How quickly should we retire orphaned packages?

[Richard W.M. Jones]

As requested on this ticket, I'm opening this up for discussion.
https://fedorahosted.org/fesco/ticket/1332

There's a proposal to retire packages quite quickly (I think) after
they are orphaned.  At the moment packages are retired once per
release.  A notice is posted on devel list, see for example:

https://lists.fedoraproject.org/pipermail/devel/2013-August/188490.html

The proposal is to change this to 4 weeks after the package is
orphaned, assuming no maintainer picks up the package within that
time.

It's my belief that:

(a) The reason for wanting packages to be retired so quickly has not
been made clear by rel-eng.

(b) The biggest reason for people to use one distro over another is
based on number of packages available to be installed.  By retiring
packages more quickly we inevitably reduce this number thereby making
Fedora less popular.

(c) An orphaned package is not necessarily a risk ("security" has been
mentioned here ...).  Just because it might be a risk on rare
occasions doesn't mean we have to throw out every orphaned package.
Security bugs can sit around in non-orphaned packages too.

(d) 4 weeks is too short.  Some people go on holiday for this long.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://people.redhat.com/~rjones/virt-df/

[Haïkel]

2014-08-21 16:11 GMT+02:00 Richard W.M. Jones <rjones(a)redhat.com&gt;:
>  As requested on this ticket, I'm opening this up for discussion.
>  https://fedorahosted.org/fesco/ticket/1332
>
>  There's a proposal to retire packages quite quickly (I think) after
>  they are orphaned.  At the moment packages are retired once per
>  release.  A notice is posted on devel list, see for example:
>
>  https://lists.fedoraproject.org/pipermail/devel/2013-August/188490.html
>
>  The proposal is to change this to 4 weeks after the package is
>  orphaned, assuming no maintainer picks up the package within that
>  time.
>
>  It's my belief that:
>
>  (a) The reason for wanting packages to be retired so quickly has not
>  been made clear by rel-eng.
>  
*disclaimer: I'm not in Rel-Eng, just a mere packager*

I kinda understand their reasoning but if you don't find it clear, I
guess that many packagers don't too.


>  (b) The biggest reason for people to use one distro over another is
>  based on number of packages available to be installed.  By retiring
>  packages more quickly we inevitably reduce this number thereby making
>  Fedora less popular.
>  
I would be less dramatic about that but you raised a serious issue here.


>  (c) An orphaned package is not necessarily a risk
> ("security" has been
>  mentioned here ...).  Just because it might be a risk on rare
>  occasions doesn't mean we have to throw out every orphaned package.
>  Security bugs can sit around in non-orphaned packages too.
>  
You're right, but filtering packages that we could safely keep or not
would require manual filtering (though it could be partly automated)
We don't have enough manpower for that, unless a group wants to make a
counter-proposal, I don't see a better way to solve that issue.

>  (d) 4 weeks is too short.  Some people go on holiday for this long.
>  
I totally second that, this is too short in a community-driven project.

H.

>  Rich.
>
>  --
>  Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
>  Read my programming and virtualization blog: http://rwmj.wordpress.com
>  virt-df lists disk usage of guests without needing to install any
>  software inside the virtual machine.  Supports Linux and Windows.
>  http://people.redhat.com/~rjones/virt-df/
>  --
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

[Matthew Miller]

On Thu, Aug 21, 2014 at 04:19:17PM +0200, Haïkel wrote:
>  > (c) An orphaned package is not necessarily a risk
> ("security" has been
>  > mentioned here ...).  Just because it might be a risk on rare
>  > occasions doesn't mean we have to throw out every orphaned package.
>  > Security bugs can sit around in non-orphaned packages too.
>  You're right, but filtering packages that we could safely keep or not
>  would require manual filtering (though it could be partly automated)
>  We don't have enough manpower for that, unless a group wants to make a
>  counter-proposal, I don't see a better way to solve that issue. 
Could we move these to an "at your own risk" separate repository rather than
deleting them, except for when we know that there's a critical security
issue?

-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader

[Haïkel]

2014-08-21 16:23 GMT+02:00 Matthew Miller <mattdm(a)fedoraproject.org&gt;:
>  On Thu, Aug 21, 2014 at 04:19:17PM +0200, Haïkel wrote:
> > > (c) An orphaned package is not necessarily a risk ("security" has
> been
> > > mentioned here ...).  Just because it might be a risk on rare
> > > occasions doesn't mean we have to throw out every orphaned package.
> > > Security bugs can sit around in non-orphaned packages too.
> > You're right, but filtering packages that we could safely keep or not
> > would require manual filtering (though it could be partly automated)
> > We don't have enough manpower for that, unless a group wants to make a
> > counter-proposal, I don't see a better way to solve that issue.
>
>  Could we move these to an "at your own risk" separate repository rather than
>  deleting them, except for when we know that there's a critical security
>  issue?
>  
Sounds reasonable to me, that might require adapting our infrastructure though.

