[gentoo-dev] Lastrite: media-gfx/pngcrush

[gentoo-dev] Lastrite: media-gfx/pngcrush

[Samuli Suominen]

# Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011)
# Fails to compile against system libpng15, bug 356127
# Removal in 14 days
media-gfx/pngcrush

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Matt Turner]

On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen <ssuominen@gentoo.org> wrote:
> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011)
> # Fails to compile against system libpng15, bug 356127
> # Removal in 14 days

14 days?

> media-gfx/pngcrush

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Samuli Suominen]

On 10/08/2011 04:19 PM, Matt Turner wrote:
> On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen <ssuominen@gentoo.org> wrote:
>> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011)
>> # Fails to compile against system libpng15, bug 356127
>> # Removal in 14 days
> 
> 14 days?

approx. 14 days and counting to CC archteams in the libpng15
stabilization bug.

the same day the tree is fully prepared for it.
the same day amd64 moves it to stable.

should come as no suprise to anyone at this point...

> 
>> media-gfx/pngcrush
> 

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/08/2011 02:19 PM, Matt Turner wrote:
> On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen
> <ssuominen@gentoo.org> wrote:
>> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011) # Fails to
>> compile against system libpng15, bug 356127 # Removal in 14 days
> 
> 14 days?
> 
>> media-gfx/pngcrush
> 
We can't really wait forever for slacking maintainers to fix their
packages. amd64 is almost ready to have libpng-1.5 stable in the very
near future

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOkFxIAAoJEPqDWhW0r/LCDf4P/jPUyoxorEdg6dxl9PfHMvZw
tmSICvBsqqcd0QRAJ77UKUqoiS/QrPdu/JSvSjJul7wxl86CYoNtgUKF1vYPhxOb
akWxBQxkxHdGjWLQl8ScfueW0eMemMaXaM3dV9ZTCPj8Y0jVS9+SMfTbQXjflZ+N
7A0QPoW0Y8/U8wKjqFyS2HhR1s6KnGYKzoPXb2PdyEWG1CJ9d2iK+RGUNoVEBzxs
HaE3pe7lMkboERhKd2U1grrGDUnsGvJyn6mHo1Q7Jz28eZ3V/tFrYEN9n3AgqYj4
ANvYtUZwdSXeRnp6JxrSUJGo6yqtwVYc2td/V0+x3hxt2gzhyq31ji4kRBq/8jQ2
ZrQ6DKz6aiWLnZS6Oouv5tUr5HPg+qMdNjoOFUz5CxwrfaESQyBS9QxYYhUU3gPh
fF/KZjnkxWx7WTddqBuawqn08KdY0BMIdPvXZZFG2At2ftOlv+ItMSPPRLJfF/ee
ew5SYw0HHa37vYTx30rgS/YfrrWKhpdvvNSw94VYfN1YHgSZmqrLQhooJxbt+q3h
sZWc3L7N9LADZ1ZdqHrrHUZfICCt0JkwlR2TXQ247M06ajPbJu3Vl5EKCR1XGJ+L
DfCFJ72ZriMNvgipfvjUAb4G2FzrEu/5Tt3LEhBC8Zj9Hpnt1ia8lJSasnwnhVzW
TtTkXrCoZlaK9Djri5AD
=4gEc
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Fabian Groffen]

[-- Attachment #1: Type: text/plain, Size: 744 bytes --]

On 08-10-2011 15:20:56 +0100, Markos Chandras wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> On 10/08/2011 02:19 PM, Matt Turner wrote:
> > On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen
> > <ssuominen@gentoo.org> wrote:
> >> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011) # Fails to
> >> compile against system libpng15, bug 356127 # Removal in 14 days
> > 
> > 14 days?
> > 
> >> media-gfx/pngcrush
> > 
> We can't really wait forever for slacking maintainers to fix their
> packages. amd64 is almost ready to have libpng-1.5 stable in the very
> near future

http://www.gentoo.org/proj/en/devrel/handbook/handbook.xml?part=2&chap=5#doc_chap8


-- 
Fabian Groffen
Gentoo on a different level

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/08/2011 03:28 PM, Fabian Groffen wrote:
> On 08-10-2011 15:20:56 +0100, Markos Chandras wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
>> 
>> On 10/08/2011 02:19 PM, Matt Turner wrote:
>>> On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen 
>>> <ssuominen@gentoo.org> wrote:
>>>> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011) #
>>>> Fails to compile against system libpng15, bug 356127 #
>>>> Removal in 14 days
>>> 
>>> 14 days?
>>> 
>>>> media-gfx/pngcrush
>>> 
>> We can't really wait forever for slacking maintainers to fix
>> their packages. amd64 is almost ready to have libpng-1.5 stable
>> in the very near future
> 
> http://www.gentoo.org/proj/en/devrel/handbook/handbook.xml?part=2&chap=5#doc_chap8
>
> 
> 
In fact, like Samuli said, the waiting period is 14+<days for ATs to
test is an become stable> which will be more than 30. No reason to
s/14/30/

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOkGLcAAoJEPqDWhW0r/LCHMsP/0bxRFzewgqT3flQExvYvZit
gatc9T++QoOBTmaJORpWgMWcthzhOSuugjC+LSWP5w9v8wPW7wy2jYwKRVHKJ3iY
Zk88aGxSCEp8K39WlG2PYurZMySfM7i+pd8iOgknyJUMNY4Rx2tMpkeWWL6BuwXl
P6BtfyvCWWg32s3yO8GhejYTZsVhjo2w7ECac3VaieDWeEi8qm+PflN86y3y3+x/
AvmS8G2PiK4sEIzZPpVpD43dpVtwnimMXcnpmn7aDtvpXSRr3DqYZsK7BDu2xUWU
P945Y3X0exxdEniy3c8UiGDERb6z1AdqLInEdejQoAqDAiHrozCoYvNcYhSoCcaK
cdg+N1Q55Y/cCGmi+dh6vGwYzKIt4x8O6Zb/pYFORO9Gp5cRjS5KJSu/pnG1xK2F
N+uCGCDzg9ruylWFsflr4yhBuXoLgFc7bJP0WimsLBPgxYhr1YXHYzV2PRwnar2U
BhGZf7NclaJIm2zlqLt5CxSBxJ958rpKURLmlT5Wtv7VX8yWtOJxPqWkd48rDIHu
wkH4PlK8+J3yI0u9eiMbuE1LwVg1eiafI75weJXIh1Yejifli1i5TilNiLtnAgya
5/pATeYQTHAaa3SnCdHuv0lK1Jm+7v+jCK51vy87Wfq/Eu5hIXP+yT6BVCl8m0Mx
l0TX+wu9gRoBMCrCfe7R
=0SYw
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Fabian Groffen]

[-- Attachment #1: Type: text/plain, Size: 599 bytes --]

On 08-10-2011 15:49:00 +0100, Markos Chandras wrote:
> >> We can't really wait forever for slacking maintainers to fix
> >> their packages. amd64 is almost ready to have libpng-1.5 stable
> >> in the very near future
> > 
> > http://www.gentoo.org/proj/en/devrel/handbook/handbook.xml?part=2&chap=5#doc_chap8
> >
> In fact, like Samuli said, the waiting period is 14+<days for ATs to
> test is an become stable> which will be more than 30. No reason to
> s/14/30/

No reason then to confuse people by suggesting the opposite either.


-- 
Fabian Groffen
Gentoo on a different level

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Rich Freeman]

On Sat, Oct 8, 2011 at 10:20 AM, Markos Chandras <hwoarang@gentoo.org> wrote:
> On 10/08/2011 02:19 PM, Matt Turner wrote:
>> 14 days?
> We can't really wait forever for slacking maintainers to fix their
> packages. amd64 is almost ready to have libpng-1.5 stable in the very
> near future
>

Didn't we just do this thread a few days ago?  :)

Matt - will an extra 16 days make any difference?  This bug has been
open since Feb.  Will something happen in 30 days that won't happen in
14?

Next, time, though posting an "FYI - we're masking blockers on Oct
7th" or whatever would probably make some happier.

If the extra 16 days will actually accomplish something beyond just
delaying libpng then we can debate the finer points of policy.
However, if we're just arguing policy for its own sake then I don't
see the value.  Perhaps a package maintainer might have the "right" to
a few weeks to fix things, but in the end you have to put the distro
and its users first.  You can do that either by speaking up or
standing aside, but if you're going to speak up, then make sure you
can follow through.

Rich

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Fabian Groffen]

[-- Attachment #1: Type: text/plain, Size: 881 bytes --]

On 08-10-2011 11:05:08 -0400, Rich Freeman wrote:
> If the extra 16 days will actually accomplish something beyond just
> delaying libpng then we can debate the finer points of policy.
> However, if we're just arguing policy for its own sake then I don't
> see the value.  Perhaps a package maintainer might have the "right" to
> a few weeks to fix things, but in the end you have to put the distro
> and its users first.  You can do that either by speaking up or
> standing aside, but if you're going to speak up, then make sure you
> can follow through.

It seems to me like you say here that any policy that Gentoo has that
you just don't like can be ignored because, well, you just don't like
it.
We can discuss whether or not the policy is ok, but should we ignore the
policy for that reason?  I think not.


-- 
Fabian Groffen
Gentoo on a different level

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Tomáš Chvátal]

Guys,
the policy makes perfect sense, there are people that sync just
monthly, so they might want to get some headsup why their packages are
going away, and not just remove them.

Thats why the recommended value is 60 days, 30 for urgent cases,
lately we just moved to 30 for everything, but please stick with that,
do not make it lower.

This is not about waiting for maintainer, or slowing up distro, but
letting our users to catch up with what we do.

As a side note masked packages CAN be broken, so the stab can proceed
from the point you mask all the broken ones.

Tom

[gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Duncan]

Tomáš Chvátal posted on Sat, 08 Oct 2011 17:29:52 +0200 as excerpted:

> Guys,
> the policy makes perfect sense, there are people that sync just monthly,
> so they might want to get some headsup why their packages are going
> away, and not just remove them.
> 
> Thats why the recommended value is 60 days, 30 for urgent cases, lately
> we just moved to 30 for everything, but please stick with that,
> do not make it lower.
> 
> This is not about waiting for maintainer, or slowing up distro, but
> letting our users to catch up with what we do.
> 
> As a side note masked packages CAN be broken, so the stab can proceed
> from the point you mask all the broken ones.

++

Mask it now, do the libpng thing in 14 days (or even sooner if all to-be-
broken packages are masked), but leave the masked packages for the full 
30 days as the policy states.

Libpng isn't held up that way, while the package still gets its 30 day 
masking last-rites.  No policy broken; no maintainer toes stepped on as a 
result of the broken policy.  No more nasty threads about (this) broken 
policy and unhappy maintainers as a result! =:^)

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Chí-Thanh Christopher Nguyễn]

Duncan schrieb:
> Libpng isn't held up that way, while the package still gets its 30 day 
> masking last-rites.  No policy broken; no maintainer toes stepped on as a 
> result of the broken policy.  No more nasty threads about (this) broken 
> policy and unhappy maintainers as a result! =:^)

Actually removing a package that doesn't violate any (written) rules
without maintainer consensus could be considered a violation of policy too.

http://www.gentoo.org/proj/en/devrel/recruiters/mentor.xml
Respect existing maintainers:
Never commit when someone else has clear ownership. Never commit on
things with unclear ownership until you've tried to clear it up.


