rundeck
acct-user/sguil
acct-group/sguil
acct-user/sigh
acct-group/sigh
acct-user/smokeping
acct-group/smokeping
acct-user/sobby
acct-group/sobby
acct-user/spread
acct-group/spread
acct-user/stg
acct-group/stg
acct-user/swift
acct-group/swift
acct-user/thttpd
acct-group/thttpd
acct-group/gpio
acct-group/simplevirt
acct-group/spi

- Flow

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 17273 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

[gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Matt Turner]

On Mon, Jul 17, 2023 at 3:43 PM Florian Schmaus <flow@gentoo.org> wrote:
>
> # Florian Schmaus <flow@gentoo.org> (2023-07-17)
> # Obsolete acct-* packages which became leaf packages.
> # Removal on 2023-08-17.
> acct-user/artifactory
> acct-group/artifactory
> acct-user/cinder
> acct-group/cinder
> acct-user/glance
> acct-group/glance
> acct-user/heat
> acct-group/heat
> acct-user/keystone
> acct-group/keystone
> acct-user/litecoin
> acct-group/litecoin
> acct-user/logcheck
> acct-group/logcheck
> acct-user/minbif
> acct-group/minbif
> acct-user/minio
> acct-group/minio
> acct-user/netbox
> acct-group/netbox
> acct-user/neutron
> acct-group/neutron
> acct-user/nova
> acct-group/nova
> acct-user/placement
> acct-group/placement
> acct-user/quagga
> acct-group/quagga
> acct-user/rplayd
> acct-group/rplayd
> acct-user/rstudio-server
> acct-group/rstudio-server
> acct-user/rundeck
> acct-group/rundeck
> acct-user/sguil
> acct-group/sguil
> acct-user/sigh
> acct-group/sigh
> acct-user/smokeping
> acct-group/smokeping
> acct-user/sobby
> acct-group/sobby
> acct-user/spread
> acct-group/spread
> acct-user/stg
> acct-group/stg
> acct-user/swift
> acct-group/swift
> acct-user/thttpd
> acct-group/thttpd
> acct-group/gpio
> acct-group/simplevirt
> acct-group/spi

Haven't we been keeping these because we still need to decide on a
policy about what to do with dead acct-*/* packages?

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Sam James]

[-- Attachment #1: Type: text/plain, Size: 1883 bytes --]


Matt Turner <mattst88@gentoo.org> writes:

> On Mon, Jul 17, 2023 at 3:43 PM Florian Schmaus <flow@gentoo.org> wrote:
>>
>> # Florian Schmaus <flow@gentoo.org> (2023-07-17)
>> # Obsolete acct-* packages which became leaf packages.
>> # Removal on 2023-08-17.
>> acct-user/artifactory
>> acct-group/artifactory
>> acct-user/cinder
>> acct-group/cinder
>> acct-user/glance
>> acct-group/glance
>> acct-user/heat
>> acct-group/heat
>> acct-user/keystone
>> acct-group/keystone
>> acct-user/litecoin
>> acct-group/litecoin
>> acct-user/logcheck
>> acct-group/logcheck
>> acct-user/minbif
>> acct-group/minbif
>> acct-user/minio
>> acct-group/minio
>> acct-user/netbox
>> acct-group/netbox
>> acct-user/neutron
>> acct-group/neutron
>> acct-user/nova
>> acct-group/nova
>> acct-user/placement
>> acct-group/placement
>> acct-user/quagga
>> acct-group/quagga
>> acct-user/rplayd
>> acct-group/rplayd
>> acct-user/rstudio-server
>> acct-group/rstudio-server
>> acct-user/rundeck
>> acct-group/rundeck
>> acct-user/sguil
>> acct-group/sguil
>> acct-user/sigh
>> acct-group/sigh
>> acct-user/smokeping
>> acct-group/smokeping
>> acct-user/sobby
>> acct-group/sobby
>> acct-user/spread
>> acct-group/spread
>> acct-user/stg
>> acct-group/stg
>> acct-user/swift
>> acct-group/swift
>> acct-user/thttpd
>> acct-group/thttpd
>> acct-group/gpio
>> acct-group/simplevirt
>> acct-group/spi
>
> Haven't we been keeping these because we still need to decide on a
> policy about what to do with dead acct-*/* packages?