>  --
>  Matthew Miller
>  <mattdm(a)fedoraproject.org&gt;
>  Fedora Project Leader
>  --
>  devel mailing list
>  devel(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/devel
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct

[Kevin Fenzi]

On Thu, 21 Aug 2014 16:52:37 +0200
Haïkel <hguemar(a)fedoraproject.org&gt; wrote:

>  2014-08-21 16:23 GMT+02:00 Matthew Miller
> <mattdm(a)fedoraproject.org&gt;:
>  > On Thu, Aug 21, 2014 at 04:19:17PM +0200, Haïkel wrote:
>  >> > (c) An orphaned package is not necessarily a risk ("security"
>  >> > has been mentioned here ...).  Just because it might be a risk
>  >> > on rare occasions doesn't mean we have to throw out every
>  >> > orphaned package. Security bugs can sit around in non-orphaned
>  >> > packages too.
>  >> You're right, but filtering packages that we could safely keep or
>  >> not would require manual filtering (though it could be partly
>  >> automated) We don't have enough manpower for that, unless a group
>  >> wants to make a counter-proposal, I don't see a better way to
>  >> solve that issue.
>  >
>  > Could we move these to an "at your own risk" separate repository
>  > rather than deleting them, except for when we know that there's a
>  > critical security issue?
>  >
>  
>  Sounds reasonable to me, that might require adapting our
>  infrastructure though. 
This would be a tremendous amount of work from
releng/infrastructure/security-team for not much gain, IMHO. 

kevin

[Kevin Fenzi]

On Thu, 21 Aug 2014 15:11:53 +0100
"Richard W.M. Jones" <rjones(a)redhat.com&gt; wrote:

...snip...

First to be clear, I am not sure I really care one way or the other on
this proposal, but happy to try and add more information... ;) 

>  (a) The reason for wanting packages to be retired so quickly has not
>  been made clear by rel-eng. 
So, my understanding of the reasoning is that currently we retire
packages only once a cycle before branching. If we do this more often
it means there's less orphan packages that go out with the next stable
release (how many that is I don't know). 

So, you have foo getting orphaned now say, it would still go out with
f21, and only be retired in f22.

>  (b) The biggest reason for people to use one distro over another is
>  based on number of packages available to be installed.  By retiring
>  packages more quickly we inevitably reduce this number thereby making
>  Fedora less popular. 
I'm not sure I agree with your first statement there. ;) 

If we split texlive into 5,000 seperate packages Fedora would suddenly
become more popular? 

I think at least a good number of people want the packages they need
for whatever purpose, but they want them to be packaged well and
maintained when they have issues with them. 

>  (c) An orphaned package is not necessarily a risk
> ("security" has been
>  mentioned here ...).  Just because it might be a risk on rare
>  occasions doesn't mean we have to throw out every orphaned package.
>  Security bugs can sit around in non-orphaned packages too. 
Sure. Orphaned packages also increase frustration some since no one
answers bug reports or updates them or rebuilds them. 

>  (d) 4 weeks is too short.  Some people go on holiday for this long.
True. 

kevin

[Ralf Corsepius]

On 08/21/2014 04:31 PM, Kevin Fenzi wrote:
>  On Thu, 21 Aug 2014 15:11:53 +0100
>  "Richard W.M. Jones" <rjones(a)redhat.com&gt; wrote:
>
>  ...snip...
>
>  First to be clear, I am not sure I really care one way or the other on
>  this proposal, but happy to try and add more information... ;)
>
> > (a) The reason for wanting packages to be retired so quickly has not
> > been made clear by rel-eng. 
>  So, you have foo getting orphaned now say, it would still go out
> with
>  f21, and only be retired in f22. 
This sounds like a bug in the process to me. Agreed, a package from a 
released release can not be orphaned, but f21 has not yet been released, 
so unless something in Fedora depends on it, it's not too late.

Ralf

[Miloslav Trmač]

Hello,
----- Original Message -----
>  As requested on this ticket, I'm opening this up for discussion.
>  https://fedorahosted.org/fesco/ticket/1332 
<snip>
>  (a) The reason for wanting packages to be retired so quickly has not
>  been made clear by rel-eng. 
My reading of the ticket gives two reasons:
* Make the act of orphaning and the impact of removing a package more
  connected to each other, allowing the reasons for orphaning
  the package to be considered in the decision to retire or revive it.
  (Retiring in smaller batches would help this as well.)