Best regards,
Chí-Thanh Christopher Nguyễn

[gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Duncan]

Chí-Thanh Christopher Nguyễn posted on Sun, 09 Oct 2011 18:37:59 +0200 as
excerpted:

> Duncan schrieb:
>> Libpng isn't held up that way, while the package still gets its 30 day
>> masking last-rites.  No policy broken; no maintainer toes stepped on as
>> a result of the broken policy.  No more nasty threads about (this)
>> broken policy and unhappy maintainers as a result! =:^)
> 
> Actually removing a package that doesn't violate any (written) rules
> without maintainer consensus could be considered a violation of policy
> too.
> 
> http://www.gentoo.org/proj/en/devrel/recruiters/mentor.xml Respect
> existing maintainers:
> Never commit when someone else has clear ownership. Never commit on
> things with unclear ownership until you've tried to clear it up.

You are correct, but AFAIK, that's one function of tree-cleaners (whether 
or not the remover is actually on the tree-cleaner team), when packages 
are broken due to going stale against current, and the bugs reporting the 
problem remain open for months without (visible) movement (there's some 
movement here, yes, but was it visible?).

That's actually why the 30-day mask is so important and it's so 
distressing to see people trying to cut it short.  Masking has a way of 
waking people (maintainers and others) up if they actually use the 
package, and gives a chance for reprieve.

But if that 30-day-mask time is cut short, it really does throw a wrench 
into things due to interactions with "p-space" (physical-space), like 
vacations, etc, especially considering that Gentoo is volunteers.  Coming 
back from a vacation to see that one's package has been removed and the 
30-day-mask-time cut short so it all happened while one was on (2-week) 
vacation is a rude thing indeed to have happen, and maintainers *should* 
be complaining!  I'd be raising holy cow! (... tho with council and on 
-core as appropriate, the making of the sausage wouldn't /all/ have to be 
in the open!)

So, please, at LEAST honor the 30-day-in-mask bit.  And if someone steps 
up to rescue during that time, let's give them some time to do so.  One 
can /hope/ both sides will be reasonable here and if something's removed 
in an untimely manner, or even at the end of the 30 days if the timing 
simply worked out badly and the person couldn't get to it until day 31 or 
35, it can be returned but kept in a masked state for another month or 
two, if necessary, without having to further nail down in written policy 
that end of things, but right now, we're not even getting to that point.  
Let's at least let the established policy work the way it was intended, 
giving someone time to step up and do the rescue.

Meanwhile, once the package is masked, don't let it hold up the normal 
update process with other packages. (Tho ideally there's cooperation in 
this aspect as well, but again, we're not even getting to the point where 
that's an issue.  Right now, existing written policies are being violated 
for questionable-at-best reasons; obviously if something's discovered to 
have been back-doored or the like, that would be rather beyond 
"questionable-at-best"!  But of course that'd be security not "just"
tree-cleaners/qa.)

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Peter Volkov]

В Вск, 09/10/2011 в 22:28 +0000, Duncan пишет:
> Chí-Thanh Christopher Nguyễn posted on Sun, 09 Oct 2011 18:37:59 +0200 as
> excerpted:
> 
> > Duncan schrieb:
> >> Libpng isn't held up that way, while the package still gets its 30 day
> >> masking last-rites.  No policy broken; no maintainer toes stepped on as
> >> a result of the broken policy.  No more nasty threads about (this)
> >> broken policy and unhappy maintainers as a result! =:^)
> > 
> > Actually removing a package that doesn't violate any (written) rules
> > without maintainer consensus could be considered a violation of policy
> > too.
> > 
> > http://www.gentoo.org/proj/en/devrel/recruiters/mentor.xml Respect
> > existing maintainers:
> > Never commit when someone else has clear ownership. Never commit on
> > things with unclear ownership until you've tried to clear it up.

Samuli pretends here to act as a part of QA team (although he is not).
Actually even whiteboard of stabilization bug tells #at _earliest_ 17
Oct" and thus there is really no sign for rush. This is the case where
QA should voice and either explain why fast stabilization of libpng is
so important or stop policy breakage. That said it became really common
to break our own policies (with no attempts to amend policy).

> You are correct, but AFAIK, that's one function of tree-cleaners (whether 
> or not the remover is actually on the tree-cleaner team), when packages 
> are broken due to going stale against current, and the bugs reporting the 
> problem remain open for months without (visible) movement (there's some 
> movement here, yes, but was it visible?).

No treecleaners are supposed to be working on maintainer-needed packages
only:
http://www.gentoo.org/proj/en/qa/treecleaners/index.xml

> So, please, at LEAST honor the 30-day-in-mask bit.  

This must be honored.

--
Peter.

[gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Duncan]

Peter Volkov posted on Tue, 11 Oct 2011 09:38:43 +0400 as excerpted:

>> You are correct, but AFAIK, that's one function of tree-cleaners
>> (whether or not the remover is actually on the tree-cleaner team), when
>> packages are broken due to going stale against current, and the bugs
>> reporting the problem remain open for months without (visible) movement
>> (there's some movement here, yes, but was it visible?).
> 
> No treecleaners are supposed to be working on maintainer-needed packages
> only:
> http://www.gentoo.org/proj/en/qa/treecleaners/index.xml

Thanks for the clarification.  I had QA/Treecleaners lumped together 
somewhat in this regard and appreciate being straightened out. =:^)

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Samuli Suominen]

On 10/11/2011 08:38 AM, Peter Volkov wrote:
> В Вск, 09/10/2011 в 22:28 +0000, Duncan пишет:
>> Chí-Thanh Christopher Nguyễn posted on Sun, 09 Oct 2011 18:37:59 +0200 as
>> excerpted:
>>
>>> Duncan schrieb:
>>>> Libpng isn't held up that way, while the package still gets its 30 day
>>>> masking last-rites.  No policy broken; no maintainer toes stepped on as
>>>> a result of the broken policy.  No more nasty threads about (this)
>>>> broken policy and unhappy maintainers as a result! =:^)
>>>
>>> Actually removing a package that doesn't violate any (written) rules
>>> without maintainer consensus could be considered a violation of policy
>>> too.
>>>
>>> http://www.gentoo.org/proj/en/devrel/recruiters/mentor.xml Respect
>>> existing maintainers:
>>> Never commit when someone else has clear ownership. Never commit on
>>> things with unclear ownership until you've tried to clear it up.
> 
> Samuli pretends here to act as a part of QA team (although he is not).
> Actually even whiteboard of stabilization bug tells #at _earliest_ 17
> Oct" and thus there is really no sign for rush. This is the case where
> QA should voice and either explain why fast stabilization of libpng is
> so important or stop policy breakage. That said it became really common
> to break our own policies (with no attempts to amend policy).

full stop.

you are forcing me to bisect the history of pngcrush.

in 2007, I grab the package from no-herd:

http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/media-gfx/pngcrush/metadata.xml?r1=1.1&r2=1.2

then I version bump it and give it to graphics herd to which I'm a team
member of:

http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/media-gfx/pngcrush/metadata.xml?r1=1.3&r2=1.4

at this point everything was still fine.

http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/media-gfx/pngcrush/metadata.xml?r1=1.4&r2=1.5

mattst88, NOT member of graphics team claims owner ship on the package
without consulting me, or anyone from graphics@ i'm aware of.

then he version bumps it to latest, which was okay'ish except the
Makefile was not reviewed at all in files/ directory and most of the -D
macros were either wrong, or just obsolete.

at this point we had pngcrush package of non-subtimal quality with
questionable maintainership. notice that graphics is still in the
metadata.xml to which i'm still part of.

then as member of base-system, I bump libpng and want to push something
new for the distribution.

pngcrush, the leaf package of graphics@ gets in the way.

then I sent a message to mattst88 in Freenode what he wants to do with
the situation.

never got a reply.

masked the package.

what does this has to with qa@ team? well, they might be intrested in
the non-subtimal commit which skipped the Makefile review, also known as
"blind commit" -- otherwise it's none of their business.

so no, you don't get to use this as anykind of weapon against me or
anyone else involved.

- Samuli

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Samuli Suominen]

On 10/11/2011 07:10 PM, Samuli Suominen wrote:
> On 10/11/2011 08:38 AM, Peter Volkov wrote:
>> В Вск, 09/10/2011 в 22:28 +0000, Duncan пишет:
>>> Chí-Thanh Christopher Nguyễn posted on Sun, 09 Oct 2011 18:37:59 +0200 as
>>> excerpted:
>>>
>>>> Duncan schrieb:
>>>>> Libpng isn't held up that way, while the package still gets its 30 day
>>>>> masking last-rites.  No policy broken; no maintainer toes stepped on as
>>>>> a result of the broken policy.  No more nasty threads about (this)
>>>>> broken policy and unhappy maintainers as a result! =:^)
>>>>
>>>> Actually removing a package that doesn't violate any (written) rules
>>>> without maintainer consensus could be considered a violation of policy
>>>> too.
>>>>
>>>> http://www.gentoo.org/proj/en/devrel/recruiters/mentor.xml Respect
>>>> existing maintainers:
>>>> Never commit when someone else has clear ownership. Never commit on
>>>> things with unclear ownership until you've tried to clear it up.
>>
>> Samuli pretends here to act as a part of QA team (although he is not).
>> Actually even whiteboard of stabilization bug tells #at _earliest_ 17
>> Oct" and thus there is really no sign for rush. This is the case where
>> QA should voice and either explain why fast stabilization of libpng is
>> so important or stop policy breakage. That said it became really common
>> to break our own policies (with no attempts to amend policy).
> 
> full stop.
> 
> you are forcing me to bisect the history of pngcrush.
> 
> in 2007, I grab the package from no-herd:
> 
> http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/media-gfx/pngcrush/metadata.xml?r1=1.1&r2=1.2
> 
> then I version bump it and give it to graphics herd to which I'm a team
> member of:
> 
> http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/media-gfx/pngcrush/metadata.xml?r1=1.3&r2=1.4
> 
> at this point everything was still fine.
> 
> http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/media-gfx/pngcrush/metadata.xml?r1=1.4&r2=1.5
> 
> mattst88, NOT member of graphics team claims owner ship on the package
> without consulting me, or anyone from graphics@ i'm aware of.
> 
> then he version bumps it to latest, which was okay'ish except the
> Makefile was not reviewed at all in files/ directory and most of the -D
> macros were either wrong, or just obsolete.
> 
> at this point we had pngcrush package of non-subtimal quality with
> questionable maintainership. notice that graphics is still in the
> metadata.xml to which i'm still part of.
> 
> then as member of base-system, I bump libpng and want to push something
> new for the distribution.
> 
> pngcrush, the leaf package of graphics@ gets in the way.
> 
> then I sent a message to mattst88 in Freenode what he wants to do with
> the situation.
> 
> never got a reply.
> 
> masked the package.
> 
> what does this has to with qa@ team? well, they might be intrested in
> the non-subtimal commit which skipped the Makefile review, also known as
> "blind commit" -- otherwise it's none of their business.
> 
> so no, you don't get to use this as anykind of weapon against me or
> anyone else involved.
> 
> - Samuli
> 

then another non member of graphics team, trying to solve the issue by
bundling libpng, bundles also zlib

and I had to run after the responsible party, reopen the bug

then I had to fix the package to use properly toolchain-funcs for
linking, cross-compilation was killed in the process too

basically picking up the pieces, again... and again

then this baseless thread in ML

so you propably can guess you've managed to kill any motivation I had
for actually fixing the package (could be subject to change)

- Samuli

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 366 bytes --]

On Tue, 11 Oct 2011 19:10:01 +0300
Samuli Suominen <ssuominen@gentoo.org> wrote:
> so no, you don't get to use this as anykind of weapon against me or
> anyone else involved.