Right. https://bugs.gentoo.org/781881 is still open. Flow could ping
the QA team and ask if it should be closed, given the opinion there
seems to be that there's no need to keep them, but I think it's wrong
to do this pre-empting a policy decision, given it essentially forces
the "don't keep them" path.



[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 377 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Mike Gilbert]

On Mon, Jul 17, 2023 at 4:27 PM Sam James <sam@gentoo.org> wrote:
> > Haven't we been keeping these because we still need to decide on a
> > policy about what to do with dead acct-*/* packages?
>
> Right. https://bugs.gentoo.org/781881 is still open. Flow could ping
> the QA team and ask if it should be closed, given the opinion there
> seems to be that there's no need to keep them, but I think it's wrong
> to do this pre-empting a policy decision, given it essentially forces
> the "don't keep them" path.

The bug has been open for several months without comment. If a policy
were going to materialize, I think it would have happened by now.

Forcing the issue by sending this last rites notice seems acceptable to me.

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1056 bytes --]

>>>>> On Mon, 17 Jul 2023, Mike Gilbert wrote:

> On Mon, Jul 17, 2023 at 4:27 PM Sam James <sam@gentoo.org> wrote:
>> > Haven't we been keeping these because we still need to decide on a
>> > policy about what to do with dead acct-*/* packages?
>> 
>> Right. https://bugs.gentoo.org/781881 is still open. Flow could ping
>> the QA team and ask if it should be closed, given the opinion there
>> seems to be that there's no need to keep them, but I think it's wrong
>> to do this pre-empting a policy decision, given it essentially forces
>> the "don't keep them" path.

> The bug has been open for several months without comment. If a policy
> were going to materialize, I think it would have happened by now.

> Forcing the issue by sending this last rites notice seems acceptable
> to me.

I'd say we remove the packages, because system user and group ids are
a somewhat scarce resource.

The ids in uid-gid.txt (in data/api.git) need to be updated as well,
i.e. they should be kept for now but changed to historical.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Pacho Ramos]

[-- Attachment #1: Type: text/plain, Size: 1120 bytes --]

El jue, 01-01-1970 a las 00:00 +0000, Ulrich Mueller escribió:
> > > > > > On Mon, 17 Jul 2023, Mike Gilbert wrote:
> 
> > On Mon, Jul 17, 2023 at 4:27 PM Sam James <sam@gentoo.org> wrote:
> > > > Haven't we been keeping these because we still need to decide
> > > > on a
> > > > policy about what to do with dead acct-*/* packages?
> > > 
> > > Right. https://bugs.gentoo.org/781881 is still open. Flow could
> > > ping
> > > the QA team and ask if it should be closed, given the opinion
> > > there
> > > seems to be that there's no need to keep them, but I think it's
> > > wrong
> > > to do this pre-empting a policy decision, given it essentially
> > > forces
> > > the "don't keep them" path.
> 
> > The bug has been open for several months without comment. If a
> > policy
> > were going to materialize, I think it would have happened by now.
> 
> > Forcing the issue by sending this last rites notice seems
> > acceptable
> > to me.
> 
> I'd say we remove the packages, because system user and group ids are
> a somewhat scarce resource.

I agree because of the same reasons 


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Зураб Квачадзе]

[-- Attachment #1: Type: text/plain, Size: 1720 bytes --]

How do we handle this case, then.
Imagine we have a leaf package acct-user/foo, which has a reserved UID of
123. It gets last rited and its entry is removed from uid-gid.txt. After a
while appears a new package acct-user/bar, which takes the 123 UID. Then a
user, say Bob, updates their system, which haven't been updated for some
time. What if they still have acct-user/foo, when acct-user/bar with the
same UID is installed? Should we even care about such cases?

