[gentoo-dev] Packages masked for lack of maintainer, but metadata.xml says otherwise

[gentoo-dev] Packages masked for lack of maintainer, but metadata.xml says otherwise

[Chí-Thanh Christopher Nguyễn]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear all,

there have been a number of packages masked lately due to lack of
maintainer. However, their metadata.xml does not list
maintainer-needed@g.o which I think should be the first step in
searching for a new maintainer. (The last being mask and treecleaning.)

The problem with this is that it keeps them off the radar[1] and also
formally prevents them from getting treatment from proxy-maintainers
or sunrise projects.

Is there anything that speaks against making metadata.xml tell the
truth? At least the following packages are affected:

# Markos Chandras <hwoarang@gentoo.org> (02 Feb 2012)
# Multiple security bugs: 284356, 341085, 369137, 384243, 401993
# No maintainer. Removal in 30 days
www-apps/twiki

# Andreas K. Hüttel <dilfridge@gentoo.org> (27 Jan 2012)
# Has developed into an unmaintainable mess, and everyone who
# knows about it is either retired or missing in action.
# Several minor bugs and one ugly security issues (#386271).
# Masked for removal because of lack of maintainer.
# Please try app-text/epdfview as light-weight replacement.
app-text/xpdf

# Samuli Suominen <ssuominen@gentoo.org> (26 Jan 2012)
# No support for stable TIFF 4.x wrt #400925 with multiple
# other issues wrt #297150, #356083, #335864 and #318485.
# Version bump request been open since 2011-03-30 wrt #361187
# Unless fixed, removal in 30 days
<net-misc/hylafax-6.0.5
x11-misc/tkhylafax

# Jorge Manuel B. S. Vicetto <jmbsvicetto@gentoo.org> (22 Jan 2012)
# Mask compiz for last-rites unless someone steps up
# to maintain it. Removal in 30 days.
dev-python/compizconfig-python
x11-apps/ccsm
x11-apps/fusion-icon
x11-apps/simple-ccsm
x11-libs/compiz-bcop
x11-libs/compizconfig-backend-gconf
x11-libs/compizconfig-backend-kconfig4
x11-libs/libcompizconfig
x11-plugins/compiz-plugins-extra
x11-plugins/compiz-plugins-main
x11-plugins/compiz-plugins-unsupported
x11-themes/emerald-themes
x11-wm/compiz
x11-wm/compiz-fusion
x11-wm/emerald


Best regards,
Chí-Thanh Christopher Nguyễn

[1] http://www.gentoo.org/proj/en/qa/treecleaners/maintainer-needed.xml
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8rFJAACgkQ+gvH2voEPRCcMwCbBRMO2TbqtT1eOWci4y4F9U1j
3ZcAn3NZq2g4GOA/hKHR+OzpiQuSddff
=vuQu
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Packages masked for lack of maintainer, but metadata.xml says otherwise

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 02/02/2012 10:56 PM, Chí-Thanh Christopher Nguyễn wrote:
> Dear all,
> 
> there have been a number of packages masked lately due to lack of 
> maintainer. However, their metadata.xml does not list 
> maintainer-needed@g.o which I think should be the first step in 
> searching for a new maintainer. (The last being mask and
> treecleaning.)
> 
> The problem with this is that it keeps them off the radar[1] and
> also formally prevents them from getting treatment from
> proxy-maintainers or sunrise projects.
> 
> Is there anything that speaks against making metadata.xml tell the 
> truth? At least the following packages are affected: [...]
> 
> 
> Best regards, Chí-Thanh Christopher Nguyễn
> 
> [1]
> http://www.gentoo.org/proj/en/qa/treecleaners/maintainer-needed.xml
>
> 
Last rites in gentoo-dev-announce and gentoo-dev are better to draw
attention. Users who happen to have these packages installed, they
will see the message when they run emerge -uDN world and they will
hopefully step up and take over the package. Those you don't have it
installed will probably don't care so keeping it off the radar is
acceptable for them.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJPKxp3AAoJEPqDWhW0r/LCAs4P+gNxP945sbobxamzR/Bq9A9z
Vub/J9fLz1yTtCcwshonsAFVz/IeoQil7iCZNwaZ4ZdBwyudKWas+Mf0fN4pW8Au
vVnt6dwvZwYvnX2FxaUUQUjuyyUucyV7HnB/oFNsKO3XdUFJVDWF3rzMxP2ihsuC
ahvmFDEvV7ITLBG2SWKhbSxTdrXIURtT0VPkkspoGNq3THS6VkULpIQVQPt5VAll
m8+XXm7mdI5/EpUZm/NYNpCVzvNKsHLUrJdvMCI/aLfhOobbLpZY5U5yFGpF8yh3
NIfNiFHZE6bLH678lVISgClKRHSnlgf1+5DN3UM/XA5JaLvcw/pLMZgQhccbQCL8
Z6MIESH3NV6FJP3E0Fd3vaOY3r8CHIOHLW2oy63n6HeOeguhbIf81DmNEcSMmxpj
hReZCgO0dw9vurk+BqxMSGTYOmUic0DVDs+P1NI+R8uDFJrCPc9BZE7uVj2ftw6I
9oE2i2kDjKhYMAOkw64mYKbSbNf2EvqtdYzMkbQRI3ZoNea+oCmu78b6/JwoPfDz
KlkAso+x9kPnHwyRH3qNasNfGDHfoBlmv8EmSbcxjCEq/osd23dRwL6PE0gFB8wo
RnOaIQ1si29JDDwlxVQ5hAEepGva+RxSFM+Qu0e7pHwXc3ENBdpZMFf1kppYJhtc
lnC0wI3cqx31S5QghfJg
=LqG5
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Packages masked for lack of maintainer, but metadata.xml says otherwise

