[gentoo-project] Gentoo, GitHub, and the Social Contract

[gentoo-project] Gentoo, GitHub, and the Social Contract

[Andreas K. Huettel]

[-- Attachment #1: Type: Text/Plain, Size: 1086 bytes --]


Hi all, 

whenever the suggestion comes up to enable contributions to Gentoo via Github 
pull requests, we also encounter discussion of the Gentoo Social Contract.

The two points that are seen as conflicting are

* The software running Github is closed source, proprietary.

* The Gentoo Social Contract states [1]:
"Gentoo will never depend upon a piece of software or metadata unless it 
conforms to the GNU General Public License, the GNU Lesser General Public 
License, the Creative Commons - Attribution/Share Alike or some other license 
approved by the Open Source Initiative (OSI)."

We need to resolve this discussion somehow, by formulating a clear policy. 
Which is why I'm putting it up here for discussion and will ask to add it to 
the next council meeting agenda. 

Many arguments have already been made. Feel free to summarize your points 
again in a reply to this e-mail.

Cheers, 
Andreas

[1] http://www.gentoo.org/main/en/contract.xml

-- 

Andreas K. Huettel
Gentoo Linux developer 
dilfridge@gentoo.org
http://www.akhuettel.de/

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 951 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Anthony G. Basile]

On 02/14/15 15:48, Andreas K. Huettel wrote:
> Hi all,
>
> whenever the suggestion comes up to enable contributions to Gentoo via Github
> pull requests, we also encounter discussion of the Gentoo Social Contract.
>
> The two points that are seen as conflicting are
>
> * The software running Github is closed source, proprietary.
>
> * The Gentoo Social Contract states [1]:
> "Gentoo will never depend upon a piece of software or metadata unless it
> conforms to the GNU General Public License, the GNU Lesser General Public
> License, the Creative Commons - Attribution/Share Alike or some other license
> approved by the Open Source Initiative (OSI)."
>
> We need to resolve this discussion somehow, by formulating a clear policy.
> Which is why I'm putting it up here for discussion and will ask to add it to
> the next council meeting agenda.
>
> Many arguments have already been made. Feel free to summarize your points
> again in a reply to this e-mail.
>
> Cheers,
> Andreas
>
> [1] http://www.gentoo.org/main/en/contract.xml
>

I didn't know that was in our social contract, but I totally stand 
behind it.  I feel very uneasy about our increasing use/dependency on 
github.  I'd like to see the stuff we have on github migrate back to our 
infra.

-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Kristian Fiskerstrand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 02/14/2015 09:55 PM, Anthony G. Basile wrote:
> On 02/14/15 15:48, Andreas K. Huettel wrote:
>> Hi all,
>> 


..


>> 
>> Many arguments have already been made. Feel free to summarize
>> your points again in a reply to this e-mail.
>> 
>> Cheers, Andreas
>> 

First of all, thank you Andreas for brining this up in an appropriate
thread of its own.

> 
> I didn't know that was in our social contract, but I totally stand 
> behind it.  I feel very uneasy about our increasing use/dependency
> on github.  I'd like to see the stuff we have on github migrate
> back to our infra.
> 

The most important part here is "depend upon". As long as the primary
repository and developer workflow internally happens on infra hosted
systems, having a copy of the repository on github to allow external
contributions is no issue the way I interpret it, and it can only be a
positive thing if we get such contributions. However, this should not
be used as a primary component of the workflow, and people should
certainly keep the social contract in mind when structuring projects.

It would of course be even better if we had our own infrastructure, or
procedures, in place to enable this within our own infrastructure. But
from what I can see in the various discussion, the review tools that
have been mentioned really are not up to par in terms of release
management and possibility to keep up to date and secure in any sane
way. How this can be the situation in the first place is a longer (and
perhaps scarier) discussion.

- -- 
Kristian Fiskerstrand
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJU37mMAAoJEP7VAChXwav6ffUH/0E4lez3noTIVu2FqdLn0nfK
sUwJdRk7KG8AV+E6o39JNasC6Ku4O6/2kl+sNIRp3FpStvXfs1GM1ImhtxHrw8K/
+KzikyfLv8TfwHj10qsQHY1/RPUtmQfJ+RgRyHDTGUKpUqx4+UJlUovPFkR3egC7
qbEBdpu2hb3ZC1WxAxS1w/RzxuyDT67UixvozzC8UErliVp5gj10BxTZJ/C7Dr4K
opLMgmu3rbMnh36W3bgXWItSwiTDFuaj2R1D27qmcOcQgv7oGecEPmt6Oxyc7AJ1
uken67qfJLjO2PG1UC+tBfUA1Hl53hdz8RqUjCED4lQMF/VRD7ZDQS5G9LFPvRo=
=55Qz
-----END PGP SIGNATURE-----

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Alexander Berntsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 14/02/15 22:09, Kristian Fiskerstrand wrote:
> The most important part here is "depend upon".
I agree.

No one should be forced to use proprietary software at any point, and
no Gentoo-related project should depend on proprietary software.

Using github as a mirror is fine, provided we do not force
contributors to use github to contribute patches.
- -- 
Alexander
bernalex@gentoo.org
https://secure.plaimi.net/~alexander

[[[
Roses are red, violets are blue; I use free software to encrypt my
online communication and so should you!
https://emailselfdefense.fsf.org
]]]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlTfvMMACgkQRtClrXBQc7UYuAD+KolAyw6i0E4QNWCrV67eshVC
LItRwXUbqzl/7/cv9EQA/3DF83+Pvr+HBK3xj9yJSngvJW4bIYnHbkbi2x1tUrOc
=Isv8
-----END PGP SIGNATURE-----

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 2374 bytes --]

On Sat, 14 Feb 2015 21:48:22 +0100 Andreas K. Huettel wrote:
> 
> Hi all, 
> 
> whenever the suggestion comes up to enable contributions to Gentoo via Github 
> pull requests, we also encounter discussion of the Gentoo Social Contract.
> 
> The two points that are seen as conflicting are
> 
> * The software running Github is closed source, proprietary.
> 
> * The Gentoo Social Contract states [1]:
> "Gentoo will never depend upon a piece of software or metadata unless it 
> conforms to the GNU General Public License, the GNU Lesser General Public 
> License, the Creative Commons - Attribution/Share Alike or some other license 
> approved by the Open Source Initiative (OSI)."
> 
> We need to resolve this discussion somehow, by formulating a clear policy. 
> Which is why I'm putting it up here for discussion and will ask to add it to 
> the next council meeting agenda. 
> 
> Many arguments have already been made. Feel free to summarize your points 
> again in a reply to this e-mail.

The best way will be to setup our own git platform on Gentoo's own
hosting.

I'm aware of two alternatives: gitlab[1] and gogs[2]. We setup both
at our university for local projects. From our experience gogs is
50x times faster (in terms of CPU and action execution time) than
gitlab. Not so surprising, because gitlab is on ruby interpreters
and gogs is on compiled Go code.

I fully support Gentoo social contract statement that Gentoo should
not depend on non-OSI products, especially on closed proprietary
products despite their wide popularity. Another risk that it may go
away or change its usage policy to an unacceptable state, or become
paid-only and so on at any moment even without warning.

And the last but not the least. Github was or is blocked in some
countries, e.g. it was recently blocked in Russia; this accident
was resolved and Github is available again here, but nobody knows
what will become later. By having separate hosting, ip and url from
other projects Gentoo will minimize legal risks, at least in some
areas.

I don't mind if github will be used unofficially, but any Gentoo
official project should have base functionality available outside
of Github (of course nobody denies to have backups on Github too).

[1] https://about.gitlab.com/
[2] http://gogs.io/

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Sat, Feb 14, 2015 at 3:48 PM, Andreas K. Huettel
<dilfridge@gentoo.org> wrote:
>
> We need to resolve this discussion somehow, by formulating a clear policy.
> Which is why I'm putting it up here for discussion and will ask to add it to
> the next council meeting agenda.

I tend to agree with what seems to be the general sentiment.  As long
as we still accept patches via bugzilla/etc, then we aren't
"depending" on github.

FOSS alternatives are to be preferred, but since we don't have those
set up, I don't see why we have to live without anything in the
meantime.  If somebody wants to host such a thing, I'd encourage them
to do so, and work with infra if they'll accept help.

-- 
Rich

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Kristian Fiskerstrand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 02/14/2015 10:37 PM, Rich Freeman wrote:
> On Sat, Feb 14, 2015 at 3:48 PM, Andreas K. Huettel 
> <dilfridge@gentoo.org> wrote:
>> 
>> We need to resolve this discussion somehow, by formulating a
>> clear policy. Which is why I'm putting it up here for discussion
>> and will ask to add it to the next council meeting agenda.
> 
> I tend to agree with what seems to be the general sentiment.  As
> long as we still accept patches via bugzilla/etc, then we aren't 
> "depending" on github.

That depends on where the primary repository of the project lies.
Whether it is primary on gentoo infra or if GitHub is de-facto primary
repository. If the latter it is a problem.

- -- 
Kristian Fiskerstrand
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJU38EwAAoJEP7VAChXwav60ZsIAJb16/W1X0YiVQx5sIb1bvP2
Is7P4+Sp6ZCuXqY0/PjXLua0w+K4sP3uCLRuSOMrfSASGH6K+Wd41sFBkeDrUbyE
9g5vPkVWXM9C92eBmdEPJhDOZ5FmPAeLmSBqLCcXIs5BivBrfZMUXvlyDcHFtvUk
FGbcGf9Mjk0c8z5qjlDmtfnu2SBbQZjAaXX4S1+1tkZxzypiPUDkQmG7Yys9clfH
TGQ+yhVpp6K4Dq4AbK3rxn55eI80I8nHt6MFM7d7Ql64eaC7FmTJlr9ZozLqmTux
mJO1Ne0xnTW7JMncar0gehRWwoqcnYTzqyzbqtHHKA6zpTGLOZ051CKDdXf9vVg=
=dOBL
-----END PGP SIGNATURE-----

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Sat, Feb 14, 2015 at 4:42 PM, Kristian Fiskerstrand <k_f@gentoo.org> wrote:
>
> That depends on where the primary repository of the project lies.
> Whether it is primary on gentoo infra or if GitHub is de-facto primary
> repository. If the latter it is a problem.
>

Well, as far as I'm concerned, the primary repository for Gentoo is
the one on my PC, because that is the only one I actually directly
commit to.  For the typical user, the primary repository is whatever
tarball they last webrsync'ed from, since that is the one containing
all the bugs they're currently suffering through.  The whole concept
of a "primary repository" is somewhat diminished these days.  :)

But, sure, in general I'd prefer if something hosted by infra is
up-to-date.  One of the challenges is that infra is only staffed to do
so much, and it seems like everybody wants to do far more.  It doesn't
help that a lot of the fancier stuff tends to be harder to maintain on
servers, although I'm not sure if that is because we tend to update
them in place (I am not a professional sysadmin, but the ones I talk
to seem to avoid doing that much these days).

-- 
Rich

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Alexander Berntsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 14/02/15 22:56, Rich Freeman wrote:
> Well, as far as I'm concerned, the primary repository for Gentoo
> is the one on my PC, because that is the only one I actually
> directly commit to.  For the typical user, the primary repository
> is whatever tarball they last webrsync'ed from, since that is the
> one containing all the bugs they're currently suffering through.
> The whole concept of a "primary repository" is somewhat diminished
> these days.  :)
Are you being serious? This is bogus.
- -- 
Alexander
bernalex@gentoo.org
https://secure.plaimi.net/~alexander
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlTfx2wACgkQRtClrXBQc7VPNQD/dXu+UymudSDvHTcs+jIMBGyj
5c032TozLIFyxzraT/AA/1E43QVd0U9y1SjPXRpNyluLLLH3FmHbyiA4Ua4jnmpe
=PYWF
-----END PGP SIGNATURE-----

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 658 bytes --]

On Sat, 14 Feb 2015 23:08:49 +0100
Alexander Berntsen <bernalex@gentoo.org> wrote:
> On 14/02/15 22:56, Rich Freeman wrote:
> > Well, as far as I'm concerned, the primary repository for Gentoo
> > is the one on my PC, because that is the only one I actually
> > directly commit to.  For the typical user, the primary repository
> > is whatever tarball they last webrsync'ed from, since that is the
> > one containing all the bugs they're currently suffering through.
> > The whole concept of a "primary repository" is somewhat diminished
> > these days.  :)
> Are you being serious? This is bogus.

That's how Git works.

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Alexander Berntsen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 14/02/15 23:13, Ciaran McCreesh wrote:
> That's how Git works.
Consider contributors (Gentoo developers or not) that want to submit
patches to a project. They should have access to the primary
repository (git or not), and be able to contribute without being
forced to use proprietary software. This is incredibly easy to
facilitate, so I don't expect us to have a problem related to github
and our social mission here.
- -- 
Alexander
bernalex@gentoo.org
https://secure.plaimi.net/~alexander
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlTfyvMACgkQRtClrXBQc7U20wD7BLm7fCshELFcGXUNo+W2O/yg
bjp8BIbocYM/0lNZ+PwA/A9qjJmZu/fnD3nSY5nARWSaBspyQQnKeATMewc/6LDt
=Yl1I
-----END PGP SIGNATURE-----

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 753 bytes --]

On Sat, 14 Feb 2015 23:23:48 +0100
Alexander Berntsen <bernalex@gentoo.org> wrote:
> On 14/02/15 23:13, Ciaran McCreesh wrote:
> > That's how Git works.
>
> Consider contributors (Gentoo developers or not) that want to submit
> patches to a project. They should have access to the primary
> repository (git or not), and be able to contribute without being
> forced to use proprietary software. This is incredibly easy to
> facilitate, so I don't expect us to have a problem related to github
> and our social mission here.

What if their ISP runs proprietary software to manage its network? Will
Gentoo accept patches by pigeon? (Obviously the postal service can't be
relied upon to not use proprietary software.)

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 999 bytes --]

On Sat, 14 Feb 2015 22:31:48 +0000 Ciaran McCreesh wrote:
> On Sat, 14 Feb 2015 23:23:48 +0100
> Alexander Berntsen <bernalex@gentoo.org> wrote:
> > On 14/02/15 23:13, Ciaran McCreesh wrote:
> > > That's how Git works.
> >
> > Consider contributors (Gentoo developers or not) that want to submit
> > patches to a project. They should have access to the primary
> > repository (git or not), and be able to contribute without being
> > forced to use proprietary software. This is incredibly easy to
> > facilitate, so I don't expect us to have a problem related to github
> > and our social mission here.
> 
> What if their ISP runs proprietary software to manage its network? Will
> Gentoo accept patches by pigeon? (Obviously the postal service can't be
> relied upon to not use proprietary software.)