On Tue, 18 Jul 2023 at 11:22 Pacho Ramos <pacho@gentoo.org> wrote:

> El jue, 01-01-1970 a las 00:00 +0000, Ulrich Mueller escribió:
> > > > > > > On Mon, 17 Jul 2023, Mike Gilbert wrote:
> >
> > > On Mon, Jul 17, 2023 at 4:27 PM Sam James <sam@gentoo.org> wrote:
> > > > > Haven't we been keeping these because we still need to decide
> > > > > on a
> > > > > policy about what to do with dead acct-*/* packages?
> > > >
> > > > Right. https://bugs.gentoo.org/781881 is still open. Flow could
> > > > ping
> > > > the QA team and ask if it should be closed, given the opinion
> > > > there
> > > > seems to be that there's no need to keep them, but I think it's
> > > > wrong
> > > > to do this pre-empting a policy decision, given it essentially
> > > > forces
> > > > the "don't keep them" path.
> >
> > > The bug has been open for several months without comment. If a
> > > policy
> > > were going to materialize, I think it would have happened by now.
> >
> > > Forcing the issue by sending this last rites notice seems
> > > acceptable
> > > to me.
> >
> > I'd say we remove the packages, because system user and group ids are
> > a somewhat scarce resource.
>
> I agree because of the same reasons
>
>

[-- Attachment #2: Type: text/html, Size: 2503 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Florian Schmaus]

[-- Attachment #1.1.1: Type: text/plain, Size: 824 bytes --]

On 18/07/2023 10.42, Зураб Квачадзе wrote:
> How do we handle this case, then.
> Imagine we have a leaf package acct-user/foo, which has a reserved UID 
> of 123. It gets last rited and its entry is removed from uid-gid.txt.

Nobody is proposing that the uid-gid.txt entry is removed. Ideally, it 
would be marked as 'historical', together with the date it went historical.


> After a while appears a new package acct-user/bar, which takes the 123 
> UID. Then a user, say Bob, updates their system, which haven't been 
> updated for some time. What if they still have acct-user/foo, when > acct-user/bar with the same UID is installed?

If a UID/GID is in use, then acct-*.eclass will find the next suitable 
ID (unless, e.g. ACCT_USER_ENFORCE_ID is set, we is usually not the case).

- Flow

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 17273 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Зураб Квачадзе]

[-- Attachment #1: Type: text/plain, Size: 990 bytes --]

Well, this configuration is reasonable, I am for the change

On Tue, 18 Jul 2023 at 11:55 Florian Schmaus <flow@gentoo.org> wrote:

> On 18/07/2023 10.42, Зураб Квачадзе wrote:
> > How do we handle this case, then.
> > Imagine we have a leaf package acct-user/foo, which has a reserved UID
> > of 123. It gets last rited and its entry is removed from uid-gid.txt.
>
> Nobody is proposing that the uid-gid.txt entry is removed. Ideally, it
> would be marked as 'historical', together with the date it went historical.
>
>
> > After a while appears a new package acct-user/bar, which takes the 123
> > UID. Then a user, say Bob, updates their system, which haven't been
> > updated for some time. What if they still have acct-user/foo, when >
> acct-user/bar with the same UID is installed?
>
> If a UID/GID is in use, then acct-*.eclass will find the next suitable
> ID (unless, e.g. ACCT_USER_ENFORCE_ID is set, we is usually not the case).
>
> - Flow
>

[-- Attachment #2: Type: text/html, Size: 1386 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Fabian Groffen]

[-- Attachment #1: Type: text/plain, Size: 751 bytes --]

On 18-07-2023 11:42:39 +0300, Зураб Квачадзе wrote:
> How do we handle this case, then.
> Imagine we have a leaf package acct-user/foo, which has a reserved UID of 123.
> It gets last rited and its entry is removed from uid-gid.txt. After a while
> appears a new package acct-user/bar, which takes the 123 UID. Then a user, say
> Bob, updates their system, which haven't been updated for some time. What if
> they still have acct-user/foo, when acct-user/bar with the same UID is
> installed? Should we even care about such cases?

IMO we should, thus 123 should not be removed from uid-gid.txt, and instead
be marked as reserved or something with a date.

