Users with commit rights in src.fp.o but no more in packager group

[Mattia Verga]

Following my comment in
https://pagure.io/fesco/issue/2856#comment-812870 I wrote a simple
script to check how many users have commit rights onto some project in
src.fp.o, but aren't (anymore) members of the `packager` group:

```
Found 31 users with commit privileges but not in packager group:
packaging-team
stefanok
mmcgrath
kernel-maint
oddshocks
systemd-maint
lvm-team
abrt-team
i18n-team
amahdal
jvlomax
coremodule
libvirt-maint
sonkun
fonts-sig
narasim
perl-sig
dcr226
gecko-maint
ozamosi
sheltren
anaconda-maint
java-sig
duriantang
dracut-maint
ipa-maint
kmod-maint
mariobl
mck182
design-sw
cdeccio
```

With the exclusion of *-team, *-sig and *-maint, I think packaging
rights should be removed from those users.
Also, as per my comment linked above, I think there should be some check
to prevent users removed from packager group to maintain commit rights.
No idea where/how to implement that.

Mattia

[Fabio Valentini]

On Wed, Aug 24, 2022 at 7:31 PM Mattia Verga via devel
<devel(a)lists.fedoraproject.org&gt; wrote:
>  Following my comment in
>  https://pagure.io/fesco/issue/2856#comment-812870 I wrote a simple
>  script to check how many users have commit rights onto some project in
>  src.fp.o, but aren't (anymore) members of the `packager` group:
>
>  ```
>  Found 31 users with commit privileges but not in packager group:
>  packaging-team
>  stefanok
>  mmcgrath
>  kernel-maint
>  oddshocks
>  systemd-maint
>  lvm-team
>  abrt-team
>  i18n-team
>  amahdal
>  jvlomax
>  coremodule
>  libvirt-maint
>  sonkun
>  fonts-sig
>  narasim
>  perl-sig
>  dcr226
>  gecko-maint
>  ozamosi
>  sheltren
>  anaconda-maint
>  java-sig
>  duriantang
>  dracut-maint
>  ipa-maint
>  kmod-maint
>  mariobl
>  mck182
>  design-sw
>  cdeccio
>  ```
>
>  With the exclusion of *-team, *-sig and *-maint, I think packaging
>  rights should be removed from those users.
>  Also, as per my comment linked above, I think there should be some check
>  to prevent users removed from packager group to maintain commit rights.
>  No idea where/how to implement that. 
I think some of those *-team / *-sig / *-maint pseudo-group users are
outdated. Most of them probably pre-date the existence of actual
groups, so they are probably all ancient. For example, we removed the
xgl-maint pseudo-group a while ago, because it was actually unused,
and its associated bugzilla account was disabled.
I wonder for how many of these groups the same is true, and whether we
should actually remove them from all packages where that's the case.

Fabio

[Alasdair G Kergon]

On Wed, Aug 24, 2022 at 09:50:59PM +0200, Fabio Valentini wrote:
>  I think some of those *-team / *-sig / *-maint pseudo-group users
> are
>  outdated. Most of them probably pre-date the existence of actual
>  groups, so they are probably all ancient. For example, we removed the
>  xgl-maint pseudo-group a while ago, because it was actually unused,
>  and its associated bugzilla account was disabled.
>  I wonder for how many of these groups the same is true, and whether we
>  should actually remove them from all packages where that's the case. 
 
lvm-team is still in use as a package owner and default bugzilla
assignee.  To do anything of any significance using the account, we were
instructed to open a ticket to ask for the change to be made for us.

It has never been a member of the packager group because it was
decided that accounts that are not individuals cannot sign the
legal agreement that is a pre-requisite to being able to join that
group.

Alasdair

[Miro Hrončok]

On 24. 08. 22 22:53, Alasdair G Kergon wrote:
>  On Wed, Aug 24, 2022 at 09:50:59PM +0200, Fabio Valentini wrote:
> > I think some of those *-team / *-sig / *-maint pseudo-group users are
> > outdated. Most of them probably pre-date the existence of actual
> > groups, so they are probably all ancient. For example, we removed the
> > xgl-maint pseudo-group a while ago, because it was actually unused,
> > and its associated bugzilla account was disabled.
> > I wonder for how many of these groups the same is true, and whether we
> > should actually remove them from all packages where that's the case.
>    
>  lvm-team is still in use as a package owner and default bugzilla
>  assignee.  To do anything of any significance using the account, we were
>  instructed to open a ticket to ask for the change to be made for us.
>  
>  It has never been a member of the packager group because it was
>  decided that accounts that are not individuals cannot sign the
>  legal agreement that is a pre-requisite to being able to join that
>  group. 
We use the python-maint pseudo-account to be the default Bugzilla assignee for 
Pythons, e.g. https://src.fedoraproject.org/rpms/python3.11

Note that it does *not* require the account to be listed in maintainers or to 
have commit rights.