One should not confuse transparent data transmission mediator and
active data management engine required to create, submit or
apply changes.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 1283 bytes --]

On Sun, 15 Feb 2015 01:35:40 +0300
Andrew Savchenko <bircoph@gentoo.org> wrote:
> On Sat, 14 Feb 2015 22:31:48 +0000 Ciaran McCreesh wrote:
> > On Sat, 14 Feb 2015 23:23:48 +0100
> > Alexander Berntsen <bernalex@gentoo.org> wrote:
> > > On 14/02/15 23:13, Ciaran McCreesh wrote:
> > > > That's how Git works.
> > >
> > > Consider contributors (Gentoo developers or not) that want to
> > > submit patches to a project. They should have access to the
> > > primary repository (git or not), and be able to contribute
> > > without being forced to use proprietary software. This is
> > > incredibly easy to facilitate, so I don't expect us to have a
> > > problem related to github and our social mission here.
> > 
> > What if their ISP runs proprietary software to manage its network?
> > Will Gentoo accept patches by pigeon? (Obviously the postal service
> > can't be relied upon to not use proprietary software.)
> 
> One should not confuse transparent data transmission mediator and
> active data management engine required to create, submit or
> apply changes.

What's the difference between connecting to a proprietary Git server
over an open network stack, and connecting to an open Git server over a
proprietary network stack?

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Daniel Campbell]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/14/2015 02:40 PM, Ciaran McCreesh wrote:
> On Sun, 15 Feb 2015 01:35:40 +0300 Andrew Savchenko 
> <bircoph@gentoo.org> wrote:
>> On Sat, 14 Feb 2015 22:31:48 +0000 Ciaran McCreesh wrote:
>>> On Sat, 14 Feb 2015 23:23:48 +0100 Alexander Berntsen 
>>> <bernalex@gentoo.org> wrote:
>>>> On 14/02/15 23:13, Ciaran McCreesh wrote:
>>>>> That's how Git works.
>>>> 
>>>> Consider contributors (Gentoo developers or not) that want to
>>>> submit patches to a project. They should have access to the
>>>> primary repository (git or not), and be able to contribute
>>>> without being forced to use proprietary software. This is
>>>> incredibly easy to facilitate, so I don't expect us to have a
>>>> problem related to github and our social mission here.
>>> 
>>> What if their ISP runs proprietary software to manage its 
>>> network? Will Gentoo accept patches by pigeon? (Obviously the 
>>> postal service can't be relied upon to not use proprietary 
>>> software.)
>> 
>> One should not confuse transparent data transmission mediator and
>> active data management engine required to create, submit or apply
>> changes.
> 
> What's the difference between connecting to a proprietary Git 
> server over an open network stack, and connecting to an open Git 
> server over a proprietary network stack?
> 

The proprietary network stack can be gotten around. If the git
provider is closed and goes down, the data is gone. If a proprietary
network stack goes down, there are other options available and the
data is still available at the open repository.

Unfortunately, most businesses are not in line with FOSS philosophy,
so essentially every single ISP is using proprietary stacks.
Additionally, one can check the hash of the HEAD or another known
commit to verify data integrity of the repository to ensure the
proprietary network didn't screw with it in transit.

Keeping the repository open is more a matter of control and
dependability than pure philosophy. No ISP that I know of uses FOSS
stacks, so they're not really comparable imo.

Just 2¢ from a user.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJU39X8AAoJEJUrb08JgYgHVPoH/2jVpSf2lWuk7gYroPv/Zz5i
PQWDvGPNXLXZrUd7x+2gXXCAnd5VaQVy/g2wtlSlJ9hlAnnXGs/dmjFsi9HcULwg
PJeftIj10RjBGFBdC1IkU+7il7YNn7pXKTOjiiRdecKWUJM7My1twN2FoURk30cR
aA64dxBF6BVGdXDSFNeYGI7HkTs5yjHe+oqsnj0GzzelBp20pHS3F4VUR3Z04nIJ
iGesUSkxfWPlCzQSWSVhj9vA4OONIvoeSAY9cS/Wy7dAqfSkBKlZq2+kcXm4DTEn
JekhjpvJKEpvG81kpw2tdrBPog3o5lEGoWodXO+aPadL7CdveotKsghefbp8ir4=
=D1yC
-----END PGP SIGNATURE-----

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1913 bytes --]

On Sat, 14 Feb 2015 22:40:54 +0000 Ciaran McCreesh wrote:
> On Sun, 15 Feb 2015 01:35:40 +0300
> Andrew Savchenko <bircoph@gentoo.org> wrote:
> > On Sat, 14 Feb 2015 22:31:48 +0000 Ciaran McCreesh wrote:
> > > On Sat, 14 Feb 2015 23:23:48 +0100
> > > Alexander Berntsen <bernalex@gentoo.org> wrote:
> > > > On 14/02/15 23:13, Ciaran McCreesh wrote:
> > > > > That's how Git works.
> > > >
> > > > Consider contributors (Gentoo developers or not) that want to
> > > > submit patches to a project. They should have access to the
> > > > primary repository (git or not), and be able to contribute
> > > > without being forced to use proprietary software. This is
> > > > incredibly easy to facilitate, so I don't expect us to have a
> > > > problem related to github and our social mission here.
> > > 
> > > What if their ISP runs proprietary software to manage its network?
> > > Will Gentoo accept patches by pigeon? (Obviously the postal service
> > > can't be relied upon to not use proprietary software.)
> > 
> > One should not confuse transparent data transmission mediator and
> > active data management engine required to create, submit or
> > apply changes.
> 
> What's the difference between connecting to a proprietary Git server
> over an open network stack, and connecting to an open Git server over a
> proprietary network stack?

1a. If proprietary git server denies user, nothing can be done.
Access to a free software project is restricted.
1b. If proprietary network stack makes it impossible to use free
git server, it is possible to change ISP in most of cases.

2a. Github has almost no obligations to free software users:
service access is free, but may be restricted any moment without any
legal penalties.
2b. ISP services are usually paid for, so users have a possibility
to affect ISP actions in majority of cases.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 286 bytes --]

On Sat, 14 Feb 2015 15:10:53 -0800
Daniel Campbell <contact@sporkbox.us> wrote:
> The proprietary network stack can be gotten around. If the git
> provider is closed and goes down, the data is gone.

Git does not work that way. Git is not like CVS or SVN.

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 1184 bytes --]

On Sun, 15 Feb 2015 02:13:36 +0300
Andrew Savchenko <bircoph@gentoo.org> wrote:
> > What's the difference between connecting to a proprietary Git server
> > over an open network stack, and connecting to an open Git server
> > over a proprietary network stack?
> 
> 1a. If proprietary git server denies user, nothing can be done.
> Access to a free software project is restricted.

If an ISP decides to start blocking traffic, access is restricted. This
happens regularly.

> 1b. If proprietary network stack makes it impossible to use free
> git server, it is possible to change ISP in most of cases.

It's utterly trivial to move a Git repository. It's not easy to change
ISP.

> 2a. Github has almost no obligations to free software users:
> service access is free, but may be restricted any moment without any
> legal penalties.

So what? If it is, it doesn't affect anything, because Git doesn't rely
upon everything being in one specific place.

> 2b. ISP services are usually paid for, so users have a possibility
> to affect ISP actions in majority of cases.

Tell that to anyone whose government decides to block Github...

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Sat, Feb 14, 2015 at 5:35 PM, Andrew Savchenko <bircoph@gentoo.org> wrote:
> On Sat, 14 Feb 2015 22:31:48 +0000 Ciaran McCreesh wrote:
>> On Sat, 14 Feb 2015 23:23:48 +0100
>> Alexander Berntsen <bernalex@gentoo.org> wrote:
>> > On 14/02/15 23:13, Ciaran McCreesh wrote:
>> > > That's how Git works.
>> >
>> > Consider contributors (Gentoo developers or not) that want to submit
>> > patches to a project. They should have access to the primary
>> > repository (git or not), and be able to contribute without being
>> > forced to use proprietary software. This is incredibly easy to
>> > facilitate, so I don't expect us to have a problem related to github
>> > and our social mission here.
>>
>> What if their ISP runs proprietary software to manage its network? Will
>> Gentoo accept patches by pigeon? (Obviously the postal service can't be
>> relied upon to not use proprietary software.)
>
> One should not confuse transparent data transmission mediator and
> active data management engine required to create, submit or
> apply changes.
>

I think we're going a bit too far down the rabbit hole.

Somebody asked in IRC whether we run linuxbios on our servers.  Even
if we did, I'm sure the CPU schematics aren't published, or the
blueprints for the power plant that runs the datacenter.

Until the entire world runs on FOSS, I think we can live with Gentoo
simply trying to adhere to the social contract as best it can.  We
don't have to run the tinderbox on a CPU whose specs date to the 80s
since that was the only one we could find with published schematics.

I'm not aware of any aspect of Gentoo that necessitates the use of
proprietary software to contribute to, at least not anything a
contributor would have to pay for / etc.  If somebody spots something
and can offer a reasonable alternative, I'm sure it will be looked
into.  I think everybody around here is fairly dedicated to FOSS.
That said, Gentoo has always been a bit pragmatic - we allow non-free
stuff into the portage tree, for example (heck, even paid proprietary
software where you need the original CD to use the ebuild).  But, you
can always set your ACCEPT_LICENSE strictly and never accidentally
install it, and that won't hold you back from contributing at all.

Honestly, I'm not really seeing a lot of division here - just arguing
over definitions/etc.

-- 
Rich

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Matthew Thode]

[-- Attachment #1: Type: text/plain, Size: 2159 bytes --]

On 02/14/2015 02:48 PM, Andreas K. Huettel wrote:
> 
> Hi all, 
> 
> whenever the suggestion comes up to enable contributions to Gentoo via Github 
> pull requests, we also encounter discussion of the Gentoo Social Contract.
> 
> The two points that are seen as conflicting are
> 
> * The software running Github is closed source, proprietary.
> 
> * The Gentoo Social Contract states [1]:
> "Gentoo will never depend upon a piece of software or metadata unless it 
> conforms to the GNU General Public License, the GNU Lesser General Public 
> License, the Creative Commons - Attribution/Share Alike or some other license 
> approved by the Open Source Initiative (OSI)."
> 
> We need to resolve this discussion somehow, by formulating a clear policy. 
> Which is why I'm putting it up here for discussion and will ask to add it to 
> the next council meeting agenda. 
> 
> Many arguments have already been made. Feel free to summarize your points 
> again in a reply to this e-mail.
> 
> Cheers, 
> Andreas
> 
> [1] http://www.gentoo.org/main/en/contract.xml
> 
While Gentoo should use open source software where it can, I don't think
we can all the time, everywhere.  It would be nice to have our primary
repo on an infrastructure that facilitates working with the community
(github / bitbucket or better yet gitlab or gogs).

From an infra side I've looked at packaging gitlab, but it, like many
other projects these days, just installs to /opt.  It's update mechanism
doesn't even support Gentoo (chef based and chef on Gentoo is in the
same boat...).  I don't know what the state of gogs is, but given what I
know about go packaging it's not going to work well either.

What we are doing now is nice and works well I think.  We have the
portage mirror on github, accepting pull requests.  We even have a way
to take the pull request and apply it to CVS.  For now that's good, but
a smoother solution would of course be better (gitlab or gogs as
mentioned above).

I do agree, that from a security perspective at least, github should not
be our source of truth.

-- 
-- Matthew Thode (prometheanfire)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Mart Raudsepp]

On L, 2015-02-14 at 16:37 -0500, Rich Freeman wrote:
> On Sat, Feb 14, 2015 at 3:48 PM, Andreas K. Huettel
> <dilfridge@gentoo.org> wrote:
> >
> > We need to resolve this discussion somehow, by formulating a clear policy.
> > Which is why I'm putting it up here for discussion and will ask to add it to
> > the next council meeting agenda.
> 
> I tend to agree with what seems to be the general sentiment.  As long
> as we still accept patches via bugzilla/etc, then we aren't
> "depending" on github.
> 
> FOSS alternatives are to be preferred, but since we don't have those
> set up, I don't see why we have to live without anything in the
> meantime.  If somebody wants to host such a thing, I'd encourage them
> to do so, and work with infra if they'll accept help.

That is a good question.
I'm sorry if I am the only one to point this out, but:
We do NOT have even a WEB VIEW of our OFFICIAL overlays to see what is
going on there without BLINDLY cloning git URIs randomly!
Why should contributors care ONE BIT about things outside their comfort
zone of contributions, which is github in many cases these days?
After 6 months of complete blindness on official overlays, I was
eventually pointed at an outside cgit which shows what's going on there.

After 2 years of talking, we are still using CVS.

It is not surprising one bit that GitHub is the last hope to people
hoping to help out, with some folks willing to get their contributions
to actually MATTER.
We have failed the community to provide any reasonable free software
ways to contribute. So semi-open source ways it is.


With all the respect to the infra team they have done with their
existing capabilities, but we need to do better and find better ways to
achieve what we can with existing resources and fix this completely sad
state.


Mart

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[hasufell]

Andreas K. Huettel:
> 
> * The Gentoo Social Contract states [1]:
> "Gentoo will never depend upon a piece of software or metadata unless it 
> conforms to the GNU General Public License, the GNU Lesser General Public 
> License, the Creative Commons - Attribution/Share Alike or some other license 
> approved by the Open Source Initiative (OSI)."
> 

This has already been violated numerous times, including the development
of emul-linux-x86-* packages.

Not sure why we are so picky about it now.

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Ben de Groot]

On 15 February 2015 at 10:23, Mart Raudsepp <leio@gentoo.org> wrote:
> On L, 2015-02-14 at 16:37 -0500, Rich Freeman wrote:
>> On Sat, Feb 14, 2015 at 3:48 PM, Andreas K. Huettel
>> <dilfridge@gentoo.org> wrote:
>> >
>> > We need to resolve this discussion somehow, by formulating a clear policy.
>> > Which is why I'm putting it up here for discussion and will ask to add it to
>> > the next council meeting agenda.
>>
>> I tend to agree with what seems to be the general sentiment.  As long
>> as we still accept patches via bugzilla/etc, then we aren't
>> "depending" on github.
>>
>> FOSS alternatives are to be preferred, but since we don't have those
>> set up, I don't see why we have to live without anything in the
>> meantime.  If somebody wants to host such a thing, I'd encourage them
>> to do so, and work with infra if they'll accept help.
>
> That is a good question.
> I'm sorry if I am the only one to point this out, but:
> We do NOT have even a WEB VIEW of our OFFICIAL overlays to see what is
> going on there without BLINDLY cloning git URIs randomly!
> Why should contributors care ONE BIT about things outside their comfort
> zone of contributions, which is github in many cases these days?
> After 6 months of complete blindness on official overlays, I was
> eventually pointed at an outside cgit which shows what's going on there.
>
> After 2 years of talking, we are still using CVS.
>
> It is not surprising one bit that GitHub is the last hope to people
> hoping to help out, with some folks willing to get their contributions
> to actually MATTER.
> We have failed the community to provide any reasonable free software
> ways to contribute. So semi-open source ways it is.
>
>
> With all the respect to the infra team they have done with their
> existing capabilities, but we need to do better and find better ways to
> achieve what we can with existing resources and fix this completely sad
> state.
>
>
> Mart
>
>

It is unfortunate that things fall through the cracks at infra, and
more and more useful tools are not provided by services under
gentoo.org, but by personal initiatives and hosted on other domains.