I thought the idea was to fix the problem in whatever way best serves
the needs of Gentoo's users, not to engage in warfare. What's all this
talk of weapons?

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Samuli Suominen]

On 10/11/2011 07:28 PM, Ciaran McCreesh wrote:
> On Tue, 11 Oct 2011 19:10:01 +0300
> Samuli Suominen <ssuominen@gentoo.org> wrote:
>> so no, you don't get to use this as anykind of weapon against me or
>> anyone else involved.
> 
> I thought the idea was to fix the problem in whatever way best serves
> the needs of Gentoo's users, not to engage in warfare. 

graphics@ will accept patches as normal in the bugzilla. that's where
the problem will be solved if anywhere.

> What's all this talk of weapons?

should have quoted "" that, it was only referring to the offensive
nature of the thread.

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Peter Volkov]

В Втр, 11/10/2011 в 19:10 +0300, Samuli Suominen пишет:
> > Samuli pretends here to act as a part of QA team (although he is not).
> > Actually even whiteboard of stabilization bug tells #at _earliest_ 17
> > Oct" and thus there is really no sign for rush. This is the case where
> > QA should voice and either explain why fast stabilization of libpng is
> > so important or stop policy breakage. That said it became really common
> > to break our own policies (with no attempts to amend policy).
> 
> full stop.

[snip history]

> what does this has to with qa@ team?

The only bodies that are allowed to avoid policies in Gentoo are QA and
security teams. Since this issue has nothing to do with security the
only option left is QA.

> so no, you don't get to use this as anykind of weapon against me or
> anyone else involved.

Sorry, I never wanted to touch any weapons and I really appreciate your
efforts. You really do tremendous job for Gentoo. But this is not the
first thread where I ask you same question: what is the problem to
follow policy? If it was a mistake what's the problem to sorry and
update mask interval. If not... What will happen if you keep hard masked
package for 30 days instead of 14? How this will affect libpng
stabilization? The only thing that changes - we will have 56
non-development related mails less in our mailboxes.

--
Peter.

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Samuli Suominen]

On 10/11/2011 08:38 AM, Peter Volkov wrote:
> В Вск, 09/10/2011 в 22:28 +0000, Duncan пишет:
>> Chí-Thanh Christopher Nguyễn posted on Sun, 09 Oct 2011 18:37:59 +0200 as
>> excerpted:
>>
>>> Duncan schrieb:
>>>> Libpng isn't held up that way, while the package still gets its 30 day
>>>> masking last-rites.  No policy broken; no maintainer toes stepped on as
>>>> a result of the broken policy.  No more nasty threads about (this)
>>>> broken policy and unhappy maintainers as a result! =:^)
>>>
>>> Actually removing a package that doesn't violate any (written) rules
>>> without maintainer consensus could be considered a violation of policy
>>> too.
>>>
>>> http://www.gentoo.org/proj/en/devrel/recruiters/mentor.xml Respect
>>> existing maintainers:
>>> Never commit when someone else has clear ownership. Never commit on
>>> things with unclear ownership until you've tried to clear it up.
> 
> Samuli pretends here to act as a part of QA team (although he is not).
> Actually even whiteboard of stabilization bug tells #at _earliest_ 17
> Oct" and thus there is really no sign for rush. This is the case where
> QA should voice and either explain why fast stabilization of libpng is
> so important or stop policy breakage. That said it became really common
> to break our own policies (with no attempts to amend policy).

(sorry for replying to same mail again, but I've missed the baseless
claim for fast stabilization)

no such thing, as 17 Oct is 30 day from when libpng-1.5 was released to
~arch -- notice it was me who added the whiteboard status too, so arches
DON'T stabilize it fast.

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Samuli Suominen]

On 10/08/2011 06:13 PM, Fabian Groffen wrote:
> On 08-10-2011 11:05:08 -0400, Rich Freeman wrote:
>> If the extra 16 days will actually accomplish something beyond just
>> delaying libpng then we can debate the finer points of policy.
>> However, if we're just arguing policy for its own sake then I don't
>> see the value.  Perhaps a package maintainer might have the "right" to
>> a few weeks to fix things, but in the end you have to put the distro
>> and its users first.  You can do that either by speaking up or
>> standing aside, but if you're going to speak up, then make sure you
>> can follow through.
> 
> It seems to me like you say here that any policy that Gentoo has that
> you just don't like can be ignored because, well, you just don't like
> it.
> We can discuss whether or not the policy is ok, but should we ignore the
> policy for that reason?  I think not.
> 
> 

It's not like fastened lastriting hasn't happened before. I question
your motives in picking this particular one. It's not like I expected
cookies for the time I've put into this porting effort, but not this
"attack" either.

whatever

- Samuli

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Fabian Groffen]

[-- Attachment #1: Type: text/plain, Size: 1380 bytes --]

On 08-10-2011 18:33:15 +0300, Samuli Suominen wrote:
> It's not like fastened lastriting hasn't happened before. I question
> your motives in picking this particular one. It's not like I expected
> cookies for the time I've put into this porting effort, but not this
> "attack" either.

If you feel I'm attacking you, then I apologise.  My personal feeling is
that my response was very mild and not directed to you.  I haven't
responded to your earlier "fastened lastriting" messages on purpose.
Now that Matt brought it up for this package, I just liked to point out
that we have a policy, that was made for some reason, and that you
violated it.

I realise that it may look like I'm picking just on you.  I'm not.  This
is the risk you run as one of the top committers of Gentoo.  I think you
do a lot of good work, and I hope you'll keep on doing so for a long
time.

You just tend to change rules as you see fit every once in a while,
which is a bad thing for Gentoo.  I don't like all policies either, but
I stick to them (for as far as I'm aware of them), because if we all
would start to ignore what we don't like, then what would be the point
in having those policies at first?

Again, this doesn't mean that each policy in its current form is
de-facto the best thing or something like that.


-- 
Fabian Groffen
Gentoo on a different level

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Ryan Hill]

[-- Attachment #1: Type: text/plain, Size: 691 bytes --]

On Sat, 08 Oct 2011 18:33:15 +0300
Samuli Suominen <ssuominen@gentoo.org> wrote:

> It's not like fastened lastriting hasn't happened before. I question
> your motives in picking this particular one. It's not like I expected
> cookies for the time I've put into this porting effort, but not this
> "attack" either.

Then stop trying to remove packages that have an active maintainer.  I could
have sworn that was written down somewhere.


-- 
fonts, gcc-porting,                  it makes no sense how it makes no sense
toolchain, wxwidgets                           but i'll take it free anytime
@ gentoo.org                EFFD 380E 047A 4B51 D2BD C64F 8AA8 8346 F9A4 0662

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Alec Warner]

On Mon, Oct 10, 2011 at 8:00 PM, Ryan Hill <dirtyepic@gentoo.org> wrote:
> On Sat, 08 Oct 2011 18:33:15 +0300
> Samuli Suominen <ssuominen@gentoo.org> wrote:
>
>> It's not like fastened lastriting hasn't happened before. I question
>> your motives in picking this particular one. It's not like I expected
>> cookies for the time I've put into this porting effort, but not this
>> "attack" either.
>
> Then stop trying to remove packages that have an active maintainer.  I could
> have sworn that was written down somewhere.

I think there was error on both sides here.

1) QA should have some documentation regarding when they will take
action. I've gotten Samuli and Diego to note that this would be a good
idea; so I hope that gets done in the future.

2) There was miscommunication on the bug. In comment #13 Samuli
mentions that 'I'm fine with switching to bundled libpng14 for now,
but I'm not going to work
on it either.' Hanno then bundles libpng only to be told later in the
day that that is wrong. Please try to communicate clearly with each
other.

3) Maintainers (and upstreams) are not always responsive. The bug was
opened in February and wasn't really worked on until recently.

When you are making a treewide change like a lib upgrade you do have a
to pick a point where 'enough' people have upgraded and you just break
(or mask in this case) everything else. If the folks want the package
in the tree they can fix it; thats the whole point of masking
(providing a notification and a fix-it interval.)

Samuli, this interval is why we mask for 30-60 days also...so try not
to shrink the interval without a good reason.

-A

>
>
> --
> fonts, gcc-porting,                  it makes no sense how it makes no sense
> toolchain, wxwidgets                           but i'll take it free anytime
> @ gentoo.org                EFFD 380E 047A 4B51 D2BD C64F 8AA8 8346 F9A4 0662
>

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/11/11 05:36, Alec Warner wrote:
> 
> 3) Maintainers (and upstreams) are not always responsive. The bug
> was opened in February and wasn't really worked on until recently.
> 
It is a bit of surprise all this talking for a bug that went
unattended for 9 months isn't it? O:) It is like people want open bugs
and rotten packages around :).

> When you are making a treewide change like a lib upgrade you do
> have a to pick a point where 'enough' people have upgraded and you
> just break (or mask in this case) everything else. If the folks
> want the package in the tree they can fix it; thats the whole point
> of masking (providing a notification and a fix-it interval.)
This is why the packages is masked now. But of course people don't
bother reading masking messages and they think that masking == removal.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOk+70AAoJEPqDWhW0r/LCWNYP/R5hptjfjUku8vutJ5ptTiXY
HEf3N3rJtZmg6CgM1kLwRoGeCxiM1iiy7AC1chYa+hlgxx4iDYS3iMUaKaQRupZu
PSLbZFWn06F7SzeujqGb5YdCBlF5Evoyswe/lxXlr60qyfyu2vCH+C3Ly8VughQp
FafI096uWm3JlxbEW1R6Bvz+TtV37FSVDWx44Hqmu6IqTwuq70tfO3V5zOGjSePR
4Af9RSK/t/+MU2f3Jn3M9dlSVJG1EzMjmLB5x3ItFANUU0kjQYe0rbz6ezpL0nb8
AWGIaHelLSLQowBICCUpmigVPoZx39oJIFMVmzqZTEOVkrjmxmeimPw3qR/oPyFn
ySlFoVahr+IXGzh2jW+EKacVio4lPSelj19uWLY104wD2Y+S909OMXnFn2MhrPYx
5RHvrMQEYXE3lb1AZxy4+Hf5up4LNZnTTwQ/IERUNqENIwJNTOxHtmGAiZxD+Jlb
u2GXURnV3/zI5Dffvk3P/fQjFRCZukakmPkYh9K/pYCjjN7Q4n1d/XqKjk9neo46
PrfcO0PTxRYvETq/JOB9YORT9+n4oL0RVp7qNgaZEQII/xxJDxIy55DXiPAHoTjU
ZumWmmzUiK9ceJPHiVKU5tNPImv7n6pNvzuiM96qMMkyydzd+TnGLSbqo+6e56qY
AH/tWodh81mNCuc+/szf
=BPvB
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Chí-Thanh Christopher Nguyễn]

Markos Chandras schrieb:
>> 3) Maintainers (and upstreams) are not always responsive. The bug
>> was opened in February and wasn't really worked on until recently.
> It is a bit of surprise all this talking for a bug that went
> unattended for 9 months isn't it? O:) It is like people want open bugs
> and rotten packages around :).