[Mike Frysinger]

[-- Attachment #1: Type: Text/Plain, Size: 443 bytes --]

On Thursday 02 February 2012 17:56:16 Chí-Thanh Christopher Nguyễn wrote:
> there have been a number of packages masked lately due to lack of
> maintainer. However, their metadata.xml does not list
> maintainer-needed@g.o which I think should be the first step in
> searching for a new maintainer.

if there is no <herd> and no <maintainer>, then "maintainer-needed@g.o" is 
implicit.  why do we need to explicitly list it ?
-mike

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [gentoo-dev] Packages masked for lack of maintainer, but metadata.xml says otherwise

[Chí-Thanh Christopher Nguyễn]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mike Frysinger schrieb:
> On Thursday 02 February 2012 17:56:16 Chí-Thanh Christopher Nguyễn
> wrote:
>> there have been a number of packages masked lately due to lack
>> of maintainer. However, their metadata.xml does not list 
>> maintainer-needed@g.o which I think should be the first step in 
>> searching for a new maintainer.
> 
> if there is no <herd> and no <maintainer>, then
> "maintainer-needed@g.o" is implicit.  why do we need to explicitly
> list it ? -mike

If that is the case, then removing would also be ok. But my point was
that the packages still had other maintainers listed.


Best regards,
Chí-Thanh Christopher Nguyễn

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8rNAsACgkQ+gvH2voEPRDbvACeKmIgmkscKmm4C4MbHMko90Bf
2+cAmwdjHK5IPzUF7ZDH4QvSSqRiZytE
=rfFY
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Packages masked for lack of maintainer, but metadata.xml says otherwise

[Samuli Suominen]

On 02/03/2012 03:10 AM, Chí-Thanh Christopher Nguyễn wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Mike Frysinger schrieb:
>> On Thursday 02 February 2012 17:56:16 Chí-Thanh Christopher Nguyễn
>> wrote:
>>> there have been a number of packages masked lately due to lack
>>> of maintainer. However, their metadata.xml does not list
>>> maintainer-needed@g.o which I think should be the first step in
>>> searching for a new maintainer.
>>
>> if there is no<herd>  and no<maintainer>, then
>> "maintainer-needed@g.o" is implicit.  why do we need to explicitly
>> list it ? -mike
>
> If that is the case, then removing would also be ok. But my point was
> that the packages still had other maintainers listed.

In hylafax's case, the package has been broken since the addition of 
tiff-4.0.0_beta5, which got added to tree "12 May 2010"

Both tiff and hylafax are with nerdboy as maintainer. At this point I've 
looked at the commitrate of said maintainer

With version bump request open from year ago

Now that tiff-4 is going stable, the breakage enters stable tree.

In the lastrite mail, I've sent the mail also directly to the 
maintainer, CCing him. I've never got any reply, and the bugs don't have 
any comment from the marked maintainer

Personally I hope someone who can also test the runtime, would commit 
hylafax+ instead of fixing hylafax to tree (bug 168890). Or both.

So it was really 2+2=4 which lead to this, all the things combined, 
case-by-case review, and I'm not sure the situation can even be 
reflected by the metadata.xml.
Except the maintainer could have removed himself from it, when he 
realized he doesn't have enough time or intrest for it

Overall I think the lastrites had the desired effect of causing enough 
buzz around it for other people to notice/get intrest to it

Re: [gentoo-dev] Packages masked for lack of maintainer, but metadata.xml says otherwise

[Alec Warner]

2012/2/2 Chí-Thanh Christopher Nguyễn <chithanh@gentoo.org>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Mike Frysinger schrieb:
>> On Thursday 02 February 2012 17:56:16 Chí-Thanh Christopher Nguyễn
>> wrote:
>>> there have been a number of packages masked lately due to lack
>>> of maintainer. However, their metadata.xml does not list
>>> maintainer-needed@g.o which I think should be the first step in
>>> searching for a new maintainer.
>>
>> if there is no <herd> and no <maintainer>, then
>> "maintainer-needed@g.o" is implicit.  why do we need to explicitly
>> list it ? -mike
>
> If that is the case, then removing would also be ok. But my point was
> that the packages still had other maintainers listed.

I want to avoid setting rules in stone. We are not correctly tooled,
trained, or have any kind of vigor for that sort of approach.
Metadata.xml is a useful guide to knowing who might care (have cared?)
about a package. It is not 100% accurate despite the efforts of the
developer community. When buggy software is buggy for months (nay,
years?) it is treecleaner policy to mask it. Casting about for
maintainers is sometimes useful. You see the undertakers do this often
when retiring individuals. That being said, the quickest way to get a
response from the community is to mask it and wait for someone who
cares to step up, ergo the policy to mask packages we cannot find time
to fix.

For reference, the list of developers who are listed as active but
have not committed anything in gentoo-x86 'recently' is around 95. I
am set to eventually retire 33 of them (still getting some bugs out of
the scripts.)

The entire list is (active) + (inactive) or (162) + (95). Obviously
not everyone in the inactive list is really inactive (the limit afaik
is 30d) but the point is that even if the metadata.xml lists someone
there is a 1 in 3 chance that they may not be following closely
anyway. Developers on devaway are a similar issue
(https://bugs.gentoo.org/show_bug.cgi?id=338829)

-A

>
>
> Best regards,
> Chí-Thanh Christopher Nguyễn
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.17 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk8rNAsACgkQ+gvH2voEPRDbvACeKmIgmkscKmm4C4MbHMko90Bf
> 2+cAmwdjHK5IPzUF7ZDH4QvSSqRiZytE
> =rfFY
> -----END PGP SIGNATURE-----
>