For this reason I propose that Sven Wegener, Michał Górny, and Patrick
Lauer be made members of the infra team, because they get things done
that the other infra members don't (for whatever reason, not pointing
fingers here). I'm thinking here about useful tools such as:

- https://github.com/gentoo/gentoo-portage-rsync-mirror
- http://cgit.gentooexperimental.org/
- #gentoo-commits bot
- AutoRepoman

-- 
Cheers,

Ben | yngwin
Gentoo developer

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Sat, Feb 14, 2015 at 9:42 PM, hasufell <hasufell@gentoo.org> wrote:
> Andreas K. Huettel:
>>
>> * The Gentoo Social Contract states [1]:
>> "Gentoo will never depend upon a piece of software or metadata unless it
>> conforms to the GNU General Public License, the GNU Lesser General Public
>> License, the Creative Commons - Attribution/Share Alike or some other license
>> approved by the Open Source Initiative (OSI)."
>>
>
> This has already been violated numerous times, including the development
> of emul-linux-x86-* packages.
>

A principle being violated in the past isn't a good reason to simply
abandon it.  Principles like this one are always going to be hard to
hit 100%, but that doesn't mean that we shouldn't do the best we can.

That said, I don't really see how the 32-bit packages violate this.
If they happen to include non-FOSS that really isn't GENTOO depending
on them.  I don't think anything essential in Gentoo depends on any
non-FOSS components of any packages in the tree.  Having non-stuff in
the tree isn't the same as depending on them.  Neither is having a
random package that depends on a non-free package - we're talking
about GENTOO depending on something, not a random package in the tree.

If some project wanted to ONLY accept contributions via pull requests
on github, then I could start seeing some concern.

-- 
Rich

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1267 bytes --]

Dnia 2015-02-15, o godz. 01:35:40
Andrew Savchenko <bircoph@gentoo.org> napisał(a):

> On Sat, 14 Feb 2015 22:31:48 +0000 Ciaran McCreesh wrote:
> > On Sat, 14 Feb 2015 23:23:48 +0100
> > Alexander Berntsen <bernalex@gentoo.org> wrote:
> > > On 14/02/15 23:13, Ciaran McCreesh wrote:
> > > > That's how Git works.
> > >
> > > Consider contributors (Gentoo developers or not) that want to submit
> > > patches to a project. They should have access to the primary
> > > repository (git or not), and be able to contribute without being
> > > forced to use proprietary software. This is incredibly easy to
> > > facilitate, so I don't expect us to have a problem related to github
> > > and our social mission here.
> > 
> > What if their ISP runs proprietary software to manage its network? Will
> > Gentoo accept patches by pigeon? (Obviously the postal service can't be
> > relied upon to not use proprietary software.)
> 
> One should not confuse transparent data transmission mediator and
> active data management engine required to create, submit or
> apply changes.

Please don't forget to request the contributor to sign a statement that
he didn't use proprietary text editor and/or git front-end.

-- 
Best regards,
Michał Górny

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 394 bytes --]

Dnia 2015-02-14, o godz. 20:15:19
Matthew Thode <prometheanfire@gentoo.org> napisał(a):

> What we are doing now is nice and works well I think.  We have the
> portage mirror on github, accepting pull requests.  We even have a way

Please don't name the *Gentoo repository* portage. It's just wrong,
then users do that, then everyone is confused!

-- 
Best regards,
Michał Górny

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1130 bytes --]

Dnia 2015-02-14, o godz. 21:48:22
"Andreas K. Huettel" <dilfridge@gentoo.org> napisał(a):

> whenever the suggestion comes up to enable contributions to Gentoo via Github 
> pull requests, we also encounter discussion of the Gentoo Social Contract.
> 
> The two points that are seen as conflicting are
> 
> * The software running Github is closed source, proprietary.
> 
> * The Gentoo Social Contract states [1]:
> "Gentoo will never depend upon a piece of software or metadata unless it 
> conforms to the GNU General Public License, the GNU Lesser General Public 
> License, the Creative Commons - Attribution/Share Alike or some other license 
> approved by the Open Source Initiative (OSI)."

Maybe you should start by providing an alternative conforming to this.
For a start, Infra should stop running proprietary software. However,
so far they have been openly refusing to publish their scripts.
In fact, I've been recently asked to put my open source overlay QA
scripts [1] in a restricted-access repository.

[1]:https://bitbucket.org/mgorny/overlay-qa-tools

-- 
Best regards,
Michał Górny

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Matthew Thode]

[-- Attachment #1: Type: text/plain, Size: 538 bytes --]

On 02/15/2015 12:00 AM, Michał Górny wrote:
> Dnia 2015-02-14, o godz. 20:15:19
> Matthew Thode <prometheanfire@gentoo.org> napisał(a):
> 
>> What we are doing now is nice and works well I think.  We have the
>> portage mirror on github, accepting pull requests.  We even have a way
> 
> Please don't name the *Gentoo repository* portage. It's just wrong,
> then users do that, then everyone is confused!
> 
How about gentoo-x86, for ebuilds pertaining to all arches of course :P

-- 
-- Matthew Thode (prometheanfire)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Alexey Lapitsky]

Hi Mart,

I agree with every sentence from your email.

Rich made a great example about the rabbit hole. I don't think we
should blindly follow the social contract.

Just want to add that Github has pushed forward so many open source
projects that we must ask ourselves a different question:

Is Gentoo willing to say "no" to the new users, developers and the
speed of development just because Github is not FOSS?

As Rich said, Gentoo has always been a bit pragmatic. I think it
should be an easy question for any pragmatic team.

On Sun, Feb 15, 2015 at 3:23 AM, Mart Raudsepp <leio@gentoo.org> wrote:
> On L, 2015-02-14 at 16:37 -0500, Rich Freeman wrote:
>> On Sat, Feb 14, 2015 at 3:48 PM, Andreas K. Huettel
>> <dilfridge@gentoo.org> wrote:
>> >
>> > We need to resolve this discussion somehow, by formulating a clear policy.
>> > Which is why I'm putting it up here for discussion and will ask to add it to
>> > the next council meeting agenda.
>>
>> I tend to agree with what seems to be the general sentiment.  As long
>> as we still accept patches via bugzilla/etc, then we aren't
>> "depending" on github.
>>
>> FOSS alternatives are to be preferred, but since we don't have those
>> set up, I don't see why we have to live without anything in the
>> meantime.  If somebody wants to host such a thing, I'd encourage them
>> to do so, and work with infra if they'll accept help.
>
> That is a good question.
> I'm sorry if I am the only one to point this out, but:
> We do NOT have even a WEB VIEW of our OFFICIAL overlays to see what is
> going on there without BLINDLY cloning git URIs randomly!
> Why should contributors care ONE BIT about things outside their comfort
> zone of contributions, which is github in many cases these days?
> After 6 months of complete blindness on official overlays, I was
> eventually pointed at an outside cgit which shows what's going on there.
>
> After 2 years of talking, we are still using CVS.
>
> It is not surprising one bit that GitHub is the last hope to people
> hoping to help out, with some folks willing to get their contributions
> to actually MATTER.
> We have failed the community to provide any reasonable free software
> ways to contribute. So semi-open source ways it is.
>
>
> With all the respect to the infra team they have done with their
> existing capabilities, but we need to do better and find better ways to
> achieve what we can with existing resources and fix this completely sad
> state.
>
>
> Mart
>
>

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Markos Chandras]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 02/15/15 04:57, Ben de Groot wrote:
> On 15 February 2015 at 10:23, Mart Raudsepp <leio@gentoo.org>
> wrote:
>> On L, 2015-02-14 at 16:37 -0500, Rich Freeman wrote:
>>> On Sat, Feb 14, 2015 at 3:48 PM, Andreas K. Huettel 
>>> <dilfridge@gentoo.org> wrote:
>>>> 
>>>> We need to resolve this discussion somehow, by formulating a
>>>> clear policy. Which is why I'm putting it up here for
>>>> discussion and will ask to add it to the next council meeting
>>>> agenda.
>>> 
>>> I tend to agree with what seems to be the general sentiment.
>>> As long as we still accept patches via bugzilla/etc, then we
>>> aren't "depending" on github.
>>> 
>>> FOSS alternatives are to be preferred, but since we don't have
>>> those set up, I don't see why we have to live without anything
>>> in the meantime.  If somebody wants to host such a thing, I'd
>>> encourage them to do so, and work with infra if they'll accept
>>> help.
>> 
>> That is a good question. I'm sorry if I am the only one to point
>> this out, but: We do NOT have even a WEB VIEW of our OFFICIAL
>> overlays to see what is going on there without BLINDLY cloning
>> git URIs randomly! Why should contributors care ONE BIT about
>> things outside their comfort zone of contributions, which is
>> github in many cases these days? After 6 months of complete
>> blindness on official overlays, I was eventually pointed at an
>> outside cgit which shows what's going on there.
>> 
>> After 2 years of talking, we are still using CVS.
>> 
>> It is not surprising one bit that GitHub is the last hope to
>> people hoping to help out, with some folks willing to get their
>> contributions to actually MATTER. We have failed the community to
>> provide any reasonable free software ways to contribute. So
>> semi-open source ways it is.
>> 
>> 
>> With all the respect to the infra team they have done with their 
>> existing capabilities, but we need to do better and find better
>> ways to achieve what we can with existing resources and fix this
>> completely sad state.
>> 
>> 
>> Mart
>> 
>> 
> 
> It is unfortunate that things fall through the cracks at infra,
> and more and more useful tools are not provided by services under 
> gentoo.org, but by personal initiatives and hosted on other
> domains.
> 
> For this reason I propose that Sven Wegener, Michał Górny, and
> Patrick Lauer be made members of the infra team, because they get
> things done that the other infra members don't (for whatever
> reason, not pointing fingers here). I'm thinking here about useful
> tools such as:
> 
> - https://github.com/gentoo/gentoo-portage-rsync-mirror -
> http://cgit.gentooexperimental.org/ - #gentoo-commits bot -
> AutoRepoman
> 

I too believe that infra shouldn't be a blocking factor in our
development process. If the infra team is not giving what we want to
develop software in collaboration with the user community we need to
look to other alternatives. If we need to use github or $foobar to
facilitate that so be it. Maybe the social contract does not apply
100% anymore and we need to adapt it. Being flexible and relevant is
critical for a distro to succeed. We can't simply turn down
contributors based on what means they use to contribute.

- -- 
Regards,
Markos Chandras
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJU4HBNAAoJEPqDWhW0r/LCLXkQALvcae5yz4d3TA63GD7ISs7g
NjE6QGCnsxtIEhq9yTAd+gZtjhnM0dMn31/DCVCSUA77wPqr5UPCCZSGjHujRTo+
GubHjZfvlDq6Rm2geklqGooxXwflg16Ddc6nuwxZDXhrKDifvX1BuEO645JTz1je
/mzNtCaSbe2hGabVbrC7wgnfgYzjV1nh8U3zDKiTXFX+AZd8pd0ciCtUwk58wdKy
1peosogTqn2Iahc3XW2NG/J/j/eHnNBy9PCC8+gY0LyJdbVMHKucccRswSUHjlu6
VPlX5UxN+vrZSDI1np8Qk1TvjFh2+iGoT9sEsYE5U5rta8fWmtKAHpvhl92qlC+0
O4BZ6uX20KYx4Wec7b3iUKi3GXnU7Oimw2olz9kZfw6o2oPBrqMORd2Eei4QepAZ
OkAlJih6QRhYT3eFVeqX4TYtfVuAcYsTyu7533t64pnNBlV3H0MU93ZVNW48y1Jf
/8cW6YkgfpVnvNPT1wIF3+V01IIQfvOpfUzC4wlkwks98v26ySYbokidn4bwoRFs
F4QcApdyl9ktTHzkWRj1ll4JuMmYDfvmcHspHkbMRhUWH9W9GzGNwkV5QW9N5Vz8
Moon2DWUWijNtKVmD8w2FHpKsnUUX1ksGk9jcDi/pZmswbGCIysV+Hyh4+qysK+a
z/cibkWDZZv9UyVlrs1W
=b1N8
-----END PGP SIGNATURE-----

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Amadeusz Żołnowski]

[-- Attachment #1: Type: text/plain, Size: 380 bytes --]

Why do we need GitHub/Bitbucket/Gogs/GitLab/whatever at all?  Could
someone justify it?

User forks Gentoo repository in whatever service he/she wants, prepares
some patches and eventually sends e-mail to gentoo-dev mailing list or
makes a report at Bugzilla describing changes and including URI to
his/her work.  It is so simple.


Cheers,

-- 
Amadeusz Żołnowski

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 472 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 875 bytes --]

On Sun, 15 Feb 2015 12:06:50 +0100 Amadeusz Żołnowski wrote:
> Why do we need GitHub/Bitbucket/Gogs/GitLab/whatever at all?  Could
> someone justify it?
> 
> User forks Gentoo repository in whatever service he/she wants, prepares
> some patches and eventually sends e-mail to gentoo-dev mailing list or
> makes a report at Bugzilla describing changes and including URI to
> his/her work.  It is so simple.

It is simple when there is a small patch set. I remember times when
I uploaded to bugzilla about dozen of patches for review with
several iterations. This is really frustrating and time consuming.
So git pull requests have their own benefits in simplification of
development process.

However, there is no need to use github in order to use pull
requests. Gogs or gitlab may be setup in order to fulfil this task.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 576 bytes --]

On Sat, 14 Feb 2015 23:12:12 -0500 Rich Freeman wrote:
> If some project wanted to ONLY accept contributions via pull requests
> on github, then I could start seeing some concern.

Maybe I'm being too paranoid, but I would be worried when majority
of workflow will come through github or any other uncontrollable
platform. Because in such case platform denial of service will
result to a serious damage to the project.

Alternative solutions should always be kept alive and usable,
as awell as developers should be aware of them.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 660 bytes --]

On Sun, 15 Feb 2015 07:00:27 +0100 Michał Górny wrote:
> Dnia 2015-02-14, o godz. 20:15:19
> Matthew Thode <prometheanfire@gentoo.org> napisał(a):
> 
> > What we are doing now is nice and works well I think.  We have the
> > portage mirror on github, accepting pull requests.  We even have a way
> 
> Please don't name the *Gentoo repository* portage. It's just wrong,
> then users do that, then everyone is confused!

That's historical. As well as gentoo-x86. One can't change the
history — well, some actually can, but one may read Orwell's 1984
to see consequences — so, please, don't, just let it be.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1312 bytes --]

On Sun, 15 Feb 2015 10:55:41 +0100 Alexey Lapitsky wrote:
> Hi Mart,
> 
> I agree with every sentence from your email.
> 
> Rich made a great example about the rabbit hole. I don't think we
> should blindly follow the social contract.
> 
> Just want to add that Github has pushed forward so many open source
> projects that we must ask ourselves a different question:
> 
> Is Gentoo willing to say "no" to the new users, developers and the
> speed of development just because Github is not FOSS?

Is Gentoo willing to say "no" to the software freedom and its own
social obligations in order to make contributions easier in the
simplest way possible?

There is a fine line here: if github will turn to a main
development platform for Gentoo — this is way too dangerous from
both philosophical and practical ways.

What if github will change its policy at any random moment, e.g.
will kick projects or deny whole countries to contribute? What if
they will require payment for services at some time?

Github itself is uncontrolled by Gentoo community, this rises
security concerns as well.

