[gentoo-project] How do you feel about non-contributing developers with commit access?

[gentoo-project] How do you feel about non-contributing developers with commit access?

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 583 bytes --]

Hello,

The Undertakers team has frequently received various forms of
'criticism' of their effort in attempting to find and retire inactive
developers.  This is getting as far as to claim that we shouldn't retire
anyone because there are no limits on commit slots.

Therefore, I would like to ask the wider community a general question:
how do you feel about preserving commit access for people who no longer
actively commit to Gentoo?  I'm talking about extreme cases, say,
no commits to any user-visible repository for over a year.

-- 
Best regards,
Michał Górny

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 963 bytes --]

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Matthew Thode]

[-- Attachment #1: Type: text/plain, Size: 956 bytes --]

On 18-11-02 16:05:35, Michał Górny wrote:
> Hello,
> 
> The Undertakers team has frequently received various forms of
> 'criticism' of their effort in attempting to find and retire inactive
> developers.  This is getting as far as to claim that we shouldn't retire
> anyone because there are no limits on commit slots.
> 
> Therefore, I would like to ask the wider community a general question:
> how do you feel about preserving commit access for people who no longer
> actively commit to Gentoo?  I'm talking about extreme cases, say,
> no commits to any user-visible repository for over a year.
> 

I'm not sure the exact time, but I think it shouldn't be user-visable,
but 'Gentoo' that should ben what's looked at.

As far as changing the developer to a non-committing developer, what
happens if they want to come back?  Would they need to retake the quiz,
re-find a mentor/recruiter, etc?

-- 
Matthew Thode (prometheanfire)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[M. J. Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 2529 bytes --]

On 02/11/18 16:22, Matthew Thode wrote:
> On 18-11-02 16:05:35, Michał Górny wrote:
>> Hello,
>>
>> The Undertakers team has frequently received various forms of
>> 'criticism' of their effort in attempting to find and retire inactive
>> developers.  This is getting as far as to claim that we shouldn't retire
>> anyone because there are no limits on commit slots.
>>
>> Therefore, I would like to ask the wider community a general question:
>> how do you feel about preserving commit access for people who no longer
>> actively commit to Gentoo?  I'm talking about extreme cases, say,
>> no commits to any user-visible repository for over a year.
>>
> I'm not sure the exact time, but I think it shouldn't be user-visable,
> but 'Gentoo' that should ben what's looked at.
>
> As far as changing the developer to a non-committing developer, what
> happens if they want to come back?  Would they need to retake the quiz,
> re-find a mentor/recruiter, etc?
>
I have long felt that an automated 'devaway' process would actually be
beneficial to Gentoo and other devs, etc, as it would be an easy way to see
if someone was 'active' and accessible; whereas the existing one depends
very much on someone talking on IRC, making commits, answering bugzilla or
github requests or bikeshedding on the mailing lists. Devaway isn't
properly used (in my experience) simply because people forget to set it. Or
its ambiguous because someone sets it, and continues some form of visible
activity with it set.

The reason I say automated, as everybody would be independently held to the
exact same standards uniformly, and whilst there are likely to be some
exceptions, these are probably better use of human 'labour' than doing the
whole job by hand. Also, there would be less confusion because it would be
possible to write a policy/procedure for the 'bot'/automation, and emails
could even be sent out automatically even, to warn potential candidates.

I would also advocate a reduced "dev-refresher" "course" which the
recruiters administer, which is a short form of the quizzes structure,
simply to revisit some of the important salient topics, and any relevant
updates in policy and practice which they might have missed in their absence.

This shouldn't be an onerous procedure to implement, and should greatly aid
the work of the retirement team to best use their limited resources to best
effect; even if that means working around the tooling to make it efficient
and effective to them.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 3474 bytes --]