There was no indication 9 months ago that this bug is so bad that the
package would be removed if not fixed. Masking the package is ok if it
is totally broken or violates policy. Removal when the maintainer is
explicitly against it is not ok.

Packages have bugs. If it is a bug that affects a small number of users
in a minor way and there is no easy fix, then the bug will get less
attention than one that affects many users in a serious way. Live with it.


Best regards,
Chí-Thanh Christopher Nguyễn

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Rich Freeman]

2011/10/11 Chí-Thanh Christopher Nguyễn <chithanh@gentoo.org>:
> There was no indication 9 months ago that this bug is so bad that the
> package would be removed if not fixed. Masking the package is ok if it
> is totally broken or violates policy. Removal when the maintainer is
> explicitly against it is not ok.

Agreed.  I understand that sometimes major packages need to be
upgraded, and when you have 350 out of 360 blockers resolved sometimes
you have to just draw the line for the sake of the many.

However, when you want to do this:

1.  Announce the general initiative on -dev-announce if it is a big
one so that people know it is happening.

2.  Post in all the blocker bugs that on DATE you plan to mask the
package to allow for the other package to move.  Make DATE at least 30
days in advance.

3.  When you do mask it, then just mask it, not for removal unless it
is unmaintained (in which case refer to treecleaners).

In this case some developer picks up a package in Aug and out of the
blue it is masked for removal.  Sure, there was a bug logged against
it, but most of the packages in the tree have bugs logged against them
and I wouldn't expect them to suddenly start disappearing.

Finally, when you are taking action in some role (QA, whatever), make
a note of it so that people know in what capacity you are acting and
what project head to escalate to.  If you can't say that "I'm doing
this as a treecleaner with the project lead's blessing" or "I'm doing
this as a member of QA with the QA lead's blessing" then you probably
shouldn't be touching somebody else's package.  The QA lead should be
held accountable for things done by QA, but it is a bit hard to do it
when people not in QA are just doing whatever they feel is best for QA
in general.  In general if you're going to be masking a whole bunch of
packages for the sake of QA, then the QA lead should probably be aware
that you're doing it.

Rich

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/11/11 14:57, Rich Freeman wrote:
> Finally, when you are taking action in some role (QA, whatever),
> make a note of it so that people know in what capacity you are
> acting and what project head to escalate to.  If you can't say that
> "I'm doing this as a treecleaner with the project lead's blessing"
> or "I'm doing this as a member of QA with the QA lead's blessing"
> then you probably shouldn't be touching somebody else's package.
> The QA lead should be held accountable for things done by QA, but
> it is a bit hard to do it when people not in QA are just doing
> whatever they feel is best for QA in general.  In general if you're
> going to be masking a whole bunch of packages for the sake of QA,
> then the QA lead should probably be aware that you're doing it.
> 
> Rich
> 
Seems like none of you ever bothered to read the bug about pngcrush
and what was discussed there. It is getting a little bit of a habit to
escalate minor problems to flames in Gentoo. So feel free to
write/say/do whatever you want(maybe add it to system@ set cause you
all seem to love this package very very much). I am done with this
thread since you all enjoy spreading flame bites around without even
spending 1' to read the bug.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOlHRaAAoJEPqDWhW0r/LC9IAP/jfGVD6Vu62uVwuFHamiv0PB
0jChQAryVAc9bHKryW1/LIy4Qp4I4IZ6ZIzh7IyTpL0CZIcJ5qBkNm3Dt1OI6cAp
vnuoe74fRIXQlkMyusN7VmNHo3jAOStPDuzUxHE7grzKXUPhz1Zmns7guJrQehNk
EFUi9SX0kvwCdvGT2THy+jSnQ5KGwXHBC+sXTOY7338A00J82w/7o+uPQCyV6/Ca
84hMYZf/X3YzGS3t4vGr5+RIVrjxlOxYK0CWPeU8/iKuUwb30mGwbC3tne/l+sPU
SjuTlY0q+yk+ZgEebsKHUrCyZzuxIf6dyyRz0UsCcs5GOU2A/pJ61zYDEbe7NJwX
Fjd0v7D3V8R7SJILJwTvYrqiogHgz+tCfIB35AlEzQcrXQqi3DTwnZZGXAtr4AKa
nFJ2s4SuXVUZanh6UnVF9ILXWCk/Snr4zxZKORqUKcfOifSehB+DKopkg+8b5grg
DLa8S3nPKpSfOAQoORgaYkLI3b1UcT9SKxz3bnTOhYI/c+fqynSHFOd1rkU6dIvN
RKQiitbqmRLXd7yasIWAPu/Bwfs8BTQqmsumTvy8dXNykDjelSMwMvI2Jogm7CzP
Zshkcw+7XHpSXYUkW7UgV2BU8cmK3uwpDGgSrfi3eioCQum35s2JZg2AqGEULXsj
nx8ApZNFXcu35IcRT6Pq
=aqyP
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Rich Freeman]

On Tue, Oct 11, 2011 at 12:52 PM, Markos Chandras <hwoarang@gentoo.org> wrote:
> Seems like none of you ever bothered to read the bug about pngcrush
> and what was discussed there.

I read the entire discussion before making a single post - it would be
irresponsible not to.  Now, I can't say that I checked the cvs
histories of the package metadata.xml file, the herd memberships, or
what somebody sent to somebody else in IRC.

If somebody had posted in the bug a month ago "FYI - I plan to mask
this package on $date so if you have a problem with that let me know,"
I doubt we'd be having this conversation at all.

> It is getting a little bit of a habit to escalate minor problems to flames in Gentoo.

Obviously Matt was unhappy with how things were handled.  It would be
best if he tried to work that out in private first, and perhaps
efforts were made to do this, and perhaps not.

However, I think the reason everybody and their uncle is posting here
is that there doesn't seem to be any acknowledgment that something
non-ideal was done here in the first place.  That just means that this
whole thing could happen again.

Arguing over who did what is counterproductive in my mind - this isn't
a forum to seek justice.  However, talking about how the process
SHOULD work is productive, and I'd just ask that in the future that
people publicly disclose in advance what they plan to do when it
involves touching packages that others maintain.  If somebody can't
come to an agreement with the maintainer on how something should be
handled the solution is to escalate within the project(s) first as
appropriate, but not to just go around doing cvs commits.

I'm fine with having a bias for action, and assuming no response in
two weeks means somebody is OK with something.  However, logging a bug
reporting an issue isn't really the same as asking for consent to mask
a package.  If a package has a critical security problem then we may
not be able to wait, but nobody is going to die if a libpng
stabilization is delayed by a week or two, and if this were started a
week or two earlier there would be no debate here.  Or, at least if
there were a debate there would be less of an aggrieved feeling.

In any case, if you don't want to see flame-wars on -dev I'd recommend
starting by not doing things that are likely to tick people off - like
committing to somebody else's package without ensuring they know about
it.  It sounds like there was an irc ping in this case, but I don't
consider those a very reliable form of communication - especially if
it is not acknowledged.

Rich

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/11/11 18:34, Rich Freeman wrote:
> On Tue, Oct 11, 2011 at 12:52 PM, Markos Chandras
> <hwoarang@gentoo.org> wrote:

I understand your points but given the fact that we have no active QA
team to pick up the mess whenever needed (Diego can't do eveyrything
on his own) I will keep doing what I think it is best for Gentoo. If
you or others don't like that please take this to devrel, to QA, to
the president or to master Yoda. Before you(not your in particular) do
that though, make sure you double checked that I indeed violated the
official policy.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOlImRAAoJEPqDWhW0r/LCrLgQAIGmW1ABZfspXPIgE4+xteJx
4psovJ47oNQyZd+zDUJRVK9I1J/IENqUeOvCwxn3mh7JkeSn5JPuUfnHTKwJPB9W
va9rKpNlW2jk0I7k6yUM70mSLZJyFFKtVdicDSwiniFVoY8irFT+9tBMcP2kw6fY
nc9Jriz395fL6+3T+euRdJYPASo7Z82OIxG65zN47KahtCdjQ43yTs+L7ZZ+ol/Y
4UJ654XDgf2A3E7dZZLhpFGauD62xXkjtPJ+EnvpxBWVuf6hPJfeEAEKXxDUfwwq
SHmXO8+nv3uQcAiyd6zIZ6dIuKCWhk6CvqkLo/Fb/kHlwDfmSUGrfMvsqlpdKJYB
faCbCCZ6cuHm6BEjbxInStDRIwOBliX/+IsYPLAxXly9HBNl8zoCq46KLj4BboSM
Pebi3V4SEjYQs36i5zS7qAs3AWY7sqjG95ivLbl+h6Hx6qdbeQmRTYMy0vyTL/YT
lQ6HuZawkOUyG29ZmpIEhBf24OP6QXdDBglWbB7XF0rnth0fUO/0K+cYlZ+/7WCK
oLfJDAoRwFs16OepPFXAkt1MogVxBz7AlULmWgRGSZbAHIfoJ++kMOw5RIx1XteW
Yw0lgv8WB2OoeQ2B9zMWmoMb9aIPYhYAUgS1qq6tpX3x2tumMKVq0k2azaIP4dp/
dKP7UVQYWo9ay50GKnZO
=uSLU
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Andreas K. Huettel]

[-- Attachment #1: Type: Text/Plain, Size: 1142 bytes --]

On Dienstag 11 Oktober 2011 20:23:13 Markos Chandras wrote:
> On 10/11/11 18:34, Rich Freeman wrote:
> > On Tue, Oct 11, 2011 at 12:52 PM, Markos Chandras
> 
> > <hwoarang@gentoo.org> wrote:
> I understand your points but given the fact that we have no active QA
> team to pick up the mess whenever needed (Diego can't do eveyrything
> on his own) I will keep doing what I think it is best for Gentoo. If
> you or others don't like that please take this to devrel, to QA, to
> the president or to master Yoda. Before you(not your in particular) do
> that though, make sure you double checked that I indeed violated the
> official policy.

Now it's getting slightly ridiculous. 

We don't have an active QA team anymore because some people thought it 
detrimental that they even tried to enforce rules (which we gave ourselves, 
just as a reminder).

Taking the resulting vacuum as a reason to just keep ignoring rules (which, by 
the way, every new recruit has to learn) is somehow taking the argument full 
circle.