* Make broken dependencies caused by retiring a package more immediately
  visible after the orphaning, to avoid once-per-release “time bombs”
  and the scramble to suddenly find maintainers.

  That our processes allows for such “time bombs” seems, to me,
  an inherently bad thing that we should be fixing.

>  (b) The biggest reason for people to use one distro over another is
>  based on number of packages available to be installed.  By retiring
>  packages more quickly we inevitably reduce this number thereby making
>  Fedora less popular. 
We wouldn’t remove packages from released branches, and the cumulative impact of the
regular retirement cycles on rawhide would AFAICT be exactly the same as the current one
big retirement cycle.

>  (c) An orphaned package is not necessarily a risk
> ("security" has been
>  mentioned here ...). 
We don’t want to gain a reputation of shipping packages that “are not necessarily a risk
but each user is required to verify this for themselves”.  Also, risk or not, an orphaned
package is frequently a _burden_ on whoever has to fix it up after failed rebuilds of the
package, or API breakage by its dependencies.

>  (d) 4 weeks is too short.  Some people go on holiday for this long.
That can obviously be tweaked.
    Mirek

[Dennis Gilmore]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 21 Aug 2014 11:02:23 -0400 (EDT)
Miloslav Trmač <mitr(a)redhat.com&gt; wrote:

>  Hello,
>  ----- Original Message -----
>  > As requested on this ticket, I'm opening this up for discussion.
>  > https://fedorahosted.org/fesco/ticket/1332
>  <snip>
>  > (a) The reason for wanting packages to be retired so quickly has not
>  > been made clear by rel-eng.
>  
>  My reading of the ticket gives two reasons:
>  * Make the act of orphaning and the impact of removing a package more
>    connected to each other, allowing the reasons for orphaning
>    the package to be considered in the decision to retire or revive it.
>    (Retiring in smaller batches would help this as well.)
>  
>  * Make broken dependencies caused by retiring a package more
>  immediately visible after the orphaning, to avoid once-per-release
>  “time bombs” and the scramble to suddenly find maintainers.
>  
>    That our processes allows for such “time bombs” seems, to me,
>    an inherently bad thing that we should be fixing.
>  
Note that we can not remove anything the shipped in the GA tree of a
release. that content is static forever. so while we can remove updates
we can not remove a package completely,  but removing from rawhide is
very doable


>  > (b) The biggest reason for people to use one distro over another
> is
>  > based on number of packages available to be installed.  By retiring
>  > packages more quickly we inevitably reduce this number thereby
>  > making Fedora less popular.
>  
>  We wouldn’t remove packages from released branches, and the
>  cumulative impact of the regular retirement cycles on rawhide would
>  AFAICT be exactly the same as the current one big retirement cycle.
>  
>  > (c) An orphaned package is not necessarily a risk ("security" has
>  > been mentioned here ...).
>  
>  We don’t want to gain a reputation of shipping packages that “are not
>  necessarily a risk but each user is required to verify this for
>  themselves”.  Also, risk or not, an orphaned package is frequently a
>  _burden_ on whoever has to fix it up after failed rebuilds of the
>  package, or API breakage by its dependencies.
>  
>  > (d) 4 weeks is too short.  Some people go on holiday for this long.
>  
>  That can obviously be tweaked.
>      Mirek
>  
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQIcBAEBAgAGBQJT90pmAAoJEH7ltONmPFDR3dUP/RReCsssCzLrQ0faS6H0Z25G
> 9vpZ+AuRbxu9r3v2rIUbqPG7SqD/iuaxrUnCj0M4GLlu4YODR4hBfFqjoZbRohFu
> lMzC4jMDWhUMtrs2rvkKWJ+prUl4Nfqah/E4cZd0EslwubTvCsBt4vkY7nGvBJVI
> bd9m6kjH7LTfTtothF9jbLWKGXkfWWYJAgmHHi6jqcT8L1AxfT9e7TMhG7CNtBvN
> Ro4PT8SsYCqkC5ZanS0G6IYj21ZCJrndnzsH/+Kqjm46VV/2uIOqfQSsqKsDRJ/d
> iM1Ecn4MbsAovmsV4ljdoYYWlHUHqqlau2UQfFYB188lfLqRY8VjDpEdYYJ1XLhS
> 9RkG+1+MbQ/MRJRBa3XZRZsFmlHi4VohiktrWJSxrwgi/ZI/Pi6TMEYdUeP7hdEn
> bTA6iraF6YyMP7tcrYo0rvIKL6zZ28fTYMCtvt76u77crNC0TVKD9Z2OBrcK2Z14
> 5YLr6LGhrNpzJNPeRgqpon8a7EztvCFd3A6F/9g+SP0nIVLD9AvansWq+np6QKbS
> QLN7MrB143m07FdHwS/n8r/4pfh2Mm6slR/7cBBfF79eekaXOsvQB0HGevHGeXUu
> RWAuJKJHD52LaSUFAIPzI4ArDBHhoTFbBpwzyz2v3cg6RCzkaWyKkC1LSJjrOCLo
> 8gt8P6xOxiJH2SgPKJ0S
> =k5Fh
> -----END PGP SIGNATURE-----
>

