From Fedora Project Wiki
< Infrastructure | Meetings
Meeting of 2007-02-22
*** Time shown in EST 14:59 < mmcgrath> Yo, we about ready to have a meeting? 15:00 * mdomsch here 15:00 * jcollie here 15:00 < mdomsch> mmcgrath, thanks for setting up publictest7 for me again 15:01 < mmcgrath> mdomsch: I just hope it doesn't disappear again 15:01 < mmcgrath> abadger1999, dgilmore, skvidal: ping? 15:02 * daMaestro here 15:02 < skvidal> yes? 15:02 < abadger1999> pong 15:02 < dgilmore> mmcgrath: sup 15:02 < mmcgrath> Ready for a meeting? 15:03 < mmcgrath> If its just the same with everyone I'd prefer to keep this meeting short so we can focus on buildsys and wiki topics, any objections? 15:03 * jcollie is ALWAYS ready for a meeting ;) 15:03 < mdomsch> no objection 15:03 < CodeX> hi 15:03 < abadger1999> Cool deal. 15:03 < skvidal> I object! 15:03 < mmcgrath> So I'll start on the wiki - The upgrade went ok. We are actually running proxy1 -> app1, proxy2 -> app2. 15:03 < skvidal> okay, no really, I'm just fucking with you 15:03 < skvidal> la la 15:03 < mmcgrath> skvidal! 15:04 < skvidal> :) 15:04 < skvidal> please, continue 15:04 < mmcgrath> app1 has app2 mounted via NFS. 15:04 < mmcgrath> The thing is actually working. 15:04 < mmcgrath> We are starting to run into performance issues though, I don't know if you guys have saved a page on the wiki in a while, it takes time. 15:04 < mmcgrath> 20-30 seconds. 15:04 < mmcgrath> The moin guys seem to think this is because of how many users we have. 15:04 < mmcgrath> When deciding who to email, it has to grep over all the user files to see who's watching that page. 15:05 < skvidal> mmcgrath: :( 15:05 < skvidal> mmcgrath: so we need to delete people? 15:05 < mmcgrath> We have options, but thats what we think is happening there. 15:05 < mmcgrath> skvidal: not sure. 15:05 < mmcgrath> I mean, 20-30 seconds isn't THAT long, but think about it. If someone wanted to DDOS the site, just script an add of a bunch of users. 15:06 < skvidal> do the moin people have any alternative user stores? 15:06 < skvidal> or can we store the user pages in a hashed subdir, for example? 15:06 < mmcgrath> also the kindofblue theme has some issues with the new wiki, I'm working on that. glezos created a new CSS that fixed some issues and generally looks nicer. 15:06 < skvidal> or maybe on a local path? 15:06 < mmcgrath> One of theme was talking about a way to create a user cache 15:06 < mmcgrath> But that was right before this meeting so we haven't discussed it much further. 15:07 -!- Netsplit orwell.freenode.net <-> irc.freenode.net quits: c4chris 15:08 < mmcgrath> looks like we've got 8510 users. 15:08 < mmcgrath> they said the ubuntu guys have the same issue. 15:08 < CodeX> How to make a successfull connection from FC6 to MSSQL <php-mssql> 15:08 < mmcgrath> CodeX you want #fedora, we're having an infrastructure meeting right now. 15:08 < mmcgrath> dgilmore: whats the word on koji? 15:08 < mmcgrath> f13: ping as well 15:09 < f13> sorry, was in another meeting. 15:09 < dgilmore> mmcgrath: things are moving f13 got koji through review 15:09 < f13> it passed package review, but I'm reluctant to build it until we get some test deployments going. 15:09 < dgilmore> we need to add ssl auth before we can do to much with koji 15:10 < dgilmore> we have our test box up 15:10 < mmcgrath> Are we going to let apache do that or koji? 15:10 < jcollie> are we going to re-use the ssl certs that we've been using for plague? 15:10 < dgilmore> mmcgrath: it needs added to koji 15:10 < dgilmore> jcollie: thats the plan 15:10 < mmcgrath> k 15:11 < dgilmore> we need to change the default config location 15:11 < dgilmore> mikem23: any of your guys done any ssl auth stuff yet? 15:13 < mmcgrath> dgilmore: are we blocked until that gets done? 15:13 < dgilmore> mmcgrath: until then we can do very minimal testing 15:13 -!- Netsplit over, joins: c4chris 15:14 < mmcgrath> k 15:14 < dgilmore> FC-5 doesnt have all the requirements so im going to yum update the FC-5 builder to FC-6 15:14 < mmcgrath> k 15:14 < mmcgrath> So aside from the auth stuff, anything to report? 15:15 < dgilmore> not yet. we are making progress 15:15 < dgilmore> i need to sit down with abadger1999 and work out how to sysnc packagedb to kojidb 15:15 < mmcgrath> <nod> 15:15 < abadger1999> yeah. 15:15 < mmcgrath> abadger1999: speaking of which, how's it going? Sounds like you've been working magic. 15:15 < jcollie> we need a fudcon chicago :) 15:16 < abadger1999> Yep :-) I've been busy on the packagedb 15:16 < mmcgrath> Any feedback from it? 15:16 < abadger1999> The front end (from user input => db) is almost complete. 15:16 < abadger1999> People say looks cool but not too much else yet. 15:16 < dgilmore> abadger1999: id like to see somewhere what all i own 15:17 < abadger1999> dgilmore: That's a good idea. 15:17 < abadger1999> I'll add that to the ROADMAP. 