-- 

Andreas K. Huettel
Gentoo Linux developer 
dilfridge@gentoo.org
http://www.akhuettel.de/


[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/11/11 21:01, Andreas K. Huettel wrote:
> On Dienstag 11 Oktober 2011 20:23:13 Markos Chandras wrote:
>> On 10/11/11 18:34, Rich Freeman wrote:
>>> On Tue, Oct 11, 2011 at 12:52 PM, Markos Chandras
>> 
>>> <hwoarang@gentoo.org> wrote:
>> I understand your points but given the fact that we have no
>> active QA team to pick up the mess whenever needed (Diego can't
>> do eveyrything on his own) I will keep doing what I think it is
>> best for Gentoo. If you or others don't like that please take
>> this to devrel, to QA, to the president or to master Yoda. Before
>> you(not your in particular) do that though, make sure you double
>> checked that I indeed violated the official policy.
> 
> Now it's getting slightly ridiculous.
> 
> We don't have an active QA team anymore because some people thought
> it detrimental that they even tried to enforce rules (which we gave
> ourselves, just as a reminder).
> 
> Taking the resulting vacuum as a reason to just keep ignoring rules
> (which, by the way, every new recruit has to learn) is somehow
> taking the argument full circle.
> 
Ok here are the known facts:
fact#1: QA is inactive
fact#2: The tree needs clean up and constant care.

Do you have anything to propose to deal with the previous well-known
facts? If me or anybody else picking up the pieces is not acceptable
then what has to be done instead?

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOlKcQAAoJEPqDWhW0r/LCSpAQAJZIdqIOkZhjMlh3aaQZhNgx
NQGFlluKoUWl+qzVZJC+4xJieWUMx7TfGke+CCUYyVDFqn9oBICsGSRfYU2wOpjo
b//c87pNtymkG70JwE2spYQkGOdCW9avY6KISj0TX2elGxPFS8Rljue422k5e6V0
SEiGvxElMy4EvDlNt0W4M5emSoHOy0x3hXgFju3lqsRrw2M83gBTQ/1cMdJa1X7J
OlBEVjkU8J0QTWqdeXl6cAItvgogdMFE87B6DkAjVaqdZq2xki4bfcFJzZBv/wsZ
iS4qOw1r1zfwWAE9U5b+mbCQXd0SXqsrhZ1afscf/rX5Oy86TvBRBv6W8Nf+Fa5t
d+9xT5j4YFHun8Lraoxx1C7vft2yXAIxGECeBIc2z0wRmKrZDYvltfpIUGckSN3Z
voOA77oLJys7LcTXfNlATj/ed8hQhp1ErhSwviWWuxcOBzBBSG3kgBPdnD6qg3s4
sqdl2AEx0dYzUWA0ZwGL8Aka+uWq6Fc7AwJJivH59Q7XUawvzT9/72w4nxaEhnW5
4u8LsmzkCMFfjVH0NyhlZ+giR4pgGxuKTShe8DKdRImajxp2/YXRy1wjScR5ZM+w
f9+IsZlEXjimq/dz/V/XUezdMDBahxQBy6DQmwjWpajcxmVFaRY08OWUKdwsLKWM
thqj1GF3HmRiItMBGDJS
=C1XA
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Alec Warner]

On Tue, Oct 11, 2011 at 1:29 PM, Markos Chandras <hwoarang@gentoo.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 10/11/11 21:01, Andreas K. Huettel wrote:
>> On Dienstag 11 Oktober 2011 20:23:13 Markos Chandras wrote:
>>> On 10/11/11 18:34, Rich Freeman wrote:
>>>> On Tue, Oct 11, 2011 at 12:52 PM, Markos Chandras
>>>
>>>> <hwoarang@gentoo.org> wrote:
>>> I understand your points but given the fact that we have no
>>> active QA team to pick up the mess whenever needed (Diego can't
>>> do eveyrything on his own) I will keep doing what I think it is
>>> best for Gentoo. If you or others don't like that please take
>>> this to devrel, to QA, to the president or to master Yoda. Before
>>> you(not your in particular) do that though, make sure you double
>>> checked that I indeed violated the official policy.
>>
>> Now it's getting slightly ridiculous.
>>
>> We don't have an active QA team anymore because some people thought
>> it detrimental that they even tried to enforce rules (which we gave
>> ourselves, just as a reminder).
>>
>> Taking the resulting vacuum as a reason to just keep ignoring rules
>> (which, by the way, every new recruit has to learn) is somehow
>> taking the argument full circle.
>>
> Ok here are the known facts:
> fact#1: QA is inactive
> fact#2: The tree needs clean up and constant care.

I really think this conversation is not going in a useful direction
and people are just talking past each other on the list.
Would it be possible to perhaps have a short (20 minute?) meeting on
irc to discuss?

-A

>
> Do you have anything to propose to deal with the previous well-known
> facts? If me or anybody else picking up the pieces is not acceptable
> then what has to be done instead?
>
> - --
> Regards,
> Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.18 (GNU/Linux)
>
> iQIcBAEBCgAGBQJOlKcQAAoJEPqDWhW0r/LCSpAQAJZIdqIOkZhjMlh3aaQZhNgx
> NQGFlluKoUWl+qzVZJC+4xJieWUMx7TfGke+CCUYyVDFqn9oBICsGSRfYU2wOpjo
> b//c87pNtymkG70JwE2spYQkGOdCW9avY6KISj0TX2elGxPFS8Rljue422k5e6V0
> SEiGvxElMy4EvDlNt0W4M5emSoHOy0x3hXgFju3lqsRrw2M83gBTQ/1cMdJa1X7J
> OlBEVjkU8J0QTWqdeXl6cAItvgogdMFE87B6DkAjVaqdZq2xki4bfcFJzZBv/wsZ
> iS4qOw1r1zfwWAE9U5b+mbCQXd0SXqsrhZ1afscf/rX5Oy86TvBRBv6W8Nf+Fa5t
> d+9xT5j4YFHun8Lraoxx1C7vft2yXAIxGECeBIc2z0wRmKrZDYvltfpIUGckSN3Z
> voOA77oLJys7LcTXfNlATj/ed8hQhp1ErhSwviWWuxcOBzBBSG3kgBPdnD6qg3s4
> sqdl2AEx0dYzUWA0ZwGL8Aka+uWq6Fc7AwJJivH59Q7XUawvzT9/72w4nxaEhnW5
> 4u8LsmzkCMFfjVH0NyhlZ+giR4pgGxuKTShe8DKdRImajxp2/YXRy1wjScR5ZM+w
> f9+IsZlEXjimq/dz/V/XUezdMDBahxQBy6DQmwjWpajcxmVFaRY08OWUKdwsLKWM
> thqj1GF3HmRiItMBGDJS
> =C1XA
> -----END PGP SIGNATURE-----
>
>

[gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Ryan Hill]

[-- Attachment #1: Type: text/plain, Size: 904 bytes --]

On Tue, 11 Oct 2011 17:52:42 +0100
Markos Chandras <hwoarang@gentoo.org> wrote:

> Seems like none of you ever bothered to read the bug about pngcrush
> and what was discussed there. It is getting a little bit of a habit to
> escalate minor problems to flames in Gentoo. So feel free to
> write/say/do whatever you want(maybe add it to system@ set cause you
> all seem to love this package very very much). I am done with this
> thread since you all enjoy spreading flame bites around without even
> spending 1' to read the bug.

I've read this whole thread and found that if we remove your posts then there
would have been no flaming whatsoever.


-- 
fonts, gcc-porting,                  it makes no sense how it makes no sense
toolchain, wxwidgets                           but i'll take it free anytime
@ gentoo.org                EFFD 380E 047A 4B51 D2BD C64F 8AA8 8346 F9A4 0662

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/12/11 02:44, Ryan Hill wrote:
> On Tue, 11 Oct 2011 17:52:42 +0100 Markos Chandras 
> <hwoarang@gentoo.org> wrote:
> 
>> Seems like none of you ever bothered to read the bug about 
>> pngcrush and what was discussed there. It is getting a little
>> bit of a habit to escalate minor problems to flames in Gentoo.
>> So feel free to write/say/do whatever you want(maybe add it to 
>> system@ set cause you all seem to love this package very very 
>> much). I am done with this thread since you all enjoy spreading 
>> flame bites around without even spending 1' to read the bug.
> 
> I've read this whole thread and found that if we remove your posts 
> then there would have been no flaming whatsoever.
> 
> 
I was dragged to this thread because people decided to make this
public and have some fun trolling around instead of following the
official policy which is either to contact QA or report me to devrel
for messing around with their (the package belongs to graphics@ ONLY,
got their approval before I do anything) packages.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOlT+pAAoJEPqDWhW0r/LCN3AP/1leeYdKCgEiE+XBG2OhdTg7
eGS/FTcv0P3/0o80ip2MtDzspNJ8sRsw0jYb8/WcgrOfzZ2CUsPQlEd0oo6bQwgU
04mcnzB7lFlBdJvC7n1AHG459q0v+aSj9iQnh2Xn0Adij9v/STab7mF7k2DGoxE/
muIQB2xEATNVSztj8Hk4dGR0eU7PWRpUY0tr6saY1pUPlMdj2CLPzhttsO2yViat
JuC4FqprQVbMLz/ws70tFOh35Al54xJdN0xVluOemRfAngvj3CowAAXDbdAcbAZq
gYXIWW49tyGPUqqe866/siHdpr6wq2HCP1XHZGuCoqqjt2q+n/aocoSpNovPyk04
lvnuZetQ3JDV/9X9aLt6X61/Vz4KeUAfD994s60oitXykh4CkQWgJQeTYBWeXq7f
UIt6EQiPKdIGzfFG80ffNFR403BisW+DyS8wS2LPDcCoKK28iitaVhD8rVjdgrAs
spU2HQRBYoNuBPHGVwKsw6d1dFANDsLqV21V6/R2gNPVIhsoCW50O+k9amTdG7zA
TprqRPidYgMgjfjMkKJ1P8m7PIEIIe2tI4yxNc6BvpXUxxAgigAGTrv0Pw5+RmHS
RHi2IaK3y0tv6JyGy4OmaUUY9FItyLZQWj+h5hKNWQuMTJhQwnEzCiYf6abKarlk
5W1Bu+z1UCLbvHwimevh
=3UKE
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Samuli Suominen]

On 10/12/2011 04:44 AM, Ryan Hill wrote:
> On Tue, 11 Oct 2011 17:52:42 +0100
> Markos Chandras <hwoarang@gentoo.org> wrote:
> 
>> Seems like none of you ever bothered to read the bug about pngcrush
>> and what was discussed there. It is getting a little bit of a habit to
>> escalate minor problems to flames in Gentoo. So feel free to
>> write/say/do whatever you want(maybe add it to system@ set cause you
>> all seem to love this package very very much). I am done with this
>> thread since you all enjoy spreading flame bites around without even
>> spending 1' to read the bug.
> 
> I've read this whole thread and found that if we remove your posts then there
> would have been no flaming whatsoever.
> 
> 

I would call baseless claims and accusations flaming. Or an poor attempt
of it.

Still waiting for an apology from one or two persons involved in this
thread, and hwoarang isn't one of them.