On Fri, 2 Nov 2018 16:43:28 +0000 M. J. Everitt wrote:
> On 02/11/18 16:22, Matthew Thode wrote:
> > On 18-11-02 16:05:35, Michał Górny wrote:
> >> Hello,
> >>
> >> The Undertakers team has frequently received various forms of
> >> 'criticism' of their effort in attempting to find and retire inactive
> >> developers.  This is getting as far as to claim that we shouldn't retire
> >> anyone because there are no limits on commit slots.
> >>
> >> Therefore, I would like to ask the wider community a general question:
> >> how do you feel about preserving commit access for people who no longer
> >> actively commit to Gentoo?  I'm talking about extreme cases, say,
> >> no commits to any user-visible repository for over a year.
> >>
> > I'm not sure the exact time, but I think it shouldn't be user-visable,
> > but 'Gentoo' that should ben what's looked at.
> >
> > As far as changing the developer to a non-committing developer, what
> > happens if they want to come back?  Would they need to retake the quiz,
> > re-find a mentor/recruiter, etc?
> >
> I have long felt that an automated 'devaway' process would actually be
> beneficial to Gentoo and other devs, etc, as it would be an easy way to see
> if someone was 'active' and accessible; whereas the existing one depends
> very much on someone talking on IRC, making commits, answering bugzilla or
> github requests or bikeshedding on the mailing lists. Devaway isn't
> properly used (in my experience) simply because people forget to set it. Or
> its ambiguous because someone sets it, and continues some form of visible
> activity with it set.
> 
> The reason I say automated, as everybody would be independently held to the
> exact same standards uniformly, and whilst there are likely to be some
> exceptions, these are probably better use of human 'labour' than doing the
> whole job by hand. Also, there would be less confusion because it would be
> possible to write a policy/procedure for the 'bot'/automation, and emails
> could even be sent out automatically even, to warn potential candidates.
> 
> I would also advocate a reduced "dev-refresher" "course" which the
> recruiters administer, which is a short form of the quizzes structure,
> simply to revisit some of the important salient topics, and any relevant
> updates in policy and practice which they might have missed in their absence.
> 
> This shouldn't be an onerous procedure to implement, and should greatly aid
> the work of the retirement team to best use their limited resources to best
> effect; even if that means working around the tooling to make it efficient
> and effective to them.

Looks like you are misunderstanding devaway. This is an
informational message to the community about limited (but not
necassarily zero!) availability. If I read this correctly and you
are proposing to suspend commit access when devaway flag is set,
this is dubious at best.

E.g. this summer I was at hospital, I set devaway flag for estimated
period of unavailability. But when things got better, I was able to
fix some stuff and make some commits. Triggering devaway on and off
in such situation would be ridiculous.

Sometimes people have reduced, but not zero availability, e.g. when
travelling or visiting conferences. Devaway is useful in such cases
to inform community that response time may be bad, but still some
activity may be present.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Jason Zaman]

On Fri, Nov 02, 2018 at 11:22:21AM -0500, Matthew Thode wrote:
> On 18-11-02 16:05:35, Michał Górny wrote:
> > Hello,
> > 
> > The Undertakers team has frequently received various forms of
> > 'criticism' of their effort in attempting to find and retire inactive
> > developers.  This is getting as far as to claim that we shouldn't retire
> > anyone because there are no limits on commit slots.
> > 
> > Therefore, I would like to ask the wider community a general question:
> > how do you feel about preserving commit access for people who no longer
> > actively commit to Gentoo?  I'm talking about extreme cases, say,
> > no commits to any user-visible repository for over a year.
> > 
> 
> I'm not sure the exact time, but I think it shouldn't be user-visable,
> but 'Gentoo' that should ben what's looked at.
> 
> As far as changing the developer to a non-committing developer, what
> happens if they want to come back?  Would they need to retake the quiz,
> re-find a mentor/recruiter, etc?

Yeah it seems like right now never-been-a-dev and
was-busy-so-retired-dev have the same long path to (re)gaining full
commit privs. I'd like if recruiters had some rough criteria for when
you can just become a dev again easily. eg if you havent even used
gentoo for years then obviously re-taking the quizzes is good. if you've
still been using gentoo a ton but not developing then probably could be
re-instated without anything. or if a new big EAPI happened in the
meantime then just read up on the changes and you'd be all set.