-- 
Miro Hrončok
-- 
Phone: [phone]
IRC: mhroncok

[Alexander Bokovoy]

On to, 25 elo 2022, Miro Hrončok wrote:
> On 24. 08. 22 22:53, Alasdair G Kergon wrote:
> >On Wed, Aug 24, 2022 at 09:50:59PM +0200, Fabio Valentini wrote:
> >>I think some of those *-team / *-sig / *-maint pseudo-group users are
> >>outdated. Most of them probably pre-date the existence of actual
> >>groups, so they are probably all ancient. For example, we removed the
> >>xgl-maint pseudo-group a while ago, because it was actually unused,
> >>and its associated bugzilla account was disabled.
> >>I wonder for how many of these groups the same is true, and whether we
> >>should actually remove them from all packages where that's the case.
> >lvm-team is still in use as a package owner and default bugzilla
> >assignee.  To do anything of any significance using the account, we were
> >instructed to open a ticket to ask for the change to be made for us.
> >
> >It has never been a member of the packager group because it was
> >decided that accounts that are not individuals cannot sign the
> >legal agreement that is a pre-requisite to being able to join that
> >group.
>
> We use the python-maint pseudo-account to be the default Bugzilla 
> assignee for Pythons, e.g. 
> https://src.fedoraproject.org/rpms/python3.11
>
> Note that it does *not* require the account to be listed in 
> maintainers or to have commit rights. 
Same for ipa-maint account.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[David Tardon]

Hi,

On Thu, 2022-08-25 at 11:04 +0300, Alexander Bokovoy wrote:
>  On to, 25 elo 2022, Miro Hrončok wrote:
>  > We use the python-maint pseudo-account to be the default Bugzilla 
>  > assignee for Pythons, e.g. 
>  > https://src.fedoraproject.org/rpms/python3.11
>  > 
>  > Note that it does *not* require the account to be listed in 
>  > maintainers or to have commit rights.
>  
>  Same for ipa-maint account. 
Same for systemd-maint and dracut-maint.

D.

[Mattia Verga]

Il 26/08/22 07:17, David Tardon ha scritto:
>  Hi,
>
>  On Thu, 2022-08-25 at 11:04 +0300, Alexander Bokovoy wrote:
> > On to, 25 elo 2022, Miro Hrončok wrote:
> >> We use the python-maint pseudo-account to be the default Bugzilla
> >> assignee for Pythons, e.g.
> >> https://src.fedoraproject.org/rpms/python3.11
> >>
> >> Note that it does *not* require the account to be listed in
> >> maintainers or to have commit rights.
> > Same for ipa-maint account.
>  Same for systemd-maint and dracut-maint.
>
>  D. 
So... wouldn't be better to have a consistent way across all packages to
deal with these cases?

What's better, a pseudo-user to be the main-admin of a package, or a
real user to be the main-admin and just add the pseudo-user as the
default assignee of bugs?

Who owns the credentials of those pseudo-users? Also, Fedora Accounts
user pages links to non-existent wiki pages... it would be nice to have
a description about them (if there's a consensus of continue listing
them as main-admin).

Mattia

[Kevin Fenzi]

On Sat, Sep 03, 2022 at 02:01:59PM +0000, Mattia Verga via devel wrote:
>  Il 26/08/22 07:17, David Tardon ha scritto:
>  > Hi,
>  >
>  > On Thu, 2022-08-25 at 11:04 +0300, Alexander Bokovoy wrote:
>  >> On to, 25 elo 2022, Miro Hrončok wrote:
>  >>> We use the python-maint pseudo-account to be the default Bugzilla
>  >>> assignee for Pythons, e.g.
>  >>> https://src.fedoraproject.org/rpms/python3.11
>  >>>
>  >>> Note that it does *not* require the account to be listed in
>  >>> maintainers or to have commit rights.
>  >> Same for ipa-maint account.
>  > Same for systemd-maint and dracut-maint.
>  >
>  > D.
>  
>  So... wouldn't be better to have a consistent way across all packages to
>  deal with these cases? 
Sure, but Fedora has been around for many years, accross a bunch of
differnt applications and these things have never been completly set. 
:(

>  What's better, a pseudo-user to be the main-admin of a package,
> or a
>  real user to be the main-admin and just add the pseudo-user as the
>  default assignee of bugs? 
We discussed this back when we switched from pkgdb to pagure-dist-git
some. One thought at the time was that we make every package use a
pseutouser for main-admin, but there's downsides to that too. 
On the plus side it would allow us to get rid of 'main admin'.
>  
>  Who owns the credentials of those pseudo-users? Also, Fedora Accounts
>  user pages links to non-existent wiki pages... it would be nice to have
>  a description about them (if there's a consensus of continue listing
>  them as main-admin). 
Many of them the group using them has the credentials, or no one at all. 