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/11/11 14:57, Rich Freeman wrote:
> 2011/10/11 Chí-Thanh Christopher Nguyễn <chithanh@gentoo.org>:
The previous e-mail was not a direct response to you but I picked it
at random so I can reply to @all since I sent the entire thread to
/dev/null


- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOlHTEAAoJEPqDWhW0r/LC2VYP/j/Pt5/0CDTRgnRgjlYeXDgj
zTnvKdOjVLo7sksQUnWXvs1/Cs26dA4woHCUkBKhWYzyYtHtD70dBPomTQyHeSJr
IisH/WmoQK0xKoMZW3IhtnsSQ5rGKRg6dw0kvh+aqAAcFnwqU9st83RUH3cY90h8
ildhVDtTJNRx5Sr7QTfRMUP2FHUSeo+mLG8mqu0hMojVQk2Y2RtK3RzoyAtkzR/c
gwb2aNDWS6E7fjbWzUr1zEONNG3yV7+OyWT7pahf1kuqqB2DZOTSKu0OEGeDSpoI
oJxFoGs8+5NnmJm3t8M+qpLbn6ZeazsWvB0I8suCFeXxlyOWlnbCHQbZsQvKwBnE
4Mk/Ffe9skGv9ZPU8jR/TIKvAhfbjjCAOagYb5Kt62UzE+wMtWDqFwuO80vNLd4u
LUrQR/YsfMSvoiOny5hBURl9eXVM2XlQ85SHpI8Q8d5B9Bn/At9s8iv/xRexMUeK
eZyUDlsI4+qe9BJtss3GLr/BtYix7mM9cvXZdRx4jvC0o1p6fYnpDPuQfJY/MTzW
hBzmPMXErHUR0FIQzPyBcpXtBBcMcJCy25Bb11YcfZTsBzURgXu0j97I9JdF29hb
nKR9TL0BUqdRLDc1vxuDfn0PORSoebaVg84D/1kwPI7DOo6GyQq3IHffvLY/vyzv
ylac/ec2CyV3wjBW/YXM
=5WxL
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/11/11 04:00, Ryan Hill wrote:
> On Sat, 08 Oct 2011 18:33:15 +0300 Samuli Suominen
> <ssuominen@gentoo.org> wrote:
> 
>> It's not like fastened lastriting hasn't happened before. I
>> question your motives in picking this particular one. It's not
>> like I expected cookies for the time I've put into this porting
>> effort, but not this "attack" either.
> 
> Then stop trying to remove packages that have an active maintainer.
> I could have sworn that was written down somewhere.
> 
> 
Isn't this the same situation with gcc stabilizations? Once the
timeframe for fixing broken packages with e.g gcc-4.5 is passed, the
remaining broken packages will be gone.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOk+uhAAoJEPqDWhW0r/LCPaIP/0WOzleagPvw82n7yPN3RO5U
DSOYXsSr64gpbRFI1w+3/lBE50fNvWAA7taRU2+c6ccHA1AcC99iPJ+FIymxZFck
2C4hRHRNhigxwZw+n+SBzXG2hNL+fvzWrRWdWOPz9WLjWr3DQF9XENIQz9rwBEij
f2QdTbIK99BEgHl5ibYFI6yhHDbtYBaBLNI9TbBQsGvNhjT0UM1+FHNFRvCPxERY
m/U/Ps+2sETa5Hf+FQou5rFUptJvY45BVriggDK9mQ1R7gHo9H5m7RkGPrZAKprC
kZ0pRZkYrWGkdVk4FZXQPJcx6DAQ/WvrJH3JGmSL6nC3lVLK+htLbsSC+NSjFqsN
02k7XSkdRVQPWkv6bPqdQMcDg55pc+pKaW4nzi69T+1aoMomgxEwHrTOfeXyOeN5
Wu7Abgg+W75aZLXzW+dzn3etCCW/3ha8GoQwqzTIGmd7hedWhmaiKfmCUZbM/Ac5
4tWnHSvA0BK4vI3NGrV8BZLO8FKrGDnSu6tHGosgcQ5HMlm4YFOmMOGmfO271Ecg
bA9YjpQZCX2BiJ6FwaDuY1NLNxcT1djvsVNg+t+7ZbLyQ1r4s7OXiTPHmfDURK0h
af08Ap1OzeBP434zSjBxU1JU40zk3eeb4/QWaAk9S+gGU05hC6jnIEpA0vY6q0ep
Tl/SvNyjpN3MUh0FG8SZ
=o4f/
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Peter Volkov]

В Втр, 11/10/2011 в 08:09 +0100, Markos Chandras пишет:
> Isn't this the same situation with gcc stabilizations?

No. As was pointed many times, there was (and still is) no clear
stabilization path announced. But there is some work behind scene and
pressing dates with absolutely no need. If you want developers to
cooperate make checkpoints clear and make this information available in
advance.

--
Peter.

[gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Duncan]

Markos Chandras posted on Tue, 11 Oct 2011 08:09:21 +0100 as excerpted:

> On 10/11/11 04:00, Ryan Hill wrote:

>> Then stop trying to remove packages that have an active maintainer.
>> I could have sworn that was written down somewhere.
>> 
> Isn't this the same situation with gcc stabilizations? Once the
> timeframe for fixing broken packages with e.g gcc-4.5 is passed, the
> remaining broken packages will be gone.

Are you seriously proposing that libpng 1.5 should follow a six-month-
hard-masked before unmasking to ~arch and 18-month-to-stable (total, 
including the hard-mask time) timeline?  

Because that's the sort of timeline you're comparing against.  What's the 
rush, again, especially if it can't be stabilized anyway for another nine 
months?  30 days doesn't look so long against that after all, does it?

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman

[gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Ryan Hill]

[-- Attachment #1: Type: text/plain, Size: 1300 bytes --]

On Tue, 11 Oct 2011 08:09:21 +0100
Markos Chandras <hwoarang@gentoo.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> On 10/11/11 04:00, Ryan Hill wrote:
> > On Sat, 08 Oct 2011 18:33:15 +0300 Samuli Suominen
> > <ssuominen@gentoo.org> wrote:
> > 
> >> It's not like fastened lastriting hasn't happened before. I
> >> question your motives in picking this particular one. It's not
> >> like I expected cookies for the time I've put into this porting
> >> effort, but not this "attack" either.
> > 
> > Then stop trying to remove packages that have an active maintainer.
> > I could have sworn that was written down somewhere.
> > 
> > 
> Isn't this the same situation with gcc stabilizations? Once the
> timeframe for fixing broken packages with e.g gcc-4.5 is passed, the
> remaining broken packages will be gone.

Absolutely not.  They aren't even masked.  There are usually a few niche
packages that can't be fixed but are in use.  People can switch to a previous
version if they ever have to rebuild them.


-- 
fonts, gcc-porting,                  it makes no sense how it makes no sense
toolchain, wxwidgets                           but i'll take it free anytime
@ gentoo.org                EFFD 380E 047A 4B51 D2BD C64F 8AA8 8346 F9A4 0662

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

[gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Ryan Hill]

[-- Attachment #1: Type: text/plain, Size: 1080 bytes --]

On Tue, 11 Oct 2011 19:41:21 -0600
Ryan Hill <dirtyepic@gentoo.org> wrote:

> > Isn't this the same situation with gcc stabilizations? Once the
> > timeframe for fixing broken packages with e.g gcc-4.5 is passed, the
> > remaining broken packages will be gone.
> 
> Absolutely not.  They aren't even masked.  There are usually a few niche
> packages that can't be fixed but are in use.  People can switch to a previous
> version if they ever have to rebuild them.

To clarify:  we keep old versions of gcc in the tree for a reason, and it's
not because we're history buffs.  "Doesn't build with GCC x.x" alone is never
grounds for removal. "Is unmaintained and doesn't build with GCC x.x" is
perfectly fine, however, and some people use the gcc trackers to identify such
packages.  Maybe that's the correlation you see.


-- 
fonts, gcc-porting,                  it makes no sense how it makes no sense
toolchain, wxwidgets                           but i'll take it free anytime
@ gentoo.org                EFFD 380E 047A 4B51 D2BD C64F 8AA8 8346 F9A4 0662

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Chí-Thanh Christopher Nguyễn]

Ryan Hill schrieb:
> On Sat, 08 Oct 2011 18:33:15 +0300
> Samuli Suominen <ssuominen@gentoo.org> wrote:
>
>> It's not like fastened lastriting hasn't happened before. I question
>> your motives in picking this particular one. It's not like I expected
>> cookies for the time I've put into this porting effort, but not this
>> "attack" either.
> Then stop trying to remove packages that have an active maintainer.  I could
> have sworn that was written down somewhere.

I found two instances of it
1. http://www.gentoo.org/proj/en/devrel/recruiters/mentor.xml
2. Ebuild quiz, question 13


Best regards,
Chí-Thanh Christopher Nguyễn

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Matt Turner]

On Sat, Oct 8, 2011 at 10:20 AM, Markos Chandras <hwoarang@gentoo.org> wrote:
> On 10/08/2011 02:19 PM, Matt Turner wrote:
>> On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen
>> <ssuominen@gentoo.org> wrote:
>>> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011) # Fails to
>>> compile against system libpng15, bug 356127 # Removal in 14 days
>>
>> 14 days?
>>
>>> media-gfx/pngcrush
>>
> We can't really wait forever for slacking maintainers to fix their
> packages. amd64 is almost ready to have libpng-1.5 stable in the very
> near future

Two things:

1) I'm *really* tired of the usage of the word "slacking" on this
mailing list. If you or someone else wants to pay me to work on
Gentoo, *then* you can tell me that I'm slacking. Otherwise, I'm a
volunteer working on things that interest me in my free time. I truly
do have more important things to do than to figure out how to port
pngcrush to libpng1.5. Namely, graduate school and midterm exams.

2) What exactly is it that you want me to do here? Upstream is aware
of the problem, and seems to be working on it as there are comments
about libpng15 in pngcrush.c. Hanno kindly stepped in and made
pngcrush use a bundled libpng14 (and at the same time bundled zlib,
which has now been fixed), which you promptly masked. I'm not sure if
the problem is bundled libs in general or specifically zlib, but we
*know* it's distasteful. It's not like that's a preferred or permanent
solution. Do you find that somehow more distasteful than removing a
piece of software from from portage that's been in the tree since
2002?

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/08/11 22:45, Matt Turner wrote:
> On Sat, Oct 8, 2011 at 10:20 AM, Markos Chandras
> <hwoarang@gentoo.org> wrote:
>> On 10/08/2011 02:19 PM, Matt Turner wrote:
>>> On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen 
>>> <ssuominen@gentoo.org> wrote:
>>>> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011) #
>>>> Fails to compile against system libpng15, bug 356127 #
>>>> Removal in 14 days
>>> 
>>> 14 days?
>>> 
>>>> media-gfx/pngcrush
>>> 
>> We can't really wait forever for slacking maintainers to fix
>> their packages. amd64 is almost ready to have libpng-1.5 stable
>> in the very near future
> 
> Two things:
> 
> 1) I'm *really* tired of the usage of the word "slacking" on this 
> mailing list. If you or someone else wants to pay me to work on 
> Gentoo, *then* you can tell me that I'm slacking. Otherwise, I'm a 
> volunteer working on things that interest me in my free time. I
> truly do have more important things to do than to figure out how to
> port pngcrush to libpng1.5. Namely, graduate school and midterm
> exams.

The bug is open since February (9 months). If you can't handle a bug
in 9 months then maybe you should consider stepping down as a
maintainer. Handling does not necessarily mean fixing. Masking could
be an acceptable solution as well. The fact that nobody pays us does
not mean that we can use that as an excuse for lower the QA barrier of
portage tree. If only I got a $1 everytime I hear this "excuse"...

