On Sat, 4 Jun 2005, Eric Rostetter wrote:
Quoting Pekka Savola <pekkas@xxxxxxxxxx>:
On Fri, 3 Jun 2005, Eric Rostetter wrote:
Seriously, if we can't get 2 votes for a package, then there is a real
problem going on.
It's pretty clear we've had a real problem going on for a long time.
Well, the urgency hasn't been made apparent enough. I'm serious here.
I'm involved in the project, and I didn't know there was as big a problem
as we have. So how would people not involved know?
Umm, how plainly do you want to get it? At least I have tried to get
people realize that these updates don't happen just by themselves, but
if you refuse to believe it (or just prefer to wait for the others do
the work), there isn't all that much to be done.
A couple of examples,
https://www.redhat.com/archives/fedora-legacy-list/2005-February/msg00168.html
https://www.redhat.com/archives/fedora-legacy-list/2005-March/msg00142.html
https://www.redhat.com/archives/fedora-legacy-list/2005-March/msg00254.html
https://www.redhat.com/archives/fedora-legacy-list/2005-March/msg00269.html [close to end]
https://www.redhat.com/archives/fedora-legacy-list/2005-May/msg00065.html
How should folks (me and others) have said it instead to make it
sufficently plain that there's a problem?
(A smaller, specific instance of lack of testing seems to be that
sufficiently many people aren't interested in FC1/FC2 and lack of
verifies for those stall the updates for other distros.)
That is, IMHO, a separate issue. Lack of votes for any OS is the
problem, not lack of votes for a particular OS. We could work around
the lack of votes for a particular OS, but we can't work around a
total lack of votes.
I think obtaining two verify votes (for any OS version) would still be
feasible at this point. For more than that (like 1 x OS or 2 x OS
version) won't really cut it.
That isn't the point of the project though. It would be much better to
get two votes. Heck, if you do one, and I do one, we're done. The only
time that would be a problem is the once or twice a year we go on vacation.
That doesn't seem to have happened all that much, however.
Then let's make it happen, okay?
I encourage you to to do it.
However, I want the project to do something _now_, not in some
unspecified time in the future (when/if willing testers have been
recruited). Just going on as before is unacceptable at this point.
That said, I could also live with two verify votes (for any version)
plus the similar timeout, but I think timeliness is more important.
I can agree to 2 votes plus timeout. If we give 2 weeks for the votes,
and 2 additional weeks for the timeout, then everything is done in one
month. Sounds reasonable to me.
4 weeks is a long time for more important security bugs. 2 weeks is
maximum after the stuff has been pushed to updates-testing (which
typically has also taken quite a while).
I think if it is a important security bug, it will not need the timeout
as much. I don't want to rush the less important updates though. Yes,
there's a judgement call as to what is important and what isn't. But
let's try the longer timeout and see how it works. If it doesn't work,
we can go back and shorten it.
There have been bugs like php, perl, kernel etc. which have been in
progress for a very long time, and the problems have been significant.
I suggest we make sufficiently big changes now (two weeks), and based
on the results, adjust as appropriate. Remember, it's two weeks from
the first VERIFY. Usually getting even that may take a while. If
folks agree that it should be two VERIFY votes, I could accept (4
weeks from the first verify) || (2 weeks from the second verify),
whichever is the soonest.
FYI, one verify vote is sufficient to VERIFY a distro version right
now, so this is why I said one measly verify vote.
I wasn't aware of this; last I knew we still needed two votes. How/when
did this change?
A long time ago, maybe a bit over 6 months or so ago.
Strange that as the web site, FAQ, etc. maintainer I'm so out of touch
with reality.
Well, the change was done in Wiki, so it didn't require action from
you. Not looking at wiki or actively testing packages may not reveal
such changes which are required to keep us moving.
--
Pekka Savola "You each name yourselves king, yet the
Netcore Oy kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
--
fedora-legacy-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/fedora-legacy-list