-- Jason

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[desultory]

On 11/07/18 07:45, Jason Zaman wrote:
> On Fri, Nov 02, 2018 at 11:22:21AM -0500, Matthew Thode wrote:
>> On 18-11-02 16:05:35, Michał Górny wrote:
>>> Hello,
>>>
>>> The Undertakers team has frequently received various forms of
>>> 'criticism' of their effort in attempting to find and retire inactive
>>> developers.  This is getting as far as to claim that we shouldn't retire
>>> anyone because there are no limits on commit slots.
>>>
>>> Therefore, I would like to ask the wider community a general question:
>>> how do you feel about preserving commit access for people who no longer
>>> actively commit to Gentoo?  I'm talking about extreme cases, say,
>>> no commits to any user-visible repository for over a year.
>>>
>>
>> I'm not sure the exact time, but I think it shouldn't be user-visable,
>> but 'Gentoo' that should ben what's looked at.
>>
>> As far as changing the developer to a non-committing developer, what
>> happens if they want to come back?  Would they need to retake the quiz,
>> re-find a mentor/recruiter, etc?
> 
> Yeah it seems like right now never-been-a-dev and
> was-busy-so-retired-dev have the same long path to (re)gaining full
> commit privs. I'd like if recruiters had some rough criteria for when
> you can just become a dev again easily. eg if you havent even used
> gentoo for years then obviously re-taking the quizzes is good. if you've
> still been using gentoo a ton but not developing then probably could be
> re-instated without anything. or if a new big EAPI happened in the
> meantime then just read up on the changes and you'd be all set.
> 
> -- Jason
> 
> 
> 
It seems as though the perceived difficulty with recruitment is less due
to the process [1], and more due to a lack of people [2] on hand for
handling what little formal recruitment is required and others
pointlessly adding work to the process [3].

[1] https://www.gentoo.org/get-involved/become-developer/
[2] https://wiki.gentoo.org/wiki/Project:Recruiters
[3] https://bugs.gentoo.org/26943

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Matt Turner]

On Sun, Nov 11, 2018 at 8:39 PM desultory <desultory@gentoo.org> wrote:
> It seems as though the perceived difficulty with recruitment is less due
> to the process [1], and more due to a lack of people [2] on hand for
> handling what little formal recruitment is required and others
> pointlessly adding work to the process [3].
>
> [1] https://www.gentoo.org/get-involved/become-developer/
> [2] https://wiki.gentoo.org/wiki/Project:Recruiters
> [3] https://bugs.gentoo.org/26943

I see no one in the recruitment queue, so I don't think the recruiters
are a bottleneck.

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[M. J. Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 830 bytes --]

On 14/11/18 20:08, Matt Turner wrote:
> On Sun, Nov 11, 2018 at 8:39 PM desultory <desultory@gentoo.org> wrote:
>> It seems as though the perceived difficulty with recruitment is less due
>> to the process [1], and more due to a lack of people [2] on hand for
>> handling what little formal recruitment is required and others
>> pointlessly adding work to the process [3].
>>
>> [1] https://www.gentoo.org/get-involved/become-developer/
>> [2] https://wiki.gentoo.org/wiki/Project:Recruiters
>> [3] https://bugs.gentoo.org/26943
> I see no one in the recruitment queue, so I don't think the recruiters
> are a bottleneck.
>
Whilst I wouldn't even speculate, even for a moment, is that because
they're so efficient to close off any potential applications before or when
they reach their attention?!

</cynical>


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[M. J. Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 993 bytes --]

On 14/11/18 20:13, M. J. Everitt wrote:
> On 14/11/18 20:08, Matt Turner wrote:
>> On Sun, Nov 11, 2018 at 8:39 PM desultory <desultory@gentoo.org> wrote:
>>> It seems as though the perceived difficulty with recruitment is less due
>>> to the process [1], and more due to a lack of people [2] on hand for
>>> handling what little formal recruitment is required and others
>>> pointlessly adding work to the process [3].
>>>
>>> [1] https://www.gentoo.org/get-involved/become-developer/
>>> [2] https://wiki.gentoo.org/wiki/Project:Recruiters
>>> [3] https://bugs.gentoo.org/26943
>> I see no one in the recruitment queue, so I don't think the recruiters
>> are a bottleneck.
>>
> Whilst I wouldn't even speculate, even for a moment, is that because
> they're so efficient to close off any potential applications before or when
> they reach their attention?!
>
> </cynical>
>
By which I mean a recruitment 'queue' would be the sign of a healthy
recruitment project ....