> 
> 2) What exactly is it that you want me to do here? Upstream is
> aware of the problem, and seems to be working on it as there are
> comments about libpng15 in pngcrush.c. Hanno kindly stepped in and
> made pngcrush use a bundled libpng14 (and at the same time bundled
> zlib, which has now been fixed), which you promptly masked. I'm not
> sure if the problem is bundled libs in general or specifically
> zlib, but we *know* it's distasteful. It's not like that's a
> preferred or permanent solution. Do you find that somehow more
> distasteful than removing a piece of software from from portage
> that's been in the tree since 2002?
> 

First of all, pay some attention and ready the masking message. It
says "Waiting for upstream to fix it". It says nothing about removal.
Hanno did two commits
1) use bundled zlib and libpng14. Doh this is not a fix. It is barely
a workaround. What if a vulnerability is discovered in the bundled
version of libpng in the next months? Will upstream fix it? Highly
unlikely since they don't seem able to keep up with libpng releases.

2) Next commit, unbundle zlib, use bundled libpng. Say problem as before.

So until you or upstream or someone else comes up with a proper fix
this will remain masked. If you still disagree feel free to talk to QA.

Finally, yes I know that we have plenty of bundled libs around but
this is not an excuse. Sometimes we cannot avoid that but in this case
it makes perfect sense to mask it and proceed with libpng15
stabilization or whatever. Moreover pngcrush has no rdeps so no other
packages affect by this change. We have the same problem with optipng
but we can't mask it because there are reverse dependencies that will
be affected.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOkPu7AAoJEPqDWhW0r/LC5OoP/iqw4tdzp/0blCmvKWqLXt9R
DD1EwrBp0o/cvG7RtwMkezW+IDWkBhmQLwXLxSh2pYtSgBzKs6F9FmyI3xkRO6Ba
1dKunJQaqvWDOrfXjvtZZ8FewovFbefxvekZeOh+6FSXXra3JG2sV0aM5JXuM5Xs
fN5DiGNXwzQV8p3XnG2mNldGzwN+Q3w3uWHkAW/ogxC3R7hluieL7P+UVYF2arCJ
v5JXFBoGmHrTvDh4jG10/vunCV0bhK+diXTLA+L4W3nqdcohvNeaulnSXc+v5Q0W
NS1KPTMtWqbuucWU87z189PH2otCrRBC+YTt7Vr/h8lSMfTWQxYQP2bOIUceh8Ru
SG12y6kfU+NPNZxIH5AeO+yeLapQyVDOQBXqbAW2R4+u3H9XNbFxi9aoKhthLBF5
akXcAO/SVji5reDtoMcvsBCgQeqO3eYjagyr8OfLA8Cfh0SqVRbZ9fx79RKSY0fz
uROKXqcEqcD2o4egc0VXDYGtlPm1xZaTwZzLRG3ZKX5DB+p/Smi/fw4SaK9OY+Si
3my9tTT/3jilhQupDytcRbkDV77yleyRy/1eQCxsm/nOoGLTsvXf7bjLS+sscdDU
HUX9+uD2SQFnUxSPyK0axk4FkXXqPteTGKoSNSG5udIBkUg++K8dKHX0pd8Frq6W
wkkFI+lm4pPABkES2Px+
=5dMm
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Matt Turner]

On Sat, Oct 8, 2011 at 9:41 PM, Markos Chandras <hwoarang@gentoo.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 10/08/11 22:45, Matt Turner wrote:
>> On Sat, Oct 8, 2011 at 10:20 AM, Markos Chandras
>> <hwoarang@gentoo.org> wrote:
>>> On 10/08/2011 02:19 PM, Matt Turner wrote:
>>>> On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen
>>>> <ssuominen@gentoo.org> wrote:
>>>>> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011) #
>>>>> Fails to compile against system libpng15, bug 356127 #
>>>>> Removal in 14 days
>>>>
>>>> 14 days?
>>>>
>>>>> media-gfx/pngcrush
>>>>
>>> We can't really wait forever for slacking maintainers to fix
>>> their packages. amd64 is almost ready to have libpng-1.5 stable
>>> in the very near future
>>
>> Two things:
>>
>> 1) I'm *really* tired of the usage of the word "slacking" on this
>> mailing list. If you or someone else wants to pay me to work on
>> Gentoo, *then* you can tell me that I'm slacking. Otherwise, I'm a
>> volunteer working on things that interest me in my free time. I
>> truly do have more important things to do than to figure out how to
>> port pngcrush to libpng1.5. Namely, graduate school and midterm
>> exams.
>
> The bug is open since February (9 months). If you can't handle a bug
> in 9 months then maybe you should consider stepping down as a
> maintainer. Handling does not necessarily mean fixing. Masking could
> be an acceptable solution as well. The fact that nobody pays us does
> not mean that we can use that as an excuse for lower the QA barrier of
> portage tree. If only I got a $1 everytime I hear this "excuse"...

Maybe you could check the fucking changelog and see that I added
myself as a maintainer in August?

Don't ever ask me for anything again.

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/09/11 02:47, Matt Turner wrote:
> On Sat, Oct 8, 2011 at 9:41 PM, Markos Chandras
> <hwoarang@gentoo.org> wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
>> 
>> On 10/08/11 22:45, Matt Turner wrote:
>>> On Sat, Oct 8, 2011 at 10:20 AM, Markos Chandras 
>>> <hwoarang@gentoo.org> wrote:
>>>> On 10/08/2011 02:19 PM, Matt Turner wrote:
>>>>> On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen 
>>>>> <ssuominen@gentoo.org> wrote:
>>>>>> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011) # 
>>>>>> Fails to compile against system libpng15, bug 356127 # 
>>>>>> Removal in 14 days
>>>>> 
>>>>> 14 days?
>>>>> 
>>>>>> media-gfx/pngcrush
>>>>> 
>>>> We can't really wait forever for slacking maintainers to fix 
>>>> their packages. amd64 is almost ready to have libpng-1.5
>>>> stable in the very near future
>>> 
>>> Two things:
>>> 
>>> 1) I'm *really* tired of the usage of the word "slacking" on
>>> this mailing list. If you or someone else wants to pay me to
>>> work on Gentoo, *then* you can tell me that I'm slacking.
>>> Otherwise, I'm a volunteer working on things that interest me
>>> in my free time. I truly do have more important things to do
>>> than to figure out how to port pngcrush to libpng1.5. Namely,
>>> graduate school and midterm exams.
>> 
>> The bug is open since February (9 months). If you can't handle a
>> bug in 9 months then maybe you should consider stepping down as
>> a maintainer. Handling does not necessarily mean fixing. Masking
>> could be an acceptable solution as well. The fact that nobody
>> pays us does not mean that we can use that as an excuse for lower
>> the QA barrier of portage tree. If only I got a $1 everytime I
>> hear this "excuse"...
> 
> Maybe you could check the fucking changelog and see that I added 
> myself as a maintainer in August?
> 
> Don't ever ask me for anything again.
> 
Watch your language. This is not your $home playroom

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOkWbhAAoJEPqDWhW0r/LCvBYQAKFNFKaK0hxXYtCVWmPHcf7D
RIWs5LtXMXrAaJwR/YRCbIncsWxn6QvEaPKjmovO3WQ5AAOKcFdHMwFqhLipXPfS
Oyn0NAdwZjXFNrOwC88Usfhu0G5yMqqcbF3IucdR538cZS1UA045zmGdkSs1JObp
J7JF1Ac0xv/iVSMsUcvp8e6CNtet/dwj48FdG3gt5dM4F9KkJMwPd87UsomcvjPm
IZMAj+7+yG4JUfabXbBJK9FVw3tLMmBc67xBDyO0Jn4T7X3o6lUapySNHdWApH65
dSPxG5QhH1Knlv6xP238RG2R43AEqBWWyG5IQjim6VwOIE1Z0rYLI+MfvQDHdyFy
BjX+HdXCRoMqsOVvBYvNUAx9yG+5b7iJFsIOKjlE7xaRDA1L/U6+Ltw8xG2ETosO
/0zq9MNvSnUXAvwyvyENcZj3Dnq+TYo67Se7WUIbhtbcT3XIKEo0Fn3FRufCEJIO
AIjm1/8GI1vIgyfzbVlGgiS0POnrR2sb9jpvcy+7GFADY60TwLT9NgbuIGsO5aK8
ykbUEfNqqxOB7S3KwbEVafDX4FLRnS8nk3vH13jz9wDUlfr/wQ6B8Su5eEEtE3zy
FrX4Hqyx+QyncuHyzABqehVVP0H8fyUrpIj07NwA4AaR9kuY6appZftGxxrYl5H4
0cOpv+TR4hLn+iBCbuGF
=7iBJ
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Matt Turner]

On Sun, Oct 9, 2011 at 5:18 AM, Markos Chandras <hwoarang@gentoo.org> wrote:
> Watch your language. This is not your $home playroom

And it's not your mailing list.

I'm sure I'm not the only one that's tired of your Let Me Insert
Myself Into Everything syndrome just because you're on QA. QA's a joke
that's only used as a stick to bludgeon other developers with.

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/09/11 16:15, Matt Turner wrote:
> On Sun, Oct 9, 2011 at 5:18 AM, Markos Chandras
> <hwoarang@gentoo.org> wrote:
>> Watch your language. This is not your $home playroom
> 
> And it's not your mailing list.
> 
> I'm sure I'm not the only one that's tired of your Let Me Insert 
> Myself Into Everything syndrome just because you're on QA. QA's a
> joke that's only used as a stick to bludgeon other developers
> with.
> 
I am not in QA fwiw just trying to keep a basic QA level in portage tree.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOkbwZAAoJEPqDWhW0r/LC8JUP/jAFGT5tDyeqg8jr+WxYp/Z5
YQzadcHOh6vhM60O+mTJeC8ycwRn/fBQXLzvYRtcUytkrUjreBKNwQbvfyPK9F/g
4cW2pwa+QH9w/lGHhsdvvl6qV3rBWZu8BzTUkclIuSLwWrOfBE/Gn/WahBT3wLbw
msjBq837FTTukQUKnFf8HBIotiiikecniNvuINjGKvPmts9C8O5Vu5QOIhNQKltC
mtF9rC9uAuSJuc5m46YCB8RLZpQpw0eZogfCBryRRnd5jv7/B1bTbKfTAtWmwHdf
fXvdAzPsDrb5otRuZYGfmmYtN1tItV87L6kjt8YxT5mv/Gaq4Udy+h32hAOjZJzy
DlsF3xhdZfzVUvEHEkKCxcVqQLBP5LaWmCTOcKYZL8NzZRoLbuOo9VPozc+ayRid
LI13urz7C2fEsb52dWCpO439reZtmWuFTjzIc41p3kMKmbB8ZgvI1HLESQQp6uK4
aGavTdac64rB/iR/jbnnkNvgrC+zPzgjV7eUKELH77krhJ/Jq+LWPY8RMYs3Km1n
+60PzfumFVEp2C/Nk7efOip66QRuNUNU040l3AIGNNFM56OLIJuONXx4uOUViyc0
SszGzPF0OVNzRWMX2Z4BlMkSgpOneInf4v3Ak0EqX/W/0xo/FnDzLCUtik8KwTMz
elVdrJNXCjXa7O+srCE1
=s+wQ
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Matt Turner]

On Sun, Oct 9, 2011 at 11:22 AM, Markos Chandras <hwoarang@gentoo.org> wrote:
> I am not in QA fwiw just trying to keep a basic QA level in portage tree.