> As Rich said, Gentoo has always been a bit pragmatic. I think it
> should be an easy question for any pragmatic team.

P.S. And please, don't top-post.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1691 bytes --]

On Sun, 15 Feb 2015 06:54:34 +0100 Michał Górny wrote:
> Dnia 2015-02-15, o godz. 01:35:40
> Andrew Savchenko <bircoph@gentoo.org> napisał(a):
> 
> > On Sat, 14 Feb 2015 22:31:48 +0000 Ciaran McCreesh wrote:
> > > On Sat, 14 Feb 2015 23:23:48 +0100
> > > Alexander Berntsen <bernalex@gentoo.org> wrote:
> > > > On 14/02/15 23:13, Ciaran McCreesh wrote:
> > > > > That's how Git works.
> > > >
> > > > Consider contributors (Gentoo developers or not) that want to submit
> > > > patches to a project. They should have access to the primary
> > > > repository (git or not), and be able to contribute without being
> > > > forced to use proprietary software. This is incredibly easy to
> > > > facilitate, so I don't expect us to have a problem related to github
> > > > and our social mission here.
> > > 
> > > What if their ISP runs proprietary software to manage its network? Will
> > > Gentoo accept patches by pigeon? (Obviously the postal service can't be
> > > relied upon to not use proprietary software.)
> > 
> > One should not confuse transparent data transmission mediator and
> > active data management engine required to create, submit or
> > apply changes.
> 
> Please don't forget to request the contributor to sign a statement that
> he didn't use proprietary text editor and/or git front-end.
 
1. Failure of text editor or git frontend can't hinder development
process seriously since other alternatives may be used.

2. My guess is that most people don't use proprietary editors or
git frontends in order to contribute to Gentoo, so this discussion
becomes mostly philosophical rather than practical.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 2180 bytes --]

On Sat, 14 Feb 2015 18:36:38 -0500 Rich Freeman wrote:
> I think we're going a bit too far down the rabbit hole.
> 
> Somebody asked in IRC whether we run linuxbios on our servers.  Even
> if we did, I'm sure the CPU schematics aren't published, or the
> blueprints for the power plant that runs the datacenter.
> 
> Until the entire world runs on FOSS, I think we can live with Gentoo
> simply trying to adhere to the social contract as best it can.  We
> don't have to run the tinderbox on a CPU whose specs date to the 80s
> since that was the only one we could find with published schematics.
> 
> I'm not aware of any aspect of Gentoo that necessitates the use of
> proprietary software to contribute to, at least not anything a
> contributor would have to pay for / etc.  If somebody spots something
> and can offer a reasonable alternative, I'm sure it will be looked
> into.  I think everybody around here is fairly dedicated to FOSS.
> That said, Gentoo has always been a bit pragmatic - we allow non-free
> stuff into the portage tree, for example (heck, even paid proprietary
> software where you need the original CD to use the ebuild).  But, you
> can always set your ACCEPT_LICENSE strictly and never accidentally
> install it, and that won't hold you back from contributing at all.
> 
> Honestly, I'm not really seeing a lot of division here - just arguing
> over definitions/etc.

I agree with you, we can't get rid of all proprietary components
in real world, but:

1. We should try to do this when possible.

2. We should estimate possible impact of a failure of such
component. If BIOS or network card firmware will fail, we can use
another hardware. And what if github will turn to be main
development platform for Gentoo and it will fail or refuse service?
Development will not be stopped completely, but will be impaired
significantly. A whole project will suffer a major damage. I want
to avoid that that's all.

Unfortunately my reasons above are not sheer speculation, unlike
theoretical proprietary firmware failures I already had suffered
from github blockade in our country.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 2205 bytes --]

On Sat, 14 Feb 2015 23:19:48 +0000 Ciaran McCreesh wrote:
> On Sun, 15 Feb 2015 02:13:36 +0300
> Andrew Savchenko <bircoph@gentoo.org> wrote:
> > > What's the difference between connecting to a proprietary Git server
> > > over an open network stack, and connecting to an open Git server
> > > over a proprietary network stack?
> > 
> > 1a. If proprietary git server denies user, nothing can be done.
> > Access to a free software project is restricted.
> 
> If an ISP decides to start blocking traffic, access is restricted. This
> happens regularly.

But ISP may be changed or some tunnelling may be used.
 
> > 1b. If proprietary network stack makes it impossible to use free
> > git server, it is possible to change ISP in most of cases.
> 
> It's utterly trivial to move a Git repository. It's not easy to change
> ISP.

When this is your private repository — yes, when you need to
collaborate with hundreds of other developers — no.

> > 2a. Github has almost no obligations to free software users:
> > service access is free, but may be restricted any moment without any
> > legal penalties.
> 
> So what? If it is, it doesn't affect anything, because Git doesn't rely
> upon everything being in one specific place.

Github is more than git server. (And I'm sure Gentoo infra can setup
git server on their own resources.) Github is a development
platform with pull requests, review tools, issue tracker and other
workflow management tools. That can't be easily and arbitrary moved.
I'm not sure if all that auxiliary information may be moved outside
of Github at all.

> > 2b. ISP services are usually paid for, so users have a possibility
> > to affect ISP actions in majority of cases.
> 
> Tell that to anyone whose government decides to block Github...

You know, I usually don't talk to myself. And this is one more
reason why I'm not happy to see github as a main development
platform to be used. In short it hosts too many projects and if one
them makes government unhappy, whole github will be blocked due to
https nature of connection. I wrote this in more detail in my other
mail to this discussion.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Patrick Lauer]

On 02/15/15 10:23, Mart Raudsepp wrote:
> On L, 2015-02-14 at 16:37 -0500, Rich Freeman wrote:
>> On Sat, Feb 14, 2015 at 3:48 PM, Andreas K. Huettel
>> <dilfridge@gentoo.org> wrote:
>>>
>>> We need to resolve this discussion somehow, by formulating a clear policy.
>>> Which is why I'm putting it up here for discussion and will ask to add it to
>>> the next council meeting agenda.
>>
>> I tend to agree with what seems to be the general sentiment.  As long
>> as we still accept patches via bugzilla/etc, then we aren't
>> "depending" on github.
>>
>> FOSS alternatives are to be preferred, but since we don't have those
>> set up, I don't see why we have to live without anything in the
>> meantime.  If somebody wants to host such a thing, I'd encourage them
>> to do so, and work with infra if they'll accept help.
> 
> That is a good question.
> I'm sorry if I am the only one to point this out, but:
> We do NOT have even a WEB VIEW of our OFFICIAL overlays to see what is
> going on there without BLINDLY cloning git URIs randomly!
> Why should contributors care ONE BIT about things outside their comfort
> zone of contributions, which is github in many cases these days?
> After 6 months of complete blindness on official overlays, I was
> eventually pointed at an outside cgit which shows what's going on there.

Yeah, http://cgit.gentooexperimental.org

I've set that up as a temporary thingy until infra remembers to infra.
In the meantime feel free to use it, it's updated every ~4h by cronjob.

> After 2 years of talking, we are still using CVS.
Actually closer to 10 years, but cvs works well enough that people don't
spend that much time on migrating to alternatives
> 
> With all the respect to the infra team they have done with their
> existing capabilities, but we need to do better and find better ways to
> achieve what we can with existing resources and fix this completely sad
> state.

I would help if I could ... there's still stuff like archives.gentoo.org
where I have not enough information *how* it is broken to figure out a fix.

Also I'm running too much other stuff that infra should be running, so
why the bleeping bleep bleep bleeeeeep bleep bleep do I have to run all
these services?!

(If I'm not forgetting anything -

znurt.org (beandog's alternative to packages.g.o)
AutoRepoman (an ugly shell script I hacked together during a long weekend)
irker (reports to IRC, but gets horribly confused with git commits
messages as I still don't have access to proper git postcommit hooks)
libreoffice-bin build host
http://packages.gentooexperimental.org/packages (cronjob'ed binpkg
server for @system on x86/amd64)
http://cgit.gentooexperimental.org - even mirrors the github
gentoo-portage-rsync-mirror repo

)

All these things are rather trivial to set up (I spent *almost* 2h to
figure out cgit from scratch), so I wonder why Gentoo Infra doesn't
infra. If y'all need help just say so and help shall be provided!


Have fun,

Patrick

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 526 bytes --]

On Sat, 14 Feb 2015 23:15:53 +0000 Ciaran McCreesh wrote:
> On Sat, 14 Feb 2015 15:10:53 -0800
> Daniel Campbell <contact@sporkbox.us> wrote:
> > The proprietary network stack can be gotten around. If the git
> > provider is closed and goes down, the data is gone.
> 
> Git does not work that way. Git is not like CVS or SVN.

Once more: github is not just a git repository, it is a platform,
with trackers, review tools and so on. These can't be move
somewhere else arbitrarily.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Dirkjan Ochtman]

On Sun, Feb 15, 2015 at 3:57 AM, Ben de Groot <yngwin@gentoo.org> wrote:
> It is unfortunate that things fall through the cracks at infra, and
> more and more useful tools are not provided by services under
> gentoo.org, but by personal initiatives and hosted on other domains.
>
> For this reason I propose that Sven Wegener, Michał Górny, and Patrick
> Lauer be made members of the infra team, because they get things done
> that the other infra members don't (for whatever reason, not pointing
> fingers here). I'm thinking here about useful tools such as:
>
> - https://github.com/gentoo/gentoo-portage-rsync-mirror
> - http://cgit.gentooexperimental.org/
> - #gentoo-commits bot
> - AutoRepoman

I think this is an interesting proposal. While the current infra
members are no doubt technically strong, I think there currently
exists an organization problem in that team in that they are failing
to scale with the rest of the community. I have offered to help out a
bunch of times, as I know others have, and clearly some people are
making a positive contribution without being infra members, but it
feels to me like all of that would be much more efficient if they were
actually part of infra.

I do think this discussion deserves its own thread, since this thread
is already being contaminated with way too much repetition.

Cheers,

Dirkjan

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1790 bytes --]

Dnia 2015-02-15, o godz. 15:39:58
Andrew Savchenko <bircoph@gentoo.org> napisał(a):

> On Sun, 15 Feb 2015 10:55:41 +0100 Alexey Lapitsky wrote:
> > Hi Mart,
> > 
> > I agree with every sentence from your email.
> > 
> > Rich made a great example about the rabbit hole. I don't think we
> > should blindly follow the social contract.
> > 
> > Just want to add that Github has pushed forward so many open source
> > projects that we must ask ourselves a different question:
> > 
> > Is Gentoo willing to say "no" to the new users, developers and the
> > speed of development just because Github is not FOSS?
> 
> Is Gentoo willing to say "no" to the software freedom and its own
> social obligations in order to make contributions easier in the
> simplest way possible?

Please explain me, how *exactly* does allowing contributions via
proprietary platform hurt free software?

> What if github will change its policy at any random moment, e.g.
> will kick projects or deny whole countries to contribute? What if
> they will require payment for services at some time?

Then users will simply stop using it. Simple as that.

> Github itself is uncontrolled by Gentoo community, this rises
> security concerns as well.

Everything rises security concerns, and especially random stuff hosted
by Gentoo Infra with no clear ToS, privacy policy and other basic
documentation in place.

Next thing I know, we should stop using third party mirrors because we
have no control over them and users can end up relying on their mirror
of choice reliably providing Gentoo files. And at the same time,
a number of developers ignores the fact that SRC_URIs are no longer
valid and files are only kept alive by random mirrors.

-- 
Best regards,
Michał Górny

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1210 bytes --]

On Sun, 15 Feb 2015 14:50:27 +0100 Michał Górny wrote:
> Dnia 2015-02-15, o godz. 15:39:58
> Andrew Savchenko <bircoph@gentoo.org> napisał(a):
> > On Sun, 15 Feb 2015 10:55:41 +0100 Alexey Lapitsky wrote:
[...]
> > Is Gentoo willing to say "no" to the software freedom and its own
> > social obligations in order to make contributions easier in the
> > simplest way possible?
> 
> Please explain me, how *exactly* does allowing contributions via
> proprietary platform hurt free software?

If this platform will become a de-facto common way to made
contributions (and this may happen taking into account github's
popularity), then platform unavailability or policy changes may
hurt the whole development process.

Please forgive me for repeating myself once more, but I was
directly asked "how", so... Github is not just a git server, this
is a platform with numerous instruments and auxiliary data. In case
of any negative change all these data (issues, code reviews and so
on) will be lost. And there is no clean way to migrate these data
to another facilities. Thus we will have a classic web-based
lock-in with all lock-in driven consequences.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 3081 bytes --]

Dnia 2015-02-15, o godz. 18:05:01
Andrew Savchenko <bircoph@gentoo.org> napisał(a):

> On Sun, 15 Feb 2015 14:50:27 +0100 Michał Górny wrote:
> > Dnia 2015-02-15, o godz. 15:39:58
> > Andrew Savchenko <bircoph@gentoo.org> napisał(a):
> > > On Sun, 15 Feb 2015 10:55:41 +0100 Alexey Lapitsky wrote:
> [...]
> > > Is Gentoo willing to say "no" to the software freedom and its own
> > > social obligations in order to make contributions easier in the
> > > simplest way possible?
> > 
> > Please explain me, how *exactly* does allowing contributions via
> > proprietary platform hurt free software?
> 
> If this platform will become a de-facto common way to made
> contributions (and this may happen taking into account github's
> popularity), then platform unavailability or policy changes may
> hurt the whole development process.

Sure. So what's the alternative? Not getting the contributions
in the first place?

If users are willing enough to contribute without GitHub, then GitHub
availability doesn't really impact that. If it becomes unavailable,
the contributions may require some more effort for them but they'll do
it.

Of course, some users will decide it's no longer worth the extra effort
to contribute if GH becomes unavailable. But then, those people
wouldn't contribute if we didn't ever use GitHub either. So either way,
we lose.

And yes, we are already getting contributions via GH we wouldn't get
other way. Because it's low effort enough for people to submit trivial
fixes. The alternative of opening bugs and attaching patches,
and the package maintainers ignoring them is not really welcoming.

That said, I'm willing to accept contributions via any media as long
as it's remotely sane on my end. Feel free to open a mailing list to
accept patches/pull requests. Or any other patch review framework
as long as it's relatively sane and works.

Just don't require contributors to do too much. Yes, git can do plain
pull requests but you have to have somewhere to pull from first. Not
every user has a private git hosting. Sure, they could ask you to pull
from github... but what's the difference then?

The risk of being unable to using something in the future should not
prohibit people from using its benefits right now.

> Please forgive me for repeating myself once more, but I was
> directly asked "how", so... Github is not just a git server, this
> is a platform with numerous instruments and auxiliary data. In case
> of any negative change all these data (issues, code reviews and so
> on) will be lost. And there is no clean way to migrate these data
> to another facilities. Thus we will have a classic web-based
> lock-in with all lock-in driven consequences.

That's a problem with every solution. If you migrate to another one,
you may have trouble moving the data. If the hard drive fails, you lose
the data since last backup. And finally, if you get too much data, you
lose it anyway because nobody cares to dig up what you're looking for.