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Michael Orlitzky]

On 11/02/2018 11:05 AM, Michał Górny wrote:
> This is getting as far as to claim that we shouldn't retire
> anyone because there are no limits on commit slots...
> 
> how do you feel about preserving commit access for people who no longer
> actively commit to Gentoo?  I'm talking about extreme cases

Some judgment should be used, but it *should* go without saying that
it's bad security to leave accounts enabled when you don't know WTF
happened to the people with the credentials.

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1103 bytes --]

Hi,

On Fri, 02 Nov 2018 16:05:35 +0100 Michał Górny wrote:
> Hello,
> 
> The Undertakers team has frequently received various forms of
> 'criticism' of their effort in attempting to find and retire inactive
> developers.  This is getting as far as to claim that we shouldn't retire
> anyone because there are no limits on commit slots.
> 
> Therefore, I would like to ask the wider community a general question:
> how do you feel about preserving commit access for people who no longer
> actively commit to Gentoo?  I'm talking about extreme cases, say,
> no commits to any user-visible repository for over a year.

Due to security concerns one year of inactivity is a fair margin for
retirement, but AFAIK with current policy undertakers may become
active after 2 months of inactivity and are quite active after half
a year.

Also care should be taken to account indirect commits, e.g. when
developer in question is author, but not commiter. This may happen
due to many reasons, e.g. review and commit by a maintainer which
is another dev.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

[gentoo-project] How do you feel about non-contributing developers with commit access?

[Sam Jorna (wraeth)]

[-- Attachment #1.1: Type: text/plain, Size: 1839 bytes --]

On 3/11/18 2:05 am, Michał Górny wrote:
> Hello,
> 
> The Undertakers team has frequently received various forms of
> 'criticism' of their effort in attempting to find and retire inactive
> developers.  This is getting as far as to claim that we shouldn't retire
> anyone because there are no limits on commit slots.
> 
> Therefore, I would like to ask the wider community a general question:
> how do you feel about preserving commit access for people who no longer
> actively commit to Gentoo?  I'm talking about extreme cases, say,
> no commits to any user-visible repository for over a year.

Hello.

I'd like to suggest that developers be allowed to retain commit
privileges until and unless they are unresponsive to status queries or
have demonstrated some kind of negative intent.

I understand the concern of allowing commit access to persist for AWOL
contributors, but for those with low commit frequency it's effectively
saying "your volunteer contributions aren't enough".

For myself, due to various factors my time for productive commit
development is severely limited, but as I only maintain a couple of
packages which, to my knowledge, don't have any issues, removing commit
access just means those that I do maintain become orphaned, and when I
do get time to work on something I have to work through GitHub or
Bugzilla, increasing work for whichever developer is kind enough to
facilitate my contribution. I am, however, able to be reached quickly,
and responsive to queries.

If a developer is present, is not neglecting anything they maintain, has
not demonstrated any malicious intent, and is offering to spend what
time they can on contributions when they have the time to ensure they
don't break anything, why stop them?

Thanks;
-- 
Sam Jorna (wraeth)
GPG ID: 0xD6180C26


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Raymond Jennings]

On Mon, Nov 5, 2018 at 5:11 PM Sam Jorna (wraeth) <wraeth@gentoo.org> wrote:
>
> On 3/11/18 2:05 am, Michał Górny wrote:
> > Hello,
> >
> > The Undertakers team has frequently received various forms of
> > 'criticism' of their effort in attempting to find and retire inactive
> > developers.  This is getting as far as to claim that we shouldn't retire
> > anyone because there are no limits on commit slots.
> >
> > Therefore, I would like to ask the wider community a general question:
> > how do you feel about preserving commit access for people who no longer
> > actively commit to Gentoo?  I'm talking about extreme cases, say,
> > no commits to any user-visible repository for over a year.
>
> Hello.
>
> I'd like to suggest that developers be allowed to retain commit
> privileges until and unless they are unresponsive to status queries or
> have demonstrated some kind of negative intent.

> I understand the concern of allowing commit access to persist for AWOL
> contributors, but for those with low commit frequency it's effectively
> saying "your volunteer contributions aren't enough".