Thanks,
Fabian

-- 
Fabian Groffen
Gentoo on a different level

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Sam James]

[-- Attachment #1: Type: text/plain, Size: 887 bytes --]


Mike Gilbert <floppym@gentoo.org> writes:

> On Mon, Jul 17, 2023 at 4:27 PM Sam James <sam@gentoo.org> wrote:
>> > Haven't we been keeping these because we still need to decide on a
>> > policy about what to do with dead acct-*/* packages?
>>
>> Right. https://bugs.gentoo.org/781881 is still open. Flow could ping
>> the QA team and ask if it should be closed, given the opinion there
>> seems to be that there's no need to keep them, but I think it's wrong
>> to do this pre-empting a policy decision, given it essentially forces
>> the "don't keep them" path.
>
> The bug has been open for several months without comment. If a policy
> were going to materialize, I think it would have happened by now.
>
> Forcing the issue by sending this last rites notice seems acceptable to me.

Pinging someone rather than "forcing the issue" as a first-step is customary.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 377 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Florian Schmaus]

[-- Attachment #1.1.1: Type: text/plain, Size: 2306 bytes --]

On 18/07/2023 11.56, Sam James wrote:
> 
> Mike Gilbert <floppym@gentoo.org> writes:
> 
>> On Mon, Jul 17, 2023 at 4:27 PM Sam James <sam@gentoo.org> wrote:
>>>> Haven't we been keeping these because we still need to decide on a
>>>> policy about what to do with dead acct-*/* packages?
>>>
>>> Right. https://bugs.gentoo.org/781881 is still open. Flow could ping
>>> the QA team and ask if it should be closed, given the opinion there
>>> seems to be that there's no need to keep them, but I think it's wrong
>>> to do this pre-empting a policy decision, given it essentially forces
>>> the "don't keep them" path.
>>
>> The bug has been open for several months without comment. If a policy
>> were going to materialize, I think it would have happened by now.
>>
>> Forcing the issue by sending this last rites notice seems acceptable to me.
> 
> Pinging someone rather than "forcing the issue" as a first-step is customary.

I am sorry, but it seems that I have to clarify something.

First, I have "pinged someone."

As of writing this, I was the last to comment on the QA bug about five 
months ago, asking why we would want to keep unused acct-* packages [1]. 
Since then, this has not been answered, and there have been zero other 
replies. That signaled me that there was no interest in pursuing the 
matter further. In addition, we have already removed acct-* packages in 
the past.

Secondly, nobody immediately forces anything.

The removal date for the acct-* packages is one month from now. One 
month is hopefully enough time to decide whether we want such a policy.


Sam, I am afraid, but I believe that the situation is different from how 
you frame it.


The proponents of keeping obsolete acct-* packages have the inventive to 
establish their preferred policy.

Accusing me of not facilitating a QA bug that deals with establishing a 
policy I do not favor seems unfair.

Do you think that a QA bug that has not seen progress in nearly five 
months should be able to establish an illegitimate shadow policy?

Currently, acct-* packages are governed by our current policy regarding 
package removal. If we decide to change this, we can also revert the 
acct-* package removals.

- Flow


1: https://bugs.gentoo.org/781881#c7


[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 17273 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Sam James]

[-- Attachment #1: Type: text/plain, Size: 2896 bytes --]


Florian Schmaus <flow@gentoo.org> writes:

> [[PGP Signed Part:Undecided]]
> On 18/07/2023 11.56, Sam James wrote:
>> Mike Gilbert <floppym@gentoo.org> writes:
>> 
>>> On Mon, Jul 17, 2023 at 4:27 PM Sam James <sam@gentoo.org> wrote:
>>>>> Haven't we been keeping these because we still need to decide on a
>>>>> policy about what to do with dead acct-*/* packages?
>>>>
>>>> Right. https://bugs.gentoo.org/781881 is still open. Flow could ping
>>>> the QA team and ask if it should be closed, given the opinion there
>>>> seems to be that there's no need to keep them, but I think it's wrong
>>>> to do this pre-empting a policy decision, given it essentially forces
>>>> the "don't keep them" path.
>>>
>>> The bug has been open for several months without comment. If a policy
>>> were going to materialize, I think it would have happened by now.
>>>
>>> Forcing the issue by sending this last rites notice seems acceptable to me.
>> Pinging someone rather than "forcing the issue" as a first-step is
>> customary.
>
> I am sorry, but it seems that I have to clarify something.
>
> First, I have "pinged someone."