Wait, what? If you're not even in QA, then who are you to start
masking other people's packages?

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/11/11 06:22, Matt Turner wrote:
> On Sun, Oct 9, 2011 at 11:22 AM, Markos Chandras
> <hwoarang@gentoo.org> wrote:
>> I am not in QA fwiw just trying to keep a basic QA level in
>> portage tree.
> 
> Wait, what? If you're not even in QA, then who are you to start 
> masking other people's packages?
> 
It seems you don't even bother to read the masking message or my
comments on the bug. I said "Talk to QA and CC me if you want to
discuss this further". Did you? Of course not cause you like trolling
publicly.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOk+tAAAoJEPqDWhW0r/LCeUEP/j7Xgx5zhEKzGw7qn3a25+uu
FxIu9rnqFb1mLTg7GzaCFb6KQNppvPwpcsV7SkE9AUoQCZf5L2RSwBPZQkVMXP4Z
yMBrWHqBmGno9qmSZg5u9iKT7AwbwcukiPFSo1hwaiqosR17AsOXjTizG7BP6/OD
UxhkuFHDOmKeeT4YiIPLRKiCw5K8gCLb9gdhu489oDoBOZueVTGyGVhNdkx7+sLB
SRNH014anoDKLx3K7AF1/nNeYuc7+aozDU9KLhuy+OVmN843VCNZoNrTXzDQSKBB
uD0iUnzRBHdVVNPs5N837IrxP4I5j8JUaLnyARcdWOCNyT/3ffPTTJr5pEMJbfGk
SzF2CxdujfIDyx4MnYc9J/lc3NxQbqdYklzN9rTilIpN/chQ7P13U++W0ssZhFha
cgGi/dlcvFp5BV32Hy74j+xzCU8+yFBKsEKgcaoyL0jkVY7XCTod4C0HYCoo5Rnc
YfYXkN9lOEw4QmW0PQZlt5RskYcH1NwikfTM6d009cliM9DPmNb7EiuMGDIRwWae
mYaMWR+8TMaFK61JaZfvpWMMZh/m8admxVcyld9n/wNskiHKDKPEKb3Wj1109m/S
rrWQBZH2iLR2XMDDBltvyO4flgcmWYzK1KLJTWtn2c1Hqc7A8D8gLYovvDWYmQdZ
4WjciKu85C7HIt9ItnG6
=ByEN
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Nirbheek Chauhan]

On Tue, Oct 11, 2011 at 12:37 PM, Markos Chandras <hwoarang@gentoo.org> wrote:
> On 10/11/11 06:22, Matt Turner wrote:
>> On Sun, Oct 9, 2011 at 11:22 AM, Markos Chandras
>> <hwoarang@gentoo.org> wrote:
>>> I am not in QA fwiw just trying to keep a basic QA level in
>>> portage tree.
>>
>> Wait, what? If you're not even in QA, then who are you to start
>> masking other people's packages?
>>
> It seems you don't even bother to read the masking message or my
> comments on the bug. I said "Talk to QA and CC me if you want to
> discuss this further". Did you? Of course not cause you like trolling
> publicly.
>

What is going on here? Why are you and Matt publicly slinging mud at
each other and defiling this mailing list? Please behave like
gentlemen, and not angry kids.

I request you both to please take this conversation off the mailing
list, and I encourage the pair of you to resolve your differences
personally and amicably[1]. Preferably after a 24hr break to cool
yourselves.

Thank you.

1. If you persist, I offer to instead schedule a duelling session on IRC.

-- 
~Nirbheek Chauhan

Gentoo GNOME+Mozilla Team

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 10/11/11 08:21, Nirbheek Chauhan wrote:
> On Tue, Oct 11, 2011 at 12:37 PM, Markos Chandras
> <hwoarang@gentoo.org> wrote:
>> On 10/11/11 06:22, Matt Turner wrote:
>>> On Sun, Oct 9, 2011 at 11:22 AM, Markos Chandras 
>>> <hwoarang@gentoo.org> wrote:
>>>> I am not in QA fwiw just trying to keep a basic QA level in 
>>>> portage tree.
>>> 
>>> Wait, what? If you're not even in QA, then who are you to
>>> start masking other people's packages?
>>> 
>> It seems you don't even bother to read the masking message or my 
>> comments on the bug. I said "Talk to QA and CC me if you want to 
>> discuss this further". Did you? Of course not cause you like
>> trolling publicly.
>> 
> 
> What is going on here? Why are you and Matt publicly slinging mud
> at each other and defiling this mailing list? Please behave like 
> gentlemen, and not angry kids.
> 
> I request you both to please take this conversation off the
> mailing list, and I encourage the pair of you to resolve your
> differences personally and amicably[1]. Preferably after a 24hr
> break to cool yourselves.
> 
> Thank you.
> 
> 1. If you persist, I offer to instead schedule a duelling session
> on IRC.
> 
The discussion was meant to be between us and QA but public noise is
more fun and draws more attention. The masking message and bug
comments clearly state to consult QA for anything related to this package.

- -- 
Regards,
Markos Chandras / Gentoo Linux Developer / Key ID: B4AFF2C2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAEBCgAGBQJOk++pAAoJEPqDWhW0r/LCRp0P/iGE/coVqC9kF0CKggOkcLU6
Dgp7oY5/l+nn1H+MyLBUH1yCGiTz7v2mrGt2ZzjwlYOnCiI8ApHCrW3J6g9sgKa3
8PvvamORbHRYVRty7DAyGoJmr2cZ8bEu172qUkPp5lWuv0C3fHBh2N8KgWV8Yntk
UJkOhADwMKVSZYKe3Pfb1+j8eX0Oad+2jZIhDaL9JgCobzFYE/ixm6WRjuhvE01n
Yhpj+/8G83jcS3n+NyYNMAPMtymxBOZJcv0KZf+5NsF3tG3oBW6ObzuWYt+NaYE/
6gXgv/UEUMWDb0zSdxzUi0P1kmQEDCtDbRR+Zcv0vBHElvxpsmN6py852hkCQR0S
fojHpd5vaBvzbXUEl1FeRh2dY72kkHVrnWAok1jTM3VFBsAcWgu5Ps6sZQaF+/bB
y8JreIPVJL/tmkI1aqBSUP0NwUi7cLaGPHQBhXKJJU0XK4dYGpGKc+fahxc4SINq
6t+UyTNfZqEQoUcgLCgQSMDxn1lY0r35e4Oi+k6lMSib9ppO9cFHr+tSl56QtGOl
MnJZSD+Vp14KdPaZ0KlTqBpt8+djCVGmEXYp0fYgilHAgLs+IPujIpjDwF2dU7LT
iD8N8/xZVa8wsXc9334jESJIEf8RKbeEvaJ/8kU8dQZfhuNn+8uVIB8l8uaMrbyX
OXOj/+xSTmCJy+QN2rHp
=8DqH
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Matt Turner]

On Tue, Oct 11, 2011 at 3:07 AM, Markos Chandras <hwoarang@gentoo.org> wrote:
>> Wait, what? If you're not even in QA, then who are you to start
>> masking other people's packages?
>>
> It seems you don't even bother to read the masking message or my
> comments on the bug. I said "Talk to QA and CC me if you want to
> discuss this further". Did you?

Of course I did. And at the time "Talk to QA and CC me" made sense
since I thought you were in QA. I don't understand why you'd ask this.

> Of course not cause you like trolling publicly.

Rather, I'm confused. I wouldn't drop into a bug report about another
developer's package and mask it, especially after the temporarily
solution was already acked by another developer.

Re: [gentoo-dev] Lastrite: media-gfx/pngcrush

[Rich Freeman]

On Sat, Oct 8, 2011 at 9:41 PM, Markos Chandras <hwoarang@gentoo.org> wrote:
> 1) use bundled zlib and libpng14. Doh this is not a fix. It is barely
> a workaround. What if a vulnerability is discovered in the bundled
> version of libpng in the next months? Will upstream fix it? Highly
> unlikely since they don't seem able to keep up with libpng releases.

I'm no sure why a bundled library needs to be cause for masking.  If
there is a vulnerability, of course we should mask away if we can't
fix it within the GLSA guidelines.

I think that the general principle of not bundling libraries is a good
one.  However, that shouldn't be the sole reason for excluding a
package from the tree, and right now I can't see any other reason to
exclude this package since bundling the library fixes the block.  I
haven't seen any evidence presented that upstream is lax with security
- not using the latest version of a library simply is a case of "if it
ain't broke, don't fix it."

Rich

[gentoo-dev] Re: Lastrite: media-gfx/pngcrush

[Ryan Hill]

[-- Attachment #1: Type: text/plain, Size: 2293 bytes --]

On Sun, 09 Oct 2011 02:41:15 +0100
Markos Chandras <hwoarang@gentoo.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> On 10/08/11 22:45, Matt Turner wrote:
> > On Sat, Oct 8, 2011 at 10:20 AM, Markos Chandras
> > <hwoarang@gentoo.org> wrote:
> >> On 10/08/2011 02:19 PM, Matt Turner wrote:
> >>> On Sat, Oct 8, 2011 at 4:47 AM, Samuli Suominen 
> >>> <ssuominen@gentoo.org> wrote:
> >>>> # Samuli Suominen <ssuominen@gentoo.org> (08 Oct 2011) #
> >>>> Fails to compile against system libpng15, bug 356127 #
> >>>> Removal in 14 days
> >>> 
> >>> 14 days?
> >>> 
> >>>> media-gfx/pngcrush
> >>> 
> >> We can't really wait forever for slacking maintainers to fix
> >> their packages. amd64 is almost ready to have libpng-1.5 stable
> >> in the very near future
> > 
> > Two things:
> > 
> > 1) I'm *really* tired of the usage of the word "slacking" on this 
> > mailing list. If you or someone else wants to pay me to work on 
> > Gentoo, *then* you can tell me that I'm slacking. Otherwise, I'm a 
> > volunteer working on things that interest me in my free time. I
> > truly do have more important things to do than to figure out how to
> > port pngcrush to libpng1.5. Namely, graduate school and midterm
> > exams.
> 
> The bug is open since February (9 months). If you can't handle a bug
> in 9 months then maybe you should consider stepping down as a
> maintainer. Handling does not necessarily mean fixing. Masking could
> be an acceptable solution as well. The fact that nobody pays us does
> not mean that we can use that as an excuse for lower the QA barrier of
> portage tree. If only I got a $1 everytime I hear this "excuse"...

Um, you really want me to mask my package 9 months in advance because it
blocks some random tracker that I have no idea when will become relevant?

How about no.

The onus of masking the package is on the person that institutes the
deadline.  Stop being surprised that people don't think your personal pet
project is as important as you do.


-- 
fonts, gcc-porting,                  it makes no sense how it makes no sense
toolchain, wxwidgets                           but i'll take it free anytime
@ gentoo.org                EFFD 380E 047A 4B51 D2BD C64F 8AA8 8346 F9A4 0662

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]