And this is not in my opinion the kind of message we want to send,
unless we want gentoo to become an elitist that only welcomes people
who are "productive enough", which in my opinion also aggravates the
risk of burnout.  Quite frankly, "you aren't active enough to deserve
to keep your developer status" is rather demoralizing, especially
since we aren't actually being paid to work on Gentoo, at least not
out of the Foundation's budget.

From what I know, the undertakers project already has procedures in
place for determining if a developer is inactive before they are
retired, and I think the same procedures would apply just as easily

> For myself, due to various factors my time for productive commit
> development is severely limited, but as I only maintain a couple of
> packages which, to my knowledge, don't have any issues, removing commit
> access just means those that I do maintain become orphaned, and when I
> do get time to work on something I have to work through GitHub or
> Bugzilla, increasing work for whichever developer is kind enough to
> facilitate my contribution. I am, however, able to be reached quickly,
> and responsive to queries.
>
> If a developer is present, is not neglecting anything they maintain, has
> not demonstrated any malicious intent, and is offering to spend what
> time they can on contributions when they have the time to ensure they
> don't break anything, why stop them?

I second this motion.  Having been removed from proxy maintainers for
inactivity myself (and against my objections as well) I can speak to
the increased load of being made aware of future bugs in the projects
I used to work on.  It adds unnecessary red tape to make developers
jump through hoops to contribute.

At the very least, once someone has passed muster with recruiters and
whatnot they shouldn't have to do a heap of paperwork just to get back
in.  Maybe email once every few months to see if they're still
responsive, and a quick check to make sure their SSH/GPG keys are
still
valid and that there are no technical issues, but I oppose any changes
in one's status as a developer just on inactivity alone.

Also, I would like to advance an example I personally encountered:

What if there's simply nothing for the developer to do?  Like if for
example they're maintaining a package that's gone quiet upstream but
which doesn't have any bugs open against it either?

No, this doesn't include the idle developer simply finding a neglected
area of gentoo to work on instead.  The pool of available work to
perform is still going to be finite, and on top of that the areas of
gentoo needing attention when another area stops giving developers
something to do may simply be outside their expertise.

If someone has proven they can contribute and be trusted they
shouldn't be removed in my opinion.  As long as they aren't slacking
off or sabotaging the distro.  Going AWOL /with/ outstanding work on
your desk, such as open bugs against packages you maintain?  That is
more serious and should probably warrant attention from the
undertakers.  But just going quiet period?  Not so much since their
absence isn't hurting Gentoo.  The question is: is their retention of
access causing harm to gentoo or obstructing development?

If they answer their emails from the undertakers that should be good
enough assuming they haven't actively gone against Gentoo.

I would also like to ask:

Why should we remove them in the first place?  As far as I know,
letting people keep developer status and commit access doesn't burden
Gentoo unduly.

* If they're contributing, the overhead of incorporating their
contributions is an investment
* If they're not contributing, but haven't done anything harmful, then
there's no burden
* If they're harming the distro then they can be removed whether
they're a burden or not.

> Thanks;
> --
> Sam Jorna (wraeth)
> GPG ID: 0xD6180C26
>

[gentoo-project] How do you feel about non-contributing developers with commit access?

[Sam Jorna (wraeth)]

[-- Attachment #1.1: Type: text/plain, Size: 2303 bytes --]

On 6/11/18 4:12 pm, Raymond Jennings wrote:
>  From what I know, the undertakers project already has procedures in
> place for determining if a developer is inactive before they are
> retired, and I think the same procedures would apply just as easily

I'm not quite sure what you mean here, and it's kind of the crux of the
question as I understand it - should $developer who appears inactive
based on $policy be forcibly retired. I'm suggesting $policy cater for
low commit frequency with no outstanding issues so long as they're
available (or reasonably devaway) and not detrimental to the distro.

> At the very least, once someone has passed muster with recruiters and
> whatnot they shouldn't have to do a heap of paperwork just to get back
> in.  Maybe email once every few months to see if they're still
> responsive, and a quick check to make sure their SSH/GPG keys are
> still
> valid and that there are no technical issues, but I oppose any changes
> in one's status as a developer just on inactivity alone.