15:17 < dgilmore> bbiab 15:17 < abadger1999> Let's see -- I've one more feature to add (owner ability to approve acls) 15:17 < mmcgrath> All, if you have time, take a look - https://admin.fedoraproject.org/pkgdb/ 15:18 < abadger1999> Then I have to work with notting, sopwith, et al to implement syncing of ACLs, notification and bugzilla. 15:18 < abadger1999> Unless I'm missing something, we should then be able to get rid of owners.list. 15:18 < mmcgrath> That'd be awesome. 15:19 < mmcgrath> or at least generate owners.list from the database. 15:19 < mmcgrath> Has notting had a chance to look at this? 15:19 < abadger1999> I talked briefly with him today. I don't think he's had much chance to look. 15:19 * mmcgrath pings notting 15:20 -!- notting [i=notting@redhat/notting] has joined #fedora-admin 15:20 < dgilmore> back 15:20 < mmcgrath> notting: we're talking about the package database. Have you had a chance to take a look? 15:20 < mmcgrath> https://admin.fedoraproject.org/pkgdb/ 15:21 < notting> i looked a few weeks ago 15:21 < skvidal> notting: look now 15:21 < mmcgrath> He's done a lot of good work over the last couple of days. 15:21 < skvidal> I think it's a lot different 15:21 < mmcgrath> abadger1999: can you give him a roundup of what the status is. 15:22 < skvidal> abadger1999: one minor suggestion 15:22 < notting> pleeease, can i search by name :) 15:22 < abadger1999> Users can request acls and notification through the interface. 15:22 < abadger1999> notting: Username or package name? 15:22 < skvidal> in the 'browse all packages view' would it be possible to make the top item alphabets - not numbers? 15:22 < abadger1999> (Both are necessary) 15:22 < notting> abadger1999: package name 15:23 < abadger1999> skvidal: Not easy easy. But it does need to be done. 15:23 < abadger1999> I'm using the turbogears paginate decorator to generate that. 15:23 < notting> what is 'checkout' perms? 15:23 < abadger1999> It's just taking a select list from the db and limiting it to a range of packages (1-100, 100-200, etc) 15:24 < abadger1999> notting: For embargoed packages we're going to want to limit who can checkout a package. 15:24 < abadger1999> I'm thinking of hiding both checkout perm and build perm on the F7 rollout. 15:24 < notting> we don't have embargoes 15:24 < abadger1999> (checkout because there should be very few packages that apply - build because we have to integrate that with koji) 15:25 < abadger1999> It was on the list of requested features for the new VCS and packagedb. 15:25 < abadger1999> So security updates can be hidden. 15:25 < notting> yeah, just not sure if we actually need it 15:25 < abadger1999> k. 15:25 < notting> i'm not too keen on delegating approveacls to others 15:25 < abadger1999> Well it's in the db but I'll hide it from end user view for now. 15:26 < abadger1999> notting: That' done now, thogh. 15:26 < notting> what's the interface for approving people who want to be added to the package? 15:26 < abadger1999> Co-maintainership is the ability to approve acls for others. 15:27 < abadger1999> Requestor clicks button to get an acl row added to the pkgdb interface. Checks "commits" 15:27 < mmcgrath> notting: at a glance, how close do you think this is? 15:27 < abadger1999> Owner gets notification (unwritten) . Then owner goes to interface and changes status from 'Awaiting Review' t 'Approved' 15:28 < notting> the approvals don't seem to stick 15:28 < abadger1999> Yeah -- that's the one feature that hasn't been written yet. 15:28 < abadger1999> I'm working on it in the pkgdb-dev branch. 15:28 < notting> so, i can request approval for my own package. you might want to catch that case ;) 15:29 < abadger1999> I can only pull so many all-nighters in a week ;-) 15:29 < abadger1999> notting: I actually left that in on purpose. 15:29 < mmcgrath> abadger1999: if someone requests access to one of my package, where do I go to see what actions are pending my approval? 15:29 < notting> abadger1999: things we'd want before we go live 15:29 < abadger1999> notting: The reason being that right now we have orphaned packages that have people watching and pseud-maintaining them. 15:29 < notting> 1) notifications (probably via mail) to package owners that there are people requesting access/want approval 15:30 < abadger1999> mmcgrath: To the package's page. 15:30 < notting> 2) notifications via mail of ownership changes (people complained when this broke for owners.list) 15:30 < notting> 3) how does this work for adding a new package? 15:30 -!- c4chris [n=chris@186.14.78.83.cust.bluewin.ch] has quit [Connection timed out] 15:31 < notting> abadger1999: no, what i meant is that requesting commit/build/etc access for a package that i already own doesn't make much sense 15:32 < abadger1999> notting: To enable orphaned packages to have someone watching them, you need some way to approve the person who wants watch. 