Ping on IRC (in #gentoo-qa, or could PM me), or again on the bug?

Someone asked the QA team to make a decision. We haven't yet, as I'd
forgot about it. It seems wrong to then just pretend that didn't happen.

At least try to get it resolved on that end by pinging again / asking us?

>
> As of writing this, I was the last to comment on the QA bug about five
> months ago, asking why we would want to keep unused acct-* packages
> [1]. Since then, this has not been answered, and there have been zero
> other replies. That signaled me that there was no interest in pursuing
> the matter further. In addition, we have already removed acct-*
> packages in the past.
>

I'm sorry that somebody missed a ping in a FOSS project. But this is
probably not the first time it's happened to you.

> Secondly, nobody immediately forces anything.
>

I'm saying that speaking to someone works better than committing
something and then asking for discussion.

> Sam, I am afraid, but I believe that the situation is different from
> how you frame it.
>
>
> The proponents of keeping obsolete acct-* packages have the inventive
> to establish their preferred policy.

It's a bit aggressive to take action, without pinging before doing so
(you did several months ago, that's not really the same thing), to
"incentivise" someone. 

>
> Accusing me of not facilitating a QA bug that deals with establishing
> a policy I do not favor seems unfair.
>

I'm not sure I'm doing that. I'm saying that doing this preempts a
decision and that a ping would've been polite.

> Do you think that a QA bug that has not seen progress in nearly five
> months should be able to establish an illegitimate shadow policy?
>

Come on.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 377 bytes --]

Re: [gentoo-dev] Re: [gentoo-dev-announce] Last rites: obsolete acct-* packages

[Sam James]

[-- Attachment #1: Type: text/plain, Size: 1959 bytes --]


Sam James <sam@gentoo.org> writes:

> [[PGP Signed Part:Undecided]]
>
> Florian Schmaus <flow@gentoo.org> writes:
>
>> [[PGP Signed Part:Undecided]]
>> On 18/07/2023 11.56, Sam James wrote:
>>> Mike Gilbert <floppym@gentoo.org> writes:
>>> 
>>>> On Mon, Jul 17, 2023 at 4:27 PM Sam James <sam@gentoo.org> wrote:
>>>>>> Haven't we been keeping these because we still need to decide on a
>>>>>> policy about what to do with dead acct-*/* packages?
>>>>>
>>>>> Right. https://bugs.gentoo.org/781881 is still open. Flow could ping
>>>>> the QA team and ask if it should be closed, given the opinion there
>>>>> seems to be that there's no need to keep them, but I think it's wrong
>>>>> to do this pre-empting a policy decision, given it essentially forces
>>>>> the "don't keep them" path.
>>>>
>>>> The bug has been open for several months without comment. If a policy
>>>> were going to materialize, I think it would have happened by now.
>>>>
>>>> Forcing the issue by sending this last rites notice seems acceptable to me.
>>> Pinging someone rather than "forcing the issue" as a first-step is
>>> customary.
>>
>> I am sorry, but it seems that I have to clarify something.
>>
>> First, I have "pinged someone."
>
> Ping on IRC (in #gentoo-qa, or could PM me), or again on the bug?
>
> Someone asked the QA team to make a decision. We haven't yet, as I'd
> forgot about it. It seems wrong to then just pretend that didn't happen.
>
> At least try to get it resolved on that end by pinging again / asking us?

Just to be super duper clear: it's fine with me if we just move on and
don't keep the packages, but I think a quick /msg #gentoo-qa "hey guys,
nothing seems to be happening with the bug, do you mind if we just close
it?" wouldn't have gone amiss.

That is _all_ I'm asking for here.

And then when we get onto talk of "incentives" and "illegitimate shadow
policies", I become very confused indeed.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 377 bytes --]