I think this is also touching on another issue - re-recruitment of
previous developers. I agree with making sure things like keys are
up-to-date and there aren't any outstanding technical, maintenance, or
security issues, though.

> If someone has proven they can contribute and be trusted they
> shouldn't be removed in my opinion.  As long as they aren't slacking
> off or sabotaging the distro.  Going AWOL /with/ outstanding work on
> your desk, such as open bugs against packages you maintain?  That is
> more serious and should probably warrant attention from the
> undertakers.  But just going quiet period?  Not so much since their
> absence isn't hurting Gentoo.  The question is: is their retention of
> access causing harm to gentoo or obstructing development?

I don't think it's a question of obstructing development but of ensuring
there aren't any holes in security, such as retaining access for someone
that no-one's heard from and, as such, could have had anything happen,
including having passwords or keys stolen.

I do think that gauging the difference between inactive and infrequent
is difficult, and don't really have any constructive suggestions on that
point as yet.

-- 
Sam Jorna (wraeth)
GPG ID: 0xD6180C26


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Raymond Jennings]

On Tue, Nov 6, 2018 at 1:16 AM Sam Jorna (wraeth) <wraeth@gentoo.org> wrote:
> On 6/11/18 4:12 pm, Raymond Jennings wrote:
> >  From what I know, the undertakers project already has procedures in
> > place for determining if a developer is inactive before they are
> > retired, and I think the same procedures would apply just as easily
>
> I'm not quite sure what you mean here, and it's kind of the crux of the
> question as I understand it - should $developer who appears inactive
> based on $policy be forcibly retired. I'm suggesting $policy cater for
> low commit frequency with no outstanding issues so long as they're
> available (or reasonably devaway) and not detrimental to the distro.

By procedures I meant that the prospective retiree gets emailed a
couple of times before they get reaped.

> > At the very least, once someone has passed muster with recruiters and
> > whatnot they shouldn't have to do a heap of paperwork just to get back
> > in.  Maybe email once every few months to see if they're still
> > responsive, and a quick check to make sure their SSH/GPG keys are
> > still
> > valid and that there are no technical issues, but I oppose any changes
> > in one's status as a developer just on inactivity alone.
>
> I think this is also touching on another issue - re-recruitment of
> previous developers. I agree with making sure things like keys are
> up-to-date and there aren't any outstanding technical, maintenance, or
> security issues, though.
>
> > If someone has proven they can contribute and be trusted they
> > shouldn't be removed in my opinion.  As long as they aren't slacking
> > off or sabotaging the distro.  Going AWOL /with/ outstanding work on
> > your desk, such as open bugs against packages you maintain?  That is
> > more serious and should probably warrant attention from the
> > undertakers.  But just going quiet period?  Not so much since their
> > absence isn't hurting Gentoo.  The question is: is their retention of
> > access causing harm to gentoo or obstructing development?
>
> I don't think it's a question of obstructing development but of ensuring
> there aren't any holes in security, such as retaining access for someone
> that no-one's heard from and, as such, could have had anything happen,
> including having passwords or keys stolen.
>
> I do think that gauging the difference between inactive and infrequent
> is difficult, and don't really have any constructive suggestions on that
> point as yet.

My suggestion is to attempt periodic contact, which if I read the docs
is already the status quo as part of the retirement process.

> --
> Sam Jorna (wraeth)
> GPG ID: 0xD6180C26
>

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 2296 bytes --]

On Fri, Nov 2, 2018 at 11:05 AM Michał Górny <mgorny@gentoo.org> wrote:

> Hello,
>
> The Undertakers team has frequently received various forms of
> 'criticism' of their effort in attempting to find and retire inactive
> developers.  This is getting as far as to claim that we shouldn't retire
> anyone because there are no limits on commit slots.
>

So I think the problems are not about commit slots (I think that is a poor
way to think about it.) I think the problems we have seen are around
developers who lose interest in various areas of the tree.

 - Herds / Projects that list N people, but really only have 1-2 active
developers. Sometimes the herd / project has no active developers.
 - Metadata.xml that lists N people, but really only have 1-2 active
maintainers. Sometimes the package has no active developers.