-- 
Best regards,
Michał Górny

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 466 bytes --]

On Sun, 15 Feb 2015 15:39:58 +0300
Andrew Savchenko <bircoph@gentoo.org> wrote:
> What if github will change its policy at any random moment, e.g.
> will kick projects or deny whole countries to contribute? What if
> they will require payment for services at some time?

The same thing could happen to infra. What do you do if Gentoo's infra
team or its sponsors demands that the entire Gnome team be fired, or
they'll pull hosting?

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Anthony G. Basile]

On 02/15/15 01:04, Michał Górny wrote:
> Dnia 2015-02-14, o godz. 21:48:22
> "Andreas K. Huettel" <dilfridge@gentoo.org> napisał(a):
>
>> whenever the suggestion comes up to enable contributions to Gentoo via Github
>> pull requests, we also encounter discussion of the Gentoo Social Contract.
>>
>> The two points that are seen as conflicting are
>>
>> * The software running Github is closed source, proprietary.
>>
>> * The Gentoo Social Contract states [1]:
>> "Gentoo will never depend upon a piece of software or metadata unless it
>> conforms to the GNU General Public License, the GNU Lesser General Public
>> License, the Creative Commons - Attribution/Share Alike or some other license
>> approved by the Open Source Initiative (OSI)."
> Maybe you should start by providing an alternative conforming to this.
> For a start, Infra should stop running proprietary software. However,
> so far they have been openly refusing to publish their scripts.
> In fact, I've been recently asked to put my open source overlay QA
> scripts [1] in a restricted-access repository.
>
> [1]:https://bitbucket.org/mgorny/overlay-qa-tools
>
  I don't know why infra doesn't open their scripts.  It may lead to 
security issues, I don't know.  They probably should, and I do 
appreciate you're pointing out to your git hooks way back when I asked.  
So kudos.

But the big difference here is that github is a company while infra is 
volunteer work.  While I don't mind people making money off our work, as 
google does with chromeos, I do want to remain free of them.  I had a 
friend at cornell.  We did our ph.d. together.  He wrote some code that 
did band structure calculations.  Because he wrote it at cornell, it 
belonged to cornell who sold the rights to one company.  That company 
then sold the rights to another and my friend followed the code.  The 
last company finally said, sorry you can't develop this code anymore and 
you can't tell people how it works.   My friend was devastated as his 
life work was taken from him.  Obviously the situation is different 
here, but this should be a lesson.

The other reason I don't like github is because it decentralizes the 
community as we adopt our workflow around github rather than our own infra.

BTW, at D'Youville College our union contract says, our intellectual 
property belongs to us and the college can't take that from us. 100% 
ours.  If you see me going around aggressively slapping glp on anything 
I write it so as to assert that claim vigorously.

-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Anthony G. Basile]

On 02/15/15 10:05, Andrew Savchenko wrote:
> On Sun, 15 Feb 2015 14:50:27 +0100 Michał Górny wrote:
>> Dnia 2015-02-15, o godz. 15:39:58
>> Andrew Savchenko <bircoph@gentoo.org> napisał(a):
>>> On Sun, 15 Feb 2015 10:55:41 +0100 Alexey Lapitsky wrote:
> [...]
>>> Is Gentoo willing to say "no" to the software freedom and its own
>>> social obligations in order to make contributions easier in the
>>> simplest way possible?
>> Please explain me, how *exactly* does allowing contributions via
>> proprietary platform hurt free software?
> If this platform will become a de-facto common way to made
> contributions (and this may happen taking into account github's
> popularity), then platform unavailability or policy changes may
> hurt the whole development process.

Github can change its terms of service at any time [1].  They do have to 
notify us, but that's it.  Beyond that anything goes provided it is 
legal in US/California law.  It can in principle begin making copyright 
claims to new commits.

Ref.
[1] https://help.github.com/articles/github-terms-of-service/



-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[NP Hardass]

[-- Attachment #1: Type: text/plain, Size: 1031 bytes --]

On Feb 15, 2015 8:04 AM, "Andrew Savchenko" <bircoph@gentoo.org> wrote:
>
> On Sat, 14 Feb 2015 23:15:53 +0000 Ciaran McCreesh wrote:
> > On Sat, 14 Feb 2015 15:10:53 -0800
> > Daniel Campbell <contact@sporkbox.us> wrote:
> > > The proprietary network stack can be gotten around. If the git
> > > provider is closed and goes down, the data is gone.
> >
> > Git does not work that way. Git is not like CVS or SVN.
>
> Once more: github is not just a git repository, it is a platform,
> with trackers, review tools and so on. These can't be move
> somewhere else arbitrarily.
>
> Best regards,
> Andrew Savchenko

This point is one a critical one to make, in my opinion. Github, if used,
should not, be used for anything but as a means for git mirroring and pull
requests, to facilitate code contribution. Every other aspect of Github:
wikis, issue tracker, etc, should not replace Gentoo infrastructure.
Github functionality should supplement, but not replace Gentoo
infrastructure so that we can remain autonomous and independent.

[-- Attachment #2: Type: text/html, Size: 1329 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 254 bytes --]

On Sun, 15 Feb 2015 11:17:54 -0500
"Anthony G. Basile" <blueness@gentoo.org> wrote:
> But the big difference here is that github is a company while infra
> is volunteer work.

And the equipment and hosting is paid for by...

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Alexey Lapitsky]

Hi Michał,

Just want to say that I agree with every point you made.

Since the discussion derailed away from the social contract, I'll try
to address some other issues.

1. Volunteer work.
Anthony, I'm glad that you brought up volunteer work.
I'm pretty sure Gentoo Infra team is extremely busy with all kinds of
problems. The volunteers' time is arguably the most valuable resource
Gentoo has.
In my opinion we should do everything possible in order to save
volunteers' time, especially when it comes to baseline work (such as
maintaining and upgrading the infra services).

From this perspective, It would be unreasonable to ask Gentoo Infra
team to support an open-source solution because GitHub might change
policy.
GitHub policy change would only affect Gentoo short term. GitHub usage
will bring a lot of value and will save volunteers' time long-term.

2. Security
Andrew, I am concerned about security as you do. I can see that from
your point of view that Gentoo can not trust GitHub because it had
some serious security issues in the past.
I see that it might be misleading and give an impression that it's
less secure than Gentoo infra, but here are some things which GitHub
has and Gentoo does not:

* a team dedicated to security issues, paid for their work, doing
on-call rotation
* 2 factor authentication which could be enforced
* bug bounty program

I'm not sure if we can have all of it if we decide to use a FOSS
system for code-review and pull requests.


On Sun, Feb 15, 2015 at 6:30 PM, NP Hardass <np.hardass@gmail.com> wrote:
>
> On Feb 15, 2015 8:04 AM, "Andrew Savchenko" <bircoph@gentoo.org> wrote:
>>
>> On Sat, 14 Feb 2015 23:15:53 +0000 Ciaran McCreesh wrote:
>> > On Sat, 14 Feb 2015 15:10:53 -0800
>> > Daniel Campbell <contact@sporkbox.us> wrote:
>> > > The proprietary network stack can be gotten around. If the git
>> > > provider is closed and goes down, the data is gone.
>> >
>> > Git does not work that way. Git is not like CVS or SVN.
>>
>> Once more: github is not just a git repository, it is a platform,
>> with trackers, review tools and so on. These can't be move
>> somewhere else arbitrarily.
>>
>> Best regards,
>> Andrew Savchenko
>
> This point is one a critical one to make, in my opinion. Github, if used,
> should not, be used for anything but as a means for git mirroring and pull
> requests, to facilitate code contribution. Every other aspect of Github:
> wikis, issue tracker, etc, should not replace Gentoo infrastructure.
> Github functionality should supplement, but not replace Gentoo
> infrastructure so that we can remain autonomous and independent.

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Anthony G. Basile]

On 02/15/15 12:42, Ciaran McCreesh wrote:
> On Sun, 15 Feb 2015 11:17:54 -0500
> "Anthony G. Basile" <blueness@gentoo.org> wrote:
>> But the big difference here is that github is a company while infra
>> is volunteer work.
> And the equipment and hosting is paid for by...
>

You mean the folks like osuosl or other institutions run by grants :P  
Or is that not the answer you were expecting?

-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 1022 bytes --]

On Sun, 15 Feb 2015 13:39:16 -0500
"Anthony G. Basile" <blueness@gentoo.org> wrote:
> On 02/15/15 12:42, Ciaran McCreesh wrote:
> > On Sun, 15 Feb 2015 11:17:54 -0500
> > "Anthony G. Basile" <blueness@gentoo.org> wrote:
> >> But the big difference here is that github is a company while infra
> >> is volunteer work.
> > And the equipment and hosting is paid for by...
> >
> 
> You mean the folks like osuosl or other institutions run by
> grants :P Or is that not the answer you were expecting?

No, that's exactly what I mean. What if OSUOSL or some other
institution decides they'll pull funding unless the entire Gentoo
Gnome team is fired? Or what if the government funding them announces
that they can't use their money to accept contributions from or
give benefit to countries in the Axis of Evil?

The idea that Gentoo is currently immune to these kinds of pressures,
but suddenly wouldn't be if Github were to be used for hosting, isn't
really grounded in reality...

-- 
Ciaran McCreesh

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Seemant Kulleen]

[-- Attachment #1: Type: text/plain, Size: 1782 bytes --]

Note: not replying directly to Ciaran (I fully agree with what you said, C
and Michal)

Question: do any of the scenarios truly threaten Gentoo's existence?

Or is it just that things might be a pain in the butt if Github becomes
unavailable?

Let's say GitHub does change its policies and go full-douchebag -- is it
really the case that Gento would be alone in being screwed, or perhaps the
numerous open source projects on there would result in another something
replacing it?

Would love to see a little less fear around here.



*--seemantk Empathic Design*
Data Visualization | Tech. Team Turnarounds | Customer Experience
http://seemantk.com


On 15 February 2015 at 11:08, Ciaran McCreesh <
ciaran.mccreesh@googlemail.com> wrote:

> On Sun, 15 Feb 2015 13:39:16 -0500
> "Anthony G. Basile" <blueness@gentoo.org> wrote:
> > On 02/15/15 12:42, Ciaran McCreesh wrote:
> > > On Sun, 15 Feb 2015 11:17:54 -0500
> > > "Anthony G. Basile" <blueness@gentoo.org> wrote:
> > >> But the big difference here is that github is a company while infra
> > >> is volunteer work.
> > > And the equipment and hosting is paid for by...
> > >
> >
> > You mean the folks like osuosl or other institutions run by
> > grants :P Or is that not the answer you were expecting?
>
> No, that's exactly what I mean. What if OSUOSL or some other
> institution decides they'll pull funding unless the entire Gentoo
> Gnome team is fired? Or what if the government funding them announces
> that they can't use their money to accept contributions from or
> give benefit to countries in the Axis of Evil?
>
> The idea that Gentoo is currently immune to these kinds of pressures,
> but suddenly wouldn't be if Github were to be used for hosting, isn't
> really grounded in reality...
>
> --
> Ciaran McCreesh
>

[-- Attachment #2: Type: text/html, Size: 2672 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Sun, Feb 15, 2015 at 12:43 PM, Alexey Lapitsky <lex.public@gmail.com> wrote:
>
> 1. Volunteer work.
> Anthony, I'm glad that you brought up volunteer work.
> I'm pretty sure Gentoo Infra team is extremely busy with all kinds of
> problems. The volunteers' time is arguably the most valuable resource
> Gentoo has.
> In my opinion we should do everything possible in order to save
> volunteers' time, especially when it comes to baseline work (such as
> maintaining and upgrading the infra services).
>
> From this perspective, It would be unreasonable to ask Gentoo Infra
> team to support an open-source solution because GitHub might change
> policy.
> GitHub policy change would only affect Gentoo short term. GitHub usage
> will bring a lot of value and will save volunteers' time long-term.

In my experience you actually have to approach volunteer work in the
opposite way.

Ask whatever you want, just don't expect it to happen unless you're
the volunteer.

There is nothing wrong with pointing out that using a proprietary
solution like Github is problematic, and calling for somebody to
deploy something free instead.

It is even better if you go ahead and step up and deploy something
free yourself.  You don't need anybody's permission to set up Gitlab
for Gentoo.  Heck, I'm betting the Council/Trustees would even be
willing to let you have a gentoo.org subdomain for it.

Volunteers are often motivated by perceived benefit of their work.  If
they feel like the thing they're working on is really worthwhile and
sought after, they're probably more likely to put in time working on
it.  However, that isn't a guarantee - something vital to Gentoo could
easily go years without any volunteer contributions at all.

I do think it would be beneficial to make our infra more portable for
this reason.  I think having official Gentoo infra makes a lot of
sense, but ideally it should be possible for anybody with a stack of
VMs/containers to be able to spin up their own Gentoo infra such that
if they just pointed their DNS server at it, then all the Gentoo tools
work just fine.  That will make it easier for everybody to contribute
to infra, and make everything that much more portable when inevitably
one of our sponsors has to drop us (we have incredibly generous
sponsors, but not every arrangement can last forever).

-- 
Rich

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Patrick Lauer]

On 02/16/15 01:42, Ciaran McCreesh wrote:
> On Sun, 15 Feb 2015 11:17:54 -0500
> "Anthony G. Basile" <blueness@gentoo.org> wrote:
>> But the big difference here is that github is a company while infra
>> is volunteer work.
> 
> And the equipment and hosting is paid for by...
> 

Volunteers.

Are you trying to have a coherent argument here?
If yes, please try to deliver it in a format that is not "20 questions"

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Sun, Feb 15, 2015 at 6:24 PM, Patrick Lauer <patrick@gentoo.org> wrote:
> On 02/16/15 01:42, Ciaran McCreesh wrote:
>> On Sun, 15 Feb 2015 11:17:54 -0500
>> "Anthony G. Basile" <blueness@gentoo.org> wrote:
>>> But the big difference here is that github is a company while infra
>>> is volunteer work.
>>
>> And the equipment and hosting is paid for by...
>>
>
> Volunteers.
>

Honestly, it is a lot more complex than that.  Infra could probably
provide a better overview, but I'm not sure how much time they want to
spend on giving one, so I'll muddle through as best I can from what
I've seen in my time as a Trustee.

Gentoo infra consists of many elements.  There is the hardware, the
maintenance of the hardware, the OS/software and the maintenance of
that, and the money to pay for all that stuff.

One of the largest areas of infra by volume are the mirrors.  These
are almost entirely hands-off on Gentoo's part as far as I'm aware.
They're mostly donated by organizations, and they're told how to set
them up, and they just run some Gentoo-provided scripts/etc to stay up
to date.  The money/labor to keep them running/bandwidth/etc is all
donated by the mirror hosts.  I'm sure that if something goes wrong
somebody from Gentoo infra helps them out, so there probably is a bit
of labor on their part.  Not really anything in the way of "equipment
and hosting" though.

Then you have the core infra.  This is stuff where infra spends the
bulk of its time.  As I understand it some of the hardware is
Gentoo-owned, and some of it is owned by sponsors who provide infra
access to it.  Almost all of this stuff has a sponsor providing
hosting/network/power/etc, and generally if a disk dies or whatever it
ends up being an employee of a sponsor or such who swaps stuff out for
us (perhaps with us sending them the hardware to swap with).
Sponsor-provided stuff tends to have the bulk of the costs paid by
sponsors.  Gentoo-owned stuff tends to have the money come from
Gentoo, which comes from our many donors (lots of individuals, and
Google Summer of Code is a big source of income I believe even after
expenses).  Recently Gentoo has been kicking in for some of the costs
at one of our sponsors, but they kick in a fair bit themselves.