[Till Maas]

On Thu, Aug 21, 2014 at 03:11:53PM +0100, Richard W.M. Jones wrote:

>  (a) The reason for wanting packages to be retired so quickly has not
>  been made clear by rel-eng. 
Miloslav explained this nicely.

>  (b) The biggest reason for people to use one distro over another is
>  based on number of packages available to be installed.  By retiring
>  packages more quickly we inevitably reduce this number thereby making
>  Fedora less popular. 
One of the reasons to chose Fedora is also to be first. This is also not
true for orphaned packages nobody takes care of. Also since the package
will usually be retired up to six months later, I doubt that this really
makes an impact of why people chose Fedora.

>  (d) 4 weeks is too short.  Some people go on holiday for this long.
If the process only happens once per week as I proposed, there is an
additional half week in average.  There are additional 2 weeks in which
packages can be unretired without much effort. And even then it would be
easy to find a packager for a re-review if one asks here on the devel
list.

Regards
Till

[Richard W.M. Jones]

On Thu, Aug 21, 2014 at 07:57:43PM +0200, Till Maas wrote:
>  On Thu, Aug 21, 2014 at 03:11:53PM +0100, Richard W.M. Jones wrote:
>  
>  > (a) The reason for wanting packages to be retired so quickly has not
>  > been made clear by rel-eng.
>  
>  Miloslav explained this nicely.
>  
>  > (b) The biggest reason for people to use one distro over another is
>  > based on number of packages available to be installed.  By retiring
>  > packages more quickly we inevitably reduce this number thereby making
>  > Fedora less popular.
>  
>  One of the reasons to chose Fedora is also to be first. This is also not
>  true for orphaned packages nobody takes care of. Also since the package
>  will usually be retired up to six months later, I doubt that this really
>  makes an impact of why people chose Fedora. 
I don't understand the reference to "up to six months later" here.

Can you explain how retirement is proposed to work precisely, with
timescales.

>  > (d) 4 weeks is too short.  Some people go on holiday for this
> long.
>  
>  If the process only happens once per week as I proposed, there is an
>  additional half week in average.  There are additional 2 weeks in which
>  packages can be unretired without much effort. And even then it would be
>  easy to find a packager for a re-review if one asks here on the devel
>  list. 
And here, "unretired without much effort" means what exactly?

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html

[Till Maas]

On Fri, Aug 22, 2014 at 09:07:34AM +0100, Richard W.M. Jones wrote:

>  I don't understand the reference to "up to six months
> later" here.
>  
>  Can you explain how retirement is proposed to work precisely, with
>  timescales. 
>  And here, "unretired without much effort" means what
> exactly? 
This is the process for Fedora (EPEL is slightly different in case
someone wonders):

- PoCs can orphan their packages every time for every release
  (Maybe this applies to everyone with commit ACLs or should at least
  allow for everyone with commit ACLs)
- Anyone can retire orphaned packages in Branched till the final change
  deadline or in Rawhide. Then a reason is stored in a dead.package file
  in dist-git.
- Once a week there is a report sent to devel@fpo about which
  packages were retired/orphaned in the previous week
- Prior to branching, all orphaned and long time FTBFS packages are
  retired by rel-eng (with two releases a year, every orphaned package
  would be retired up to six months later). Also packages depending on
  packages to be retired will be retired, unless someone takes care of
  them. The announcements usually start some weeks prior to branching.
- Up to two weeks after a package is retired, no re-review is required,
  so unretirement requires a ticket for rel-eng to unblock the package
  from koji to allow builds being distributed, an update to pkgdb to
  change the state from Retired to Approved  (which currently needs to
  be made by rel-eng as well), and reverting the last commit in dist-git
- Afterwards unretiring a package requires are re-review.

Regards
Till