The result of the above are essentially:
 - Work on a given area of the tree has to wait some time while the
existing (inactive) maintainer is pinged.
 - A given area of the tree may look well covered (e.g. package has many
maintainers listed) when in fact this is untrue and none of the maintainers
are active. This leads to developers possibly ignoring that portion of the
tree.

To me, retiring 'inactive' developers is really done to address these
issues. If inactive developers are removed from maintainer lists from time
to time, we get a better signal on what packages are actively maintained,
vs packages that need more support.

I don't have any particular problem with people who maintain only a few
packages; they may not commit often but as long as they care for the
packages assigned to them I think they still bring value. The trick is
differentiating between these people and inactive people. This is one
reason why we always email people; there is an expectation that active
developers respond to email and inactive developers do not. It seems to
have served us well thus far.


>
> Therefore, I would like to ask the wider community a general question:
> how do you feel about preserving commit access for people who no longer
> actively commit to Gentoo?  I'm talking about extreme cases, say,
> no commits to any user-visible repository for over a year.
>

> --
> Best regards,
> Michał Górny
>

[-- Attachment #2: Type: text/html, Size: 2968 bytes --]

Re: [gentoo-project] How do you feel about non-contributing developers with commit access?

[Raymond Jennings]

I stand by what I said.

Before revoking commit access, first make sure that their absence is
not actively obstructing development, like if their maintainership is
occupying packages in need of attention that they aren't looking after
and which can't be tampered with by others without infringing on that
maintainership.  Check to see if there's outstanding bugs against the
packages.

Then simply email them as stipulated in undertaking procedures.

Personally, I think that revocation of commit access and retirement
should be considered two distinct processes.

Commit access can be revoked and restored with a little bit of
administration, and if a developer is inactive for a lengthy period of
time, whether they make use of devaway or not, they should have their
commit access temporarily revoked just on grounds of security
principles.  Dormant accounts are potentially vulnerable to being
hijacked.  This is where the developer's responses (or lack thereof)
to activity probing emails should come in handy.

Actual retirement though in my opinion should be reserved for cases
where their absence is actively harming development, for example by
having their absentee maintainership of a package or whatnot obstruct
maintenance or bugfixing or development or what have you.

In my opinion the last thing gentoo needs is to make it harder for
people to contribute.

My two cents.

On Mon, Nov 12, 2018 at 3:22 PM Alec Warner <antarus@gentoo.org> wrote:
>
> On Fri, Nov 2, 2018 at 11:05 AM Michał Górny <mgorny@gentoo.org> wrote:
>>
>> Hello,
>>
>> The Undertakers team has frequently received various forms of
>> 'criticism' of their effort in attempting to find and retire inactive
>> developers.  This is getting as far as to claim that we shouldn't retire
>> anyone because there are no limits on commit slots.
>
>
> So I think the problems are not about commit slots (I think that is a poor way to think about it.) I think the problems we have seen are around developers who lose interest in various areas of the tree.
>
>  - Herds / Projects that list N people, but really only have 1-2 active developers. Sometimes the herd / project has no active developers.
>  - Metadata.xml that lists N people, but really only have 1-2 active maintainers. Sometimes the package has no active developers.
>
> The result of the above are essentially:
>  - Work on a given area of the tree has to wait some time while the existing (inactive) maintainer is pinged.
>  - A given area of the tree may look well covered (e.g. package has many maintainers listed) when in fact this is untrue and none of the maintainers are active. This leads to developers possibly ignoring that portion of the tree.
>
> To me, retiring 'inactive' developers is really done to address these issues. If inactive developers are removed from maintainer lists from time to time, we get a better signal on what packages are actively maintained, vs packages that need more support.
>
> I don't have any particular problem with people who maintain only a few packages; they may not commit often but as long as they care for the packages assigned to them I think they still bring value. The trick is differentiating between these people and inactive people. This is one reason why we always email people; there is an expectation that active developers respond to email and inactive developers do not. It seems to have served us well thus far.
>
>>
>>
>> Therefore, I would like to ask the wider community a general question:
>> how do you feel about preserving commit access for people who no longer
>> actively commit to Gentoo?  I'm talking about extreme cases, say,
>> no commits to any user-visible repository for over a year.
>>
>>
>> --
>> Best regards,
>> Michał Górny