So, quite a bit of labor comes from volunteers.  However, the "paid
for" bit largely comes down to our sponsors, augmented by numerous
small donations from within the community.

All that said, I honestly don't consider the risk of one of our
sponsors "censoring" us is all that likely unless Gentoo as a
community really got out of hand (such that being associated with us
were damaging to their reputations).  The more realistic risk with our
model is that individual sponsors can come and go - maybe a sponsor
gets bought out or goes out of business or just is having hard times
and can't afford to support us any longer.  This happens on occasion,
and obviously we try to be gracious about it since they ARE donors
(usually they work with us on migration too).  However, my sense is
that most/all of our infra is hand-built servers running on bare
metal, which means that moving services around involves a lot of
labor.  It isn't like copying a disk image to a new VM provider and
cutting over DNS, let alone something like puppet/chef/ansible.

As we build out new infra services (whether they be git, gitlab, or
whatever) it would be really nice if the server configs (minus
credentials) could be open.  That would make it far easier for others
to contribute to them, automate their deployment, and so on.  There
really shouldn't be any reason that somebody shouldn't be able to set
up their own gentoo.org with everything but the domain name.  Sure, we
won't get there overnight, but it is a direction that makes sense.  We
just don't have the manpower to be excluding potential contributions.

-- 
Rich

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[hasufell]

Rich Freeman:
> On Sat, Feb 14, 2015 at 9:42 PM, hasufell <hasufell@gentoo.org> wrote:
>> Andreas K. Huettel:
>>>
>>> * The Gentoo Social Contract states [1]:
>>> "Gentoo will never depend upon a piece of software or metadata unless it
>>> conforms to the GNU General Public License, the GNU Lesser General Public
>>> License, the Creative Commons - Attribution/Share Alike or some other license
>>> approved by the Open Source Initiative (OSI)."
>>>
>>
>> This has already been violated numerous times, including the development
>> of emul-linux-x86-* packages.
>>
> 
> A principle being violated in the past isn't a good reason to simply
> abandon it.  Principles like this one are always going to be hard to
> hit 100%, but that doesn't mean that we shouldn't do the best we can.
> 
> That said, I don't really see how the 32-bit packages violate this.
> If they happen to include non-FOSS that really isn't GENTOO depending
> on them.  I don't think anything essential in Gentoo depends on any
> non-FOSS components of any packages in the tree.  Having non-stuff in
> the tree isn't the same as depending on them.  Neither is having a
> random package that depends on a non-free package - we're talking
> about GENTOO depending on something, not a random package in the tree.
> 
> If some project wanted to ONLY accept contributions via pull requests
> on github, then I could start seeing some concern.
> 

Scripts no one can read except the team (even after being asked to
publish them) is by definition propriety software. It was used to
develop and package emul-linux-x86-* packages until this very day.

No one cared, at any time. I just find this a bit confusing, because of
the sudden bikeshed about github which IS already widely used in gentoo
(whether everyone likes it or not).

Git is distributed, so I do not see a single reason to SOLELY depend on
github. I'm not sure why people confuse this. If we don't, then ~95% of
this discussion becomes obsolete.

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Sun, Feb 15, 2015 at 10:26 PM, hasufell <hasufell@gentoo.org> wrote:
>
> Scripts no one can read except the team (even after being asked to
> publish them) is by definition propriety software. It was used to
> develop and package emul-linux-x86-* packages until this very day.
>
> No one cared, at any time. I just find this a bit confusing, because of
> the sudden bikeshed about github which IS already widely used in gentoo
> (whether everyone likes it or not).

I'm not sure how many people noticed - certainly nobody made a big
complaint about it.  Now that you bring it up I agree that this should
be corrected, though at least in this case it is a bit of a moot point
as those packages are largely obsolete now.

An area that always bothered me was stage3 building, but I think our
catalyst docs have improved.  I don't know if following the wiki guide
leads to a stage3 identical to our published one or not, but if not
that would be an example of a similar situation that should be fixed.

>
> Git is distributed, so I do not see a single reason to SOLELY depend on
> github. I'm not sure why people confuse this. If we don't, then ~95% of
> this discussion becomes obsolete.
>

I don't think anybody is proposing that we SOLELY depend on github.
We can always keep an eye on it lest that become the case.  I'd much
rather see something hosted on Gentoo infra using FOSS take this role.

-- 
Rich

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Anthony G. Basile]

On 02/15/15 14:08, Ciaran McCreesh wrote:
> On Sun, 15 Feb 2015 13:39:16 -0500
> "Anthony G. Basile" <blueness@gentoo.org> wrote:
>> On 02/15/15 12:42, Ciaran McCreesh wrote:
>>> On Sun, 15 Feb 2015 11:17:54 -0500
>>> "Anthony G. Basile" <blueness@gentoo.org> wrote:
>>>> But the big difference here is that github is a company while infra
>>>> is volunteer work.
>>> And the equipment and hosting is paid for by...
>>>
>> You mean the folks like osuosl or other institutions run by
>> grants :P Or is that not the answer you were expecting?
> No, that's exactly what I mean. What if OSUOSL or some other
> institution decides they'll pull funding unless the entire Gentoo
> Gnome team is fired? Or what if the government funding them announces
> that they can't use their money to accept contributions from or
> give benefit to countries in the Axis of Evil?
>
> The idea that Gentoo is currently immune to these kinds of pressures,
> but suddenly wouldn't be if Github were to be used for hosting, isn't
> really grounded in reality...
>
Then I'll write a grant.  I've played this game long enough to know how 
to keep the money interests and free research apart.

-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Anthony G. Basile]

On 02/15/15 14:23, Seemant Kulleen wrote:
> Note: not replying directly to Ciaran (I fully agree with what you said, C
> and Michal)
>
> Question: do any of the scenarios truly threaten Gentoo's existence?
>
> Or is it just that things might be a pain in the butt if Github becomes
> unavailable?
>
> Let's say GitHub does change its policies and go full-douchebag -- is it
> really the case that Gento would be alone in being screwed, or perhaps the
> numerous open source projects on there would result in another something
> replacing it?
>
> Would love to see a little less fear around here.

Its fine as long as infra is the centre of our operations.  Because 
github is so much better than cvs provided by infra (sorry infra its 
true) I worry that we'll depend on it too much.  To be honest, I love 
the entire github workflow and would feel much better if we could just 
own it ourselves.

Its unlikely github will go full-douchebag with its TOS.  Its more 
likely they will do what freecode.com (aka freshmeat.com) did.  Just 
close shop on day 0.

Finally it depends what you mean by "existance".  I've seen companies 
exert pressures that morph things into what they should not be.  A 
healthy amount of distances here is good.  I like our autonomony.

>
>
>
> *--seemantk Empathic Design*
> Data Visualization | Tech. Team Turnarounds | Customer Experience
> http://seemantk.com
>
>
> On 15 February 2015 at 11:08, Ciaran McCreesh <
> ciaran.mccreesh@googlemail.com> wrote:
>
>> On Sun, 15 Feb 2015 13:39:16 -0500
>> "Anthony G. Basile" <blueness@gentoo.org> wrote:
>>> On 02/15/15 12:42, Ciaran McCreesh wrote:
>>>> On Sun, 15 Feb 2015 11:17:54 -0500
>>>> "Anthony G. Basile" <blueness@gentoo.org> wrote:
>>>>> But the big difference here is that github is a company while infra
>>>>> is volunteer work.
>>>> And the equipment and hosting is paid for by...
>>>>
>>> You mean the folks like osuosl or other institutions run by
>>> grants :P Or is that not the answer you were expecting?
>> No, that's exactly what I mean. What if OSUOSL or some other
>> institution decides they'll pull funding unless the entire Gentoo
>> Gnome team is fired? Or what if the government funding them announces
>> that they can't use their money to accept contributions from or
>> give benefit to countries in the Axis of Evil?
>>
>> The idea that Gentoo is currently immune to these kinds of pressures,
>> but suddenly wouldn't be if Github were to be used for hosting, isn't
>> really grounded in reality...
>>
>> --
>> Ciaran McCreesh
>>


-- 
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail    : blueness@gentoo.org
GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
GnuPG ID  : F52D4BBA

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Michael Jones]

[-- Attachment #1: Type: text/plain, Size: 1302 bytes --]

On Mon, Feb 16, 2015 at 7:43 AM, Anthony G. Basile <blueness@gentoo.org>
wrote:

> Its fine as long as infra is the centre of our operations.  Because github
> is so much better than cvs provided by infra (sorry infra its true) I worry
> that we'll depend on it too much.  To be honest, I love the entire github
> workflow and would feel much better if we could just own it ourselves.
>

In case folks on this list haven't seen it before, Gerrit[1] offers a
workflow that might be attractive to Gentoo, over and above GitHub's.

Some example's of Gerrit in use include the Qt project [2] and Coreboot
project [3]

Of special interest is that Gerrit provides an API by which verification
scripts can be run against each patch under consideration, such a repoman.
It further lets authorized users to push a patch from the web, without
needing to open the git commandline, similar to how GitHub pull requests
work.

Just food for thought!

Cheers
--Michael Jones



> --
> Anthony G. Basile, Ph.D.
> Gentoo Linux Developer [Hardened]
> E-Mail    : blueness@gentoo.org
> GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
> GnuPG ID  : F52D4BBA
>
>
>
[1] https://code.google.com/p/gerrit/
[2] https://codereview.qt-project.org/#/q/status:open,n,z
[3] http://review.coreboot.org/#/q/status:open

[-- Attachment #2: Type: text/html, Size: 2274 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Jorge Manuel B. S. Vicetto]

On Mon, 16 Feb 2015, Rich Freeman wrote:

> On Sun, Feb 15, 2015 at 10:26 PM, hasufell <hasufell@gentoo.org> wrote:
>>
>> Scripts no one can read except the team (even after being asked to
>> publish them) is by definition propriety software. It was used to
>> develop and package emul-linux-x86-* packages until this very day.
>>
>> No one cared, at any time. I just find this a bit confusing, because of
>> the sudden bikeshed about github which IS already widely used in gentoo
>> (whether everyone likes it or not).
>
> I'm not sure how many people noticed - certainly nobody made a big
> complaint about it.  Now that you bring it up I agree that this should
> be corrected, though at least in this case it is a bit of a moot point
> as those packages are largely obsolete now.

Some of the scripts used are hosted in several public repositories (like 
the qa-scripts). Almost all of the others are part of the infra 
configuration repositories.
We've shared some of the scripts already and I'm sure all of us would 
prefer to share all the others - we just need to go over them and make 
sure we split any authentication out of them.

> An area that always bothered me was stage3 building, but I think our
> catalyst docs have improved.  I don't know if following the wiki guide
> leads to a stage3 identical to our published one or not, but if not
> that would be an example of a similar situation that should be fixed.

Rich, please make an effort to ask the correct people before making such 
comments that can be misread as meaning that the RelEng team is building 
stages "in secret" or questioning how anyone can be certain about what is 
built.
Both the catalyst repository[1] containing catalyst code and the releng 
repository[2] containing both the official stages and helper scripts  used 
for stage building are available through gogo.

  [1] - git://git.overlays.gentoo.org/proj/catalyst.git
  [2] - git://git.overlays.gentoo.org/proj/releng.git

Regards,
Jorge Manuel B. S. Vicetto
Gentoo Developer

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Jorge Manuel B. S. Vicetto]

On Sun, 15 Feb 2015, Rich Freeman wrote:

<snip>

> Then you have the core infra.  This is stuff where infra spends the
> bulk of its time.  As I understand it some of the hardware is
> Gentoo-owned, and some of it is owned by sponsors who provide infra
> access to it.  Almost all of this stuff has a sponsor providing
> hosting/network/power/etc, and generally if a disk dies or whatever it
> ends up being an employee of a sponsor or such who swaps stuff out for
> us (perhaps with us sending them the hardware to swap with).
> Sponsor-provided stuff tends to have the bulk of the costs paid by
> sponsors.  Gentoo-owned stuff tends to have the money come from
> Gentoo, which comes from our many donors (lots of individuals, and
> Google Summer of Code is a big source of income I believe even after
> expenses).  Recently Gentoo has been kicking in for some of the costs
> at one of our sponsors, but they kick in a fair bit themselves.
>
> So, quite a bit of labor comes from volunteers.  However, the "paid
> for" bit largely comes down to our sponsors, augmented by numerous
> small donations from within the community.

> All that said, I honestly don't consider the risk of one of our
> sponsors "censoring" us is all that likely unless Gentoo as a
> community really got out of hand (such that being associated with us
> were damaging to their reputations).  The more realistic risk with our
> model is that individual sponsors can come and go - maybe a sponsor
> gets bought out or goes out of business or just is having hard times
> and can't afford to support us any longer.  This happens on occasion,
> and obviously we try to be gracious about it since they ARE donors
> (usually they work with us on migration too).  However, my sense is
> that most/all of our infra is hand-built servers running on bare
> metal, which means that moving services around involves a lot of
> labor.  It isn't like copying a disk image to a new VM provider and
> cutting over DNS, let alone something like puppet/chef/ansible.

The infra team maintains an internal wiki for our job. Our systems are 
installed from an infra built stage4, following some docs, but this is 
done by different people over time.
We do rely "heavily" on two configuration management systems. The older 
one, cfengine, has been in use for many years. Sometime ago we started 
migrating to puppet. We've currently still migrating services to puppet.
We use some git repositories for specific areas such as dns or for our 
infra overlay.

> As we build out new infra services (whether they be git, gitlab, or
> whatever) it would be really nice if the server configs (minus
> credentials) could be open.  That would make it far easier for others
> to contribute to them, automate their deployment, and so on.  There
> really shouldn't be any reason that somebody shouldn't be able to set
> up their own gentoo.org with everything but the domain name.  Sure, we
> won't get there overnight, but it is a direction that makes sense.  We
> just don't have the manpower to be excluding potential contributions.

We're already using cfengine / puppet for this. We need to review / split 
service definitions before we can make it public, though.

Regards,
Jorge Manuel B. S. Vicetto
Gentoo Developer

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Jorge Manuel B. S. Vicetto]

On Mon, 16 Feb 2015, Michael Jones wrote:

> On Mon, Feb 16, 2015 at 7:43 AM, Anthony G. Basile <blueness@gentoo.org>
> wrote:
>
>> Its fine as long as infra is the centre of our operations.  Because github
>> is so much better than cvs provided by infra (sorry infra its true) I worry
>> that we'll depend on it too much.  To be honest, I love the entire github
>> workflow and would feel much better if we could just own it ourselves.
>>
>
> In case folks on this list haven't seen it before, Gerrit[1] offers a
> workflow that might be attractive to Gentoo, over and above GitHub's.

A few people have mentioned gerrit over time and the infra team is aware 
of it. Unfortunately, gerrit requires Java[1].