15:32 < abadger1999> So you take ownership, add yourself to the acl. Approve your own acls, drop ownership. 15:32 < abadger1999> Enabling this behaviour might be bad -- but it's something we have now. 15:33 < notting> abadger1999: by 'me', you mean 'anyone', or 'me' == 'admin'? 15:34 < abadger1999> notting: I'll steal heavily from your scripts for 1 & 2. 3 -- I'm open to suggestions. cvs-import contacts the packagedb? Some commandline tool for the cvs-admins torun? 15:34 < abadger1999> me == anyone. 15:35 -!- c4chris [n=chris@213-191.0-85.cust.bluewin.ch] has joined #fedora-admin 15:35 < notting> abadger1999: needs to be pre-cvs import - basically, at the same time the directories are created. if it's a script, dgilmore can tie it into his stuff 15:35 < abadger1999> Okay. So admins need to run it at the same time as directory creation. 15:36 < abadger1999> And dgilmore is working on that. 15:36 < notting> abadger1999: is there a concept of admin access to packagedb? 15:36 < warren> cvsadmin? 15:36 < abadger1999> Not yet. We've got to work out how we're going to integrate with the FAS on that. 15:37 < abadger1999> Of course, people who can touch the db can make changes. 15:37 < abadger1999> And it's not hard to code command line scripts that automate those changes. 15:37 < abadger1999> but GUI admin interface... not yet. 15:38 < warren> cvsadmin in FAS would be admin in packagedb? 15:38 < abadger1999> That would be fine. 15:38 < abadger1999> I can make that kind of restriction pretty easily. 15:39 < abadger1999> What about FESCo-sponsors have the ability to make changes though? 15:39 < mmcgrath> abadger1999: roadmap it? I'd say just get what we need. 15:40 < abadger1999> We don't want them to be cvsadmin's but we do want them to be able to make changes like "This owner is AWOL, asign his packages to orphan" 15:41 < notting> abadger1999: right now, all ownership changes go through cvsadmin 15:42 < abadger1999> notting: True. But FESCo policy is different. So we're going to have to change that. 15:42 < warren> notting, only because the tools don't allow anything else yet (right?) 15:42 < abadger1999> mmcgrath: You're right. I'll implement cvsadmin for now. 15:42 < notting> abadger1999: an owner should be able to drop -> orphan. perhaps a sponsor should drop -> orphan. i'd prefer picking up of a package go through admin. 15:42 < abadger1999> And we'll work on something else as FAS2 shapes up. 15:43 < notting> warren: no, because ownership changes impact access control to the source repository 15:43 < warren> notting, so a sponsor shouldn't be able to change ownership of a sponsoree's packages? 15:44 < abadger1999> notting: Are you talking all taking of packages should require admin approval? 15:45 < notting> abadger1999: i'm paranoid. 15:46 < abadger1999> I see your view but don't support it. Is it a policy decision that FESCo needs to decide? 15:47 < dgilmore> notting: im with you 15:47 -!- warren [i=warren@redhat/wombat/warren] has quit ["Leaving"] 15:47 < dgilmore> id rather have a sanity check in there 15:47 -!- warren [i=warren@nat/redhat/x-63bf95f68dd0f1a6] has joined #fedora-admin 15:48 < mmcgrath> hmm 15:48 < notting> abadger1999: well, they approved the locking down of owners.list 15:49 < mmcgrath> These are things we can always change later if wee need to. 15:49 < notting> abadger1999: so, keeping a similar policy in the new tool seems simplest 15:49 < abadger1999> True. but locking down owners.list was the only way to get what we wanted (people unable to change other people's packages if acls are set.) 15:50 < notting> and your current proposal appears to break that - a user could take an orphan package and set acl w/o any other intervention 15:50 < abadger1999> The rest of the things that come with it are too burdensome in my opinion. 15:50 < abadger1999> yes. Orphan package. 15:51 < abadger1999> They can't do the same to an owned package, though. 15:51 * mmcgrath just noticed its been 50 minutes. 15:51 < abadger1999> heh -- we best move on. 15:51 < mmcgrath> yeah. 15:51 < mmcgrath> Real quick I'll just open the floor. 15:52 < mmcgrath> Does anyone else have anything to discuss? 15:52 < mmcgrath> has everyone had a chance to look at puppet? 15:52 < daMaestro> has there been any discussion about a need for a single point of entry for file access? 15:52 < abadger1999> The little bit I interacted with the other day looked nice. 15:52 < daMaestro> (using public mirrors) 15:53 < mmcgrath> daMaestro: I must have missed your email? Can you send me the thread link? 15:53 < daMaestro> such: a user wants foo.rpm ... http://download.fedoraproject.org/core/foo.rpm? 15:53 < daMaestro> mmcgrath, lol.. ok.. you caught me.. i will send a message. 15:53 < mmcgrath> k, anyone have anything else? 15:54 < mmcgrath> allllrighty. =============== MEETING END =====================