  [1] - 
https://gerrit-documentation.storage.googleapis.com/Documentation/2.10/install.html#requirements

> Some example's of Gerrit in use include the Qt project [2] and Coreboot
> project [3]
>
> Of special interest is that Gerrit provides an API by which verification
> scripts can be run against each patch under consideration, such a repoman.
> It further lets authorized users to push a patch from the web, without
> needing to open the git commandline, similar to how GitHub pull requests
> work.
>
> Just food for thought!
>
> Cheers
> --Michael Jones
>
>
>
>> --
>> Anthony G. Basile, Ph.D.
>> Gentoo Linux Developer [Hardened]
>> E-Mail    : blueness@gentoo.org
>> GnuPG FP  : 1FED FAD9 D82C 52A5 3BAB  DC79 9384 FA6E F52D 4BBA
>> GnuPG ID  : F52D4BBA
>>
>>
>>
> [1] https://code.google.com/p/gerrit/
> [2] https://codereview.qt-project.org/#/q/status:open,n,z
> [3] http://review.coreboot.org/#/q/status:open

Regards,
Jorge Manuel B. S. Vicetto
Gentoo Developer

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Robin H. Johnson]

On Sun, Feb 15, 2015 at 07:04:54AM +0100, Michał Górny wrote:
> Dnia 2015-02-14, o godz. 21:48:22
> "Andreas K. Huettel" <dilfridge@gentoo.org> napisał(a):
> 
> > whenever the suggestion comes up to enable contributions to Gentoo via Github 
> > pull requests, we also encounter discussion of the Gentoo Social Contract.
> > 
> > The two points that are seen as conflicting are
> > 
> > * The software running Github is closed source, proprietary.
> > 
> > * The Gentoo Social Contract states [1]:
> > "Gentoo will never depend upon a piece of software or metadata unless it 
> > conforms to the GNU General Public License, the GNU Lesser General Public 
> > License, the Creative Commons - Attribution/Share Alike or some other license 
> > approved by the Open Source Initiative (OSI)."
> Maybe you should start by providing an alternative conforming to this.
> For a start, Infra should stop running proprietary software. However,
> so far they have been openly refusing to publish their scripts.
> In fact, I've been recently asked to put my open source overlay QA
> scripts [1] in a restricted-access repository.
The only reason most Infra scripts AREN'T directly public, is that they
are in the long-standing cfengine/puppet repos, and those repos contain
scatterings of passwords. Next week, the cfengine history will be a full
decade old (Earliest commit is 2005/02/22).

Using Wikimedia (who run Wikipedia) as an example, go and read this:
http://blog.wikimedia.org/2011/09/19/ever-wondered-how-the-wikimedia-servers-are-configured/

It took WikiMedia a few weeks of fulltime work multiple by several
people, to get the stuff into a state with split public/private repos.

Infra would love to have our stuff more open, but as it stands, there is
a LOT of historical password junk in the scripts. 

If you look at recent package additions, you'll see I added
dev-ruby/hiera-eyaml-gpg, to extract more of the passwords out of the
core Puppet tree. For passwords beyond puppet, look at
https://github.com/robbat2/pwstore, not presently packaged because I'm
waiting for a response from upstream to see about how it diverged.

If I could afford to spend the more than just volunteer time on Infra,
yes, I'd love to have few full 40 hour weeks to put into cleaning up our
cfengine and puppet to where it's significantly easier to manage. I've
been doing that for my dayjob already:
https://github.com/BCLibCoop/?query=puppet 
And I'm borrowing where possible in both directions: both for work from
Gentoo infra, and for Gentoo from my work stuff.

At the present rate it's going, it's mostly:
- new services are built in puppet
- old services are deprecated and removed from cfengine

Nothing that infra runs explicitly depends on GitHub.

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Infrastructure Lead
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Robin H. Johnson]

On Sun, Feb 15, 2015 at 06:43:28PM +0100, Alexey Lapitsky wrote:
> on-call rotation
Sure, Infra will happily take full-time employment if you're going to
pay reasonable salaries for it. Gentoo Foundation doesn't have even
remotely the budget for it.

> * 2 factor authentication which could be enforced
Do you REALLY want 2FA for Git?

I'll deploy this [1] when I resolve our present sponsor holdups with the new
Git server.

[1] https://github.com/mricon/totp-cgi/blob/master/contrib/gitolite/README.rst

> * bug bounty program
Will you fund it? Then sure!

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Infrastructure Lead
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Tue, Feb 17, 2015 at 1:37 AM, Jorge Manuel B. S. Vicetto
<jmbsvicetto@gentoo.org> wrote:
> On Mon, 16 Feb 2015, Rich Freeman wrote:
>
>> An area that always bothered me was stage3 building, but I think our
>> catalyst docs have improved.  I don't know if following the wiki guide
>> leads to a stage3 identical to our published one or not...
>
> Rich, please make an effort to ask the correct people before making such
> comments that can be misread as meaning that the RelEng team is building
> stages "in secret" or questioning how anyone can be certain about what is
> built.

The only comments I made were:
1.  IN THE PAST I was concerned about stage3 building.
2.  Things have improved.
3.  I am unsure if following the wiki guide leads to a stage3
identical to our published one or not.

All three remain just as true after your comments.  :)  I'm certainly
interested in clarification on the last one.  It isn't actually enough
to publish a repo full of files - you also have to document how you
use them.  That may very well already be documented in the Catalyst
wiki page.

As far as "misreading" goes - people will read what they want to read
into just about anything that anybody says.  I try to clearly state
what I mean, and I'm sure I do it imperfectly.  If somebody isn't sure
what I mean, they're more than welcome to talk to me about it.

-- 
Rich

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Tue, Feb 17, 2015 at 4:01 AM, Robin H. Johnson <robbat2@gentoo.org> wrote:
>
> If I could afford to spend the more than just volunteer time on Infra,
> yes, I'd love to have few full 40 hour weeks to put into cleaning up our
> cfengine and puppet to where it's significantly easier to manage.

The one thing I was trying to avoid doing was giving an impression
that the infra team isn't busy doing work that helps everybody around
here.

You summarize the problem well here.  You're too busy due to a labor
shortage to do the sorts of things that would help reduce the labor
shortage.

I don't mean to trivialize the problem, either.  Gentoo has a lot of
donated infrastructure, and a decent amount of cash when you're
talking about replacing hard drives and such.  The problem is that we
really don't have the kind of money it would take to take on even a
single employee.

Apologies if my email came across as kicking you guys when you were
down.  It was really more about trying to point out that we have a
problem.

-- 
Rich

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Jorge Manuel B. S. Vicetto]

On Tue, 17 Feb 2015, Rich Freeman wrote:

> On Tue, Feb 17, 2015 at 1:37 AM, Jorge Manuel B. S. Vicetto
> <jmbsvicetto@gentoo.org> wrote:
>> On Mon, 16 Feb 2015, Rich Freeman wrote:
>>
>>> An area that always bothered me was stage3 building, but I think our
>>> catalyst docs have improved.  I don't know if following the wiki guide
>>> leads to a stage3 identical to our published one or not...
>>
>> Rich, please make an effort to ask the correct people before making such
>> comments that can be misread as meaning that the RelEng team is building
>> stages "in secret" or questioning how anyone can be certain about what is
>> built.
>
> The only comments I made were:
> 1.  IN THE PAST I was concerned about stage3 building.
> 2.  Things have improved.
> 3.  I am unsure if following the wiki guide leads to a stage3
> identical to our published one or not.
>
> All three remain just as true after your comments.  :)  I'm certainly
> interested in clarification on the last one.  It isn't actually enough
> to publish a repo full of files - you also have to document how you
> use them.  That may very well already be documented in the Catalyst
> wiki page.

I don't know what wiki page you are talking about, but to build stages 
based on the official specs and using the releng repo, one needs only to 
put the following into cron to build amd64 / x86:

/release/releng/tools/catalyst-auto -c 
/release/releng/tools/catalyst-auto-amd64.conf

/release/releng/tools/catalyst-auto -c 
/release/releng/tools/catalyst-auto-x86.conf

This will use the /release mountpoint to do the building and save of 
stages. Unless we've fixed it already (I don't think we did), that will 
fail loudly if it's a symlink - that's why I still have a local fork to 
build stages on my build server under /home/release. This is something we 
plan to make more flexible in the catalyst-3 rewrite.

> As far as "misreading" goes - people will read what they want to read
> into just about anything that anybody says.  I try to clearly state
> what I mean, and I'm sure I do it imperfectly.  If somebody isn't sure
> what I mean, they're more than welcome to talk to me about it.

I hope the above and the previous email helped address your concerns and 
cleared any doubts.

Regards,
Jorge Manuel B. S. Vicetto
Gentoo Developer

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 961 bytes --]

On Tue, 17 Feb 2015 06:52:24 +0000 (UTC) Jorge Manuel B. S. Vicetto
wrote:
> On Mon, 16 Feb 2015, Michael Jones wrote:
> 
> > On Mon, Feb 16, 2015 at 7:43 AM, Anthony G. Basile <blueness@gentoo.org>
> > wrote:
> >
> >> Its fine as long as infra is the centre of our operations.  Because github
> >> is so much better than cvs provided by infra (sorry infra its true) I worry
> >> that we'll depend on it too much.  To be honest, I love the entire github
> >> workflow and would feel much better if we could just own it ourselves.
> >>
> >
> > In case folks on this list haven't seen it before, Gerrit[1] offers a
> > workflow that might be attractive to Gentoo, over and above GitHub's.
> 
> A few people have mentioned gerrit over time and the infra team is aware 
> of it. Unfortunately, gerrit requires Java[1].

Try gogs, its very fast, relatively lightweigth and requires only
Go :)
http://gogs.io/

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[hasufell]

Andrew Savchenko:
> On Tue, 17 Feb 2015 06:52:24 +0000 (UTC) Jorge Manuel B. S. Vicetto
> wrote:
>> On Mon, 16 Feb 2015, Michael Jones wrote:
>>
>>> On Mon, Feb 16, 2015 at 7:43 AM, Anthony G. Basile <blueness@gentoo.org>
>>> wrote:
>>>
>>>> Its fine as long as infra is the centre of our operations.  Because github
>>>> is so much better than cvs provided by infra (sorry infra its true) I worry
>>>> that we'll depend on it too much.  To be honest, I love the entire github
>>>> workflow and would feel much better if we could just own it ourselves.
>>>>
>>>
>>> In case folks on this list haven't seen it before, Gerrit[1] offers a
>>> workflow that might be attractive to Gentoo, over and above GitHub's.
>>
>> A few people have mentioned gerrit over time and the infra team is aware 
>> of it. Unfortunately, gerrit requires Java[1].
> 
> Try gogs, its very fast, relatively lightweigth and requires only
> Go :)
> http://gogs.io/
> 

It doesn't even support pull requests (yet).

Deploying is very easy though (opposed to gitlab).

[gentoo-project] Infra Kickstarter?

[Robin H. Johnson]

On Tue, Feb 17, 2015 at 07:10:53AM -0500, Rich Freeman wrote:
> On Tue, Feb 17, 2015 at 4:01 AM, Robin H. Johnson <robbat2@gentoo.org> wrote:
> >
> > If I could afford to spend the more than just volunteer time on Infra,
> > yes, I'd love to have few full 40 hour weeks to put into cleaning up our
> > cfengine and puppet to where it's significantly easier to manage.
> 
> The one thing I was trying to avoid doing was giving an impression
> that the infra team isn't busy doing work that helps everybody around
> here.
> 
> You summarize the problem well here.  You're too busy due to a labor
> shortage to do the sorts of things that would help reduce the labor
> shortage.
Of infra staff, in 2014 antarus left infra, and we gained dastergon
prometheanfire redlizard. bonsaikitten turned us down again, as he's
busy running the gentooexperimental infrastructure.

> I don't mean to trivialize the problem, either.  Gentoo has a lot of
> donated infrastructure, and a decent amount of cash when you're
> talking about replacing hard drives and such.  The problem is that we
> really don't have the kind of money it would take to take on even a
> single employee.
I've wondered in the past, about doing a Kickstarter/IndieGogo to pay me
for spending a month or two on Gentoo, based on the model of the very
successful Django kickstarter:
https://www.kickstarter.com/projects/andrewgodwin/schema-migrations-for-django
(there have been other open source kickstarters since then, but the
Django one was one of the first that delivered just open source
software).

If I wanted to do it full-time, for the cost of living (with my wife and
10 month old daughter) in Vancouver, at a bare minimum, I need it to be
at least $6000CAD/month before taxes.

Potential major projects for it, in a rough priority order:
- Get rid of cfengine
- Migration of services off some of our oldest servers
- Split-model Puppet (like Wikimedia)
- Projects Hosting (mostly repurposing 'kup', but needs some dev work)
- Split mail & dev.g.o
- eu.dev.g.o box (post-split of mail)
- Official Gentoo cloud images, from releng (because they'd make infra's
  life easier too).
- List Archives
- Website revamp

Stuff that is NOT on the table (and why)
- Git migration 
  - We're actually just blocked on a specific new sponsor for more than
	month now, they bought a nice new box, and they have to fix
	something in their network.

This also needs to have a self-sustaining result, not an expectation
that it will be repeated in future.

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Infrastructure Lead
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Dean Stephens]

On 02/15/15 22:26, hasufell wrote:
> Scripts no one can read except the team (even after being asked to
> publish them) is by definition propriety software. It was used to
> develop and package emul-linux-x86-* packages until this very day.
> 
Your prose might benefit from labeling when you are using hyperbole,
otherwise when you make factually inaccurate claims it might seem as
though you actually believe them.

In case that was unclear: while those scripts might not be formally
published, they have been made available to people who are not on the
team. Unless, that is, you define "the team" as anyone who has seen the
scripts; in which case you would be trivially correct by definition.

In short: less bathos, please.

Re: [gentoo-project] Infra Kickstarter?

[Pavlos Ratis]

[-- Attachment #1: Type: text/plain, Size: 4244 bytes --]

On Wed, Feb 18, 2015 at 5:47 AM, Robin H. Johnson <robbat2@gentoo.org>
wrote:

> On Tue, Feb 17, 2015 at 07:10:53AM -0500, Rich Freeman wrote:
> > On Tue, Feb 17, 2015 at 4:01 AM, Robin H. Johnson <robbat2@gentoo.org>
> wrote:
> > >
> > > If I could afford to spend the more than just volunteer time on Infra,
> > > yes, I'd love to have few full 40 hour weeks to put into cleaning up
> our
> > > cfengine and puppet to where it's significantly easier to manage.
> >
> > The one thing I was trying to avoid doing was giving an impression
> > that the infra team isn't busy doing work that helps everybody around
> > here.
> >
> > You summarize the problem well here.  You're too busy due to a labor
> > shortage to do the sorts of things that would help reduce the labor
> > shortage.
> Of infra staff, in 2014 antarus left infra, and we gained dastergon
> prometheanfire redlizard. bonsaikitten turned us down again, as he's
> busy running the gentooexperimental infrastructure.
>
> > I don't mean to trivialize the problem, either.  Gentoo has a lot of
> > donated infrastructure, and a decent amount of cash when you're
> > talking about replacing hard drives and such.  The problem is that we
> > really don't have the kind of money it would take to take on even a
> > single employee.
> I've wondered in the past, about doing a Kickstarter/IndieGogo to pay me
> for spending a month or two on Gentoo, based on the model of the very
> successful Django kickstarter:
>
> https://www.kickstarter.com/projects/andrewgodwin/schema-migrations-for-django
> (there have been other open source kickstarters since then, but the
> Django one was one of the first that delivered just open source
> software).
>
> If I wanted to do it full-time, for the cost of living (with my wife and
> 10 month old daughter) in Vancouver, at a bare minimum, I need it to be
> at least $6000CAD/month before taxes.
>
> Potential major projects for it, in a rough priority order:
> - Get rid of cfengine
> - Migration of services off some of our oldest servers
> - Split-model Puppet (like Wikimedia)
> - Projects Hosting (mostly repurposing 'kup', but needs some dev work)
> - Split mail & dev.g.o
> - eu.dev.g.o box (post-split of mail)
> - Official Gentoo cloud images, from releng (because they'd make infra's
>   life easier too).
> - List Archives
> - Website revamp
>
> Stuff that is NOT on the table (and why)
> - Git migration
>   - We're actually just blocked on a specific new sponsor for more than
>         month now, they bought a nice new box, and they have to fix
>         something in their network.
>
> This also needs to have a self-sustaining result, not an expectation
> that it will be repeated in future.
>
> --
> Robin Hugh Johnson
> Gentoo Linux: Developer, Infrastructure Lead
> E-Mail     : robbat2@gentoo.org
> GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
>
>
A Kickstarter/IndieGogo fund-raising campaign would be great for these kind
of time-consuming efforts.
I had asked in trustees' IRC channel about that topic last August and they
replied that there isn't any issue on running such campaigns with a
specific objective.

Although a remote full-time job is ideal and irreplaceable, an alternative
solution would be a Sprint like Debian DSA team[1] and KDE[2] did in the
past.
More specifically, KDE ran successfully fund-raiser campaigns for Randa
Meetings in 2012[3] and 2014[4].
In addition, instead of increasing expenses for booking a place to organize
the Sprint, a company could provide a room to hold the sprint, like SUSE
did to KDE Plasma developers[5].

Of course the alternative option needs more planning since the infra team
is distributed around the world and most of the members have already a
full-time jobs and obligations.
However, since a Sprint was discussed in the Gentoo Dinner in FOSDEM I
wanted to mention it as an alternative solution for potential organization
in the future.

[1] https://lists.debian.org/debian-project/2013/06/msg00164.html
[2] https://sprints.kde.org/sprint/all
[3] https://pledgie.com/campaigns/18045
[4] https://www.kde.org/fundraisers/randameetings2014/
[5]
https://news.opensuse.org/2010/02/11/meet-the-kde-plasma-developers-at-suse-feb-22/


Best regards,
Pavlos Ratis

[-- Attachment #2: Type: text/html, Size: 6020 bytes --]

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[hasufell]

Dean Stephens:
> On 02/15/15 22:26, hasufell wrote:
>> Scripts no one can read except the team (even after being asked to
>> publish them) is by definition propriety software. It was used to
>> develop and package emul-linux-x86-* packages until this very day.
>>
> Your prose might benefit from labeling when you are using hyperbole,
> otherwise when you make factually inaccurate claims it might seem as
> though you actually believe them.
> 
> In case that was unclear: while those scripts might not be formally
> published, they have been made available to people who are not on the
> team. Unless, that is, you define "the team" as anyone who has seen the
> scripts; in which case you would be trivially correct by definition.
> 

Are you saying you only share the code with your buddies? In that case,
it is against our social contract as well.

Not only that, it is even a serious security problem since the developer
community doesn't know how these things are packaged and neither do the
users.

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Matt Turner]

On Wed, Feb 18, 2015 at 9:56 AM, hasufell <hasufell@gentoo.org> wrote:
> Dean Stephens:
>> On 02/15/15 22:26, hasufell wrote:
>>> Scripts no one can read except the team (even after being asked to
>>> publish them) is by definition propriety software. It was used to
>>> develop and package emul-linux-x86-* packages until this very day.
>>>
>> Your prose might benefit from labeling when you are using hyperbole,
>> otherwise when you make factually inaccurate claims it might seem as
>> though you actually believe them.
>>
>> In case that was unclear: while those scripts might not be formally
>> published, they have been made available to people who are not on the
>> team. Unless, that is, you define "the team" as anyone who has seen the
>> scripts; in which case you would be trivially correct by definition.
>>
>
> Are you saying you only share the code with your buddies? In that case,
> it is against our social contract as well.

Yes, fine, it is. I don't think you're making an interesting point.

> Not only that, it is even a serious security problem since the developer
> community doesn't know how these things are packaged and neither do the
> users.

There's a serious security problem if they were to release the scripts
(passwords and all) right this second.

There's a lack of man power and that's completely sufficient to
explain why these things haven't happened.

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[hasufell]

Matt Turner:
> On Wed, Feb 18, 2015 at 9:56 AM, hasufell <hasufell@gentoo.org> wrote:
>> Dean Stephens:
>>> On 02/15/15 22:26, hasufell wrote:
>>>> Scripts no one can read except the team (even after being asked to
>>>> publish them) is by definition propriety software. It was used to
>>>> develop and package emul-linux-x86-* packages until this very day.
>>>>
>>> Your prose might benefit from labeling when you are using hyperbole,
>>> otherwise when you make factually inaccurate claims it might seem as
>>> though you actually believe them.
>>>
>>> In case that was unclear: while those scripts might not be formally
>>> published, they have been made available to people who are not on the
>>> team. Unless, that is, you define "the team" as anyone who has seen the
>>> scripts; in which case you would be trivially correct by definition.
>>>
>>
>> Are you saying you only share the code with your buddies? In that case,
>> it is against our social contract as well.
> 
> Yes, fine, it is. I don't think you're making an interesting point.
> 

My point is that the team violated the social contract.

>> Not only that, it is even a serious security problem since the developer
>> community doesn't know how these things are packaged and neither do the
>> users.
> 
> There's a serious security problem if they were to release the scripts
> (passwords and all) right this second.
> 

This statement makes me wonder if you really understand opensource (or
even free software).

Maybe the recruitment quizzes need to be fixed in this regard.

> There's a lack of man power and that's completely sufficient to
> explain why these things haven't happened.
> 

Definitely not.

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Matt Turner]

On Wed, Feb 18, 2015 at 10:47 AM, hasufell <hasufell@gentoo.org> wrote:
> Matt Turner:
>> On Wed, Feb 18, 2015 at 9:56 AM, hasufell <hasufell@gentoo.org> wrote:
>>> Dean Stephens:
>>>> On 02/15/15 22:26, hasufell wrote:
>>>>> Scripts no one can read except the team (even after being asked to
>>>>> publish them) is by definition propriety software. It was used to
>>>>> develop and package emul-linux-x86-* packages until this very day.
>>>>>
>>>> Your prose might benefit from labeling when you are using hyperbole,
>>>> otherwise when you make factually inaccurate claims it might seem as
>>>> though you actually believe them.
>>>>
>>>> In case that was unclear: while those scripts might not be formally
>>>> published, they have been made available to people who are not on the
>>>> team. Unless, that is, you define "the team" as anyone who has seen the
>>>> scripts; in which case you would be trivially correct by definition.
>>>>
>>>
>>> Are you saying you only share the code with your buddies? In that case,
>>> it is against our social contract as well.
>>
>> Yes, fine, it is. I don't think you're making an interesting point.
>>
>
> My point is that the team violated the social contract.

You don't get it. What's done is done. Suggesting that they simply
release everything as is this right this very second is irresponsible.

>>> Not only that, it is even a serious security problem since the developer
>>> community doesn't know how these things are packaged and neither do the
>>> users.
>>
>> There's a serious security problem if they were to release the scripts
>> (passwords and all) right this second.
>>
>
> This statement makes me wonder if you really understand opensource (or
> even free software).
>

If I didn't think there was a good chance you were running some of my
free software right now I'd probably be insulted.

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Wed, Feb 18, 2015 at 2:19 PM, Matt Turner <mattst88@gentoo.org> wrote:
> On Wed, Feb 18, 2015 at 10:47 AM, hasufell <hasufell@gentoo.org> wrote:
>>
>> My point is that the team violated the social contract.
>
> You don't get it. What's done is done. Suggesting that they simply
> release everything as is this right this very second is irresponsible.
>

Seems like there is interest all around in opening things up more.
That is a good thing.  We've been living with this for 10 years - we
can take our time to fix it correctly.  Scolding a team that already
wants to help us all out isn't the right approach.

I like Robin's "kickstarter" suggestion in general as a potential way
to improve things.  I'll probably comment further in the other
thread...

-- 
Rich

Re: [gentoo-project] Infra Kickstarter?

[Andreas K. Huettel]

[-- Attachment #1: Type: Text/Plain, Size: 1421 bytes --]

Am Mittwoch, 18. Februar 2015, 04:47:31 schrieb Robin H. Johnson:
>
> I've wondered in the past, about doing a Kickstarter/IndieGogo to pay me
> for spending a month or two on Gentoo, based on the model of the very
> successful Django kickstarter:

Sure, why not! It's worth a try.

> Potential major projects for it, in a rough priority order:
> - Get rid of cfengine
> - Migration of services off some of our oldest servers
> - Split-model Puppet (like Wikimedia)
> - Projects Hosting (mostly repurposing 'kup', but needs some dev work)
> - Split mail & dev.g.o
> - eu.dev.g.o box (post-split of mail)
> - Official Gentoo cloud images, from releng (because they'd make infra's
>   life easier too).
> - List Archives
> - Website revamp

Sounds good to me.

> Stuff that is NOT on the table (and why)
> - Git migration
>   - We're actually just blocked on a specific new sponsor for more than
> 	month now, they bought a nice new box, and they have to fix
> 	something in their network.

You know, keeping people updated of current developments (maybe some sort of 
infra blog, or an "Infra News" section of the GMN) would also be great. 
Especially for topics where a lot of passion is involved (say gitweb or git 
migration)... :] Write it once and be rid of questions for a while.

-- 

Andreas K. Huettel
Gentoo Linux developer 
dilfridge@gentoo.org
http://www.akhuettel.de/


[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 951 bytes --]

Re: [gentoo-project] Infra Kickstarter?

[vivo75]

Il 18/02/2015 04:47, Robin H. Johnson ha scritto:
> I've wondered in the past, about doing a Kickstarter/IndieGogo to pay me
> for spending a month or two on Gentoo, based on the model of the very
> successful Django kickstarter:
> https://www.kickstarter.com/projects/andrewgodwin/schema-migrations-for-django
> (there have been other open source kickstarters since then, but the
> Django one was one of the first that delivered just open source
> software).

I'll put $50CAD at least on this, I'm also offering my help as a senior
sysadmin / database manager if it could be of help.

Francesco Riosa

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Dean Stephens]

On 02/18/15 13:47, hasufell wrote:
> Matt Turner:
>> On Wed, Feb 18, 2015 at 9:56 AM, hasufell <hasufell@gentoo.org> wrote:
>>> Are you saying you only share the code with your buddies? In that case,
>>> it is against our social contract as well.
>>
I have not shared the code in question with anyone at all, I also happen
to have never been on the team that wrote, maintains, and uses is.

Knowing a claim is false does not automatically make one the subject of it.
>>> Not only that, it is even a serious security problem since the developer
>>> community doesn't know how these things are packaged and neither do the
>>> users.
>>
>> There's a serious security problem if they were to release the scripts
>> (passwords and all) right this second.
>>
> 
> This statement makes me wonder if you really understand opensource (or
> even free software).
> 
> Maybe the recruitment quizzes need to be fixed in this regard.
> 
While embedding authorization tokens in a script is not exactly in
keeping with best practices, implying that the only concern in
publishing a script which you have been told includes such tokens is
your own desire for it to be published is at best ignorant. As such, you
would appear to be in dire need of basic information security training.

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[hasufell]

Rich Freeman:
> 
> I like Robin's "kickstarter" suggestion in general as a potential way
> to improve things.  I'll probably comment further in the other
> thread...
> 

I think the solution is to make less pressure on infra. That way we are
also less dependant on infra.

This would be easily possible if gentoo was a collection of high-quality
overlays sharing the same base of policies and having tight
communication for inter-overlay matters, e.g. with a central bug tracker.

Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Rich Freeman]

On Fri, Feb 20, 2015 at 4:05 PM, hasufell <hasufell@gentoo.org> wrote:
> Rich Freeman:
>>
>> I like Robin's "kickstarter" suggestion in general as a potential way
>> to improve things.  I'll probably comment further in the other
>> thread...
>>
>
> I think the solution is to make less pressure on infra. That way we are
> also less dependant on infra.
>
> This would be easily possible if gentoo was a collection of high-quality
> overlays sharing the same base of policies and having tight
> communication for inter-overlay matters, e.g. with a central bug tracker.
>

I certainly agree that we should try to focus on the elements of infra
that are most essential.

However, I'm not sure that your suggestion will necessarily reduce the
impact on infra.  Moving lots of stuff to overlays doesn't get rid of
the need for a git repo unless we move EVERYTHING to overlays that
aren't hosted by Gentoo.  We might reduce the number of mirrors we
need if we stop mirroring some packages, but we won't eliminate the
need for mirrors unless we don't mirror anything.  Etc.

I imagine 95% of the burden of infra is in providing services at all.
If we didn't host any mailing lists, that would reduce infra.  If we
just retired a few lists, that wouldn't really make much difference.

Just something to keep in mind when trying to reduce our scope.  I do
generally think we should be thinking about what services are most
important to host ourselves vs just utilizing stuff that is out there.

-- 
Rich

Re: [gentoo-project] Infra Kickstarter?

[Patrick Lauer]

On 02/18/15 11:47, Robin H. Johnson wrote:
> On Tue, Feb 17, 2015 at 07:10:53AM -0500, Rich Freeman wrote:
>> On Tue, Feb 17, 2015 at 4:01 AM, Robin H. Johnson <robbat2@gentoo.org> wrote:
>>>
>>> If I could afford to spend the more than just volunteer time on Infra,
>>> yes, I'd love to have few full 40 hour weeks to put into cleaning up our
>>> cfengine and puppet to where it's significantly easier to manage.
>>
>> The one thing I was trying to avoid doing was giving an impression
>> that the infra team isn't busy doing work that helps everybody around
>> here.
>>
>> You summarize the problem well here.  You're too busy due to a labor
>> shortage to do the sorts of things that would help reduce the labor
>> shortage.
> Of infra staff, in 2014 antarus left infra, and we gained dastergon
> prometheanfire redlizard. bonsaikitten turned us down again, as he's
> busy running the gentooexperimental infrastructure.

.... eh?

*You* turned me down. I continue running stuff because apparently no one
else is able to do so, especially not infra. (Am I grumpy?)

I know it's bad form to quote private IRC communications, but in June
2014 you said:


<robbat2> but yourself and ryao are the two people i'm not inviting to
infra at this point
<robbat2> unless stuff gets really dire
<robbat2> i need to not inflame some of the politics, and while y'all
get stuff done, i can't juggle that and the politics at the same time


And I'm now like "... eh?"


Sigh.