I'm not sure it's possible to get them all sorted, but I agree at least
a wiki page with info on them would be good to have at the very least.

kevin

[Vít Ondruch]

Dne 03. 09. 22 v 22:28 Kevin Fenzi napsal(a):
>  On Sat, Sep 03, 2022 at 02:01:59PM +0000, Mattia Verga via devel
> wrote:
> > Il 26/08/22 07:17, David Tardon ha scritto:
> >> Hi,
> >>
> >> On Thu, 2022-08-25 at 11:04 +0300, Alexander Bokovoy wrote:
> >>> On to, 25 elo 2022, Miro Hrončok wrote:
> >>>> We use the python-maint pseudo-account to be the default Bugzilla
> >>>> assignee for Pythons, e.g.
> >>>> https://src.fedoraproject.org/rpms/python3.11
> >>>>
> >>>> Note that it does *not* require the account to be listed in
> >>>> maintainers or to have commit rights.
> >>> Same for ipa-maint account.
> >> Same for systemd-maint and dracut-maint.
> >>
> >> D.
> > So... wouldn't be better to have a consistent way across all packages to
> > deal with these cases?
>  Sure, but Fedora has been around for many years, accross a bunch of
>  differnt applications and these things have never been completly set.
>  :(
>
> > What's better, a pseudo-user to be the main-admin of a package, or a
> > real user to be the main-admin and just add the pseudo-user as the
> > default assignee of bugs?
>  

What is the difference between pseudo-users and groups? The group 
membership management is certainly PITA, because group members cannot 
e.g. remove the group from retired packages:

https://pagure.io/releng/issue/10954

Apart from that, I don't think that the pseudo-users or group ownership 
would work. I saw a good amount of people giving the packages to some 
groups or pseudo-users, but in turn, that meant there is nobody who 
would care about such package.


Vít


>  We discussed this back when we switched from pkgdb to
> pagure-dist-git
>  some. One thought at the time was that we make every package use a
>  pseutouser for main-admin, but there's downsides to that too.
>  On the plus side it would allow us to get rid of 'main admin'.
> > Who owns the credentials of those pseudo-users? Also, Fedora Accounts
> > user pages links to non-existent wiki pages... it would be nice to have
> > a description about them (if there's a consensus of continue listing
> > them as main-admin).
>  Many of them the group using them has the credentials, or no one at all.
>
>  I'm not sure it's possible to get them all sorted, but I agree at least
>  a wiki page with info on them would be good to have at the very least.
>
>  kevin
>
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
>

[Miro Hrončok]

On 05. 09. 22 11:07, Vít Ondruch wrote:
>  
>  Apart from that, I don't think that the pseudo-users or group ownership would 
>  work. I saw a good amount of people giving the packages to some groups or 
>  pseudo-users, but in turn, that meant there is nobody who would care about such 
>  package. 
+100

-- 
Miro Hrončok
-- 
Phone: [phone]
IRC: mhroncok

[Kevin Fenzi]

On Mon, Sep 05, 2022 at 12:13:26PM +0200, Miro Hrončok wrote:
>  On 05. 09. 22 11:07, Vít Ondruch wrote:
>  > 
>  > Apart from that, I don't think that the pseudo-users or group ownership
>  > would work. I saw a good amount of people giving the packages to some
>  > groups or pseudo-users, but in turn, that meant there is nobody who
>  > would care about such package.
>  
>  +100 
While that can surely happen, it can and does also happen when someone
is 'main admin' of a package. :) You can't make someone care.
I think the best thing we can do is match up the people who care with
the packages they care about. Using main admin as a indicator of who
cares for the package doesn't seem right to me. You can definitely have
cases of packages where multiple people work on it, or cases where just
one person does, but they aren't the main admin. 

Anyhow, the only real reason we need main admin is that bugzilla needs 1
specific user to assign bugs to. Perhaps we could consider this when/if
we ever move off bugzilla. 

kevin

[Vít Ondruch]

Dne 06. 09. 22 v 0:25 Kevin Fenzi napsal(a):
>  On Mon, Sep 05, 2022 at 12:13:26PM +0200, Miro Hrončok wrote:
> > On 05. 09. 22 11:07, Vít Ondruch wrote:
> >> Apart from that, I don't think that the pseudo-users or group ownership
> >> would work. I saw a good amount of people giving the packages to some
> >> groups or pseudo-users, but in turn, that meant there is nobody who
> >> would care about such package.
> > +100
>  While that can surely happen, it can and does also happen when someone
>  is 'main admin' of a package. :) You can't make someone care.
>  

Right, but we have a process to identify inactive maintainers. If there 
is no maintainer left, the package is orphaned. The ownership should 
never be moved to the group. It is much harder to identify identify 
packages which are assigned to certain group, because the groups often 
are active.

And as I said, being member of ruby-packagers-sig, it is not straight 
forward to remove group from packages. Even though it has admin 
privileges, it cannot be removed from the package by the group member. 
Maybe I should report this somewhere officially ...


>  I think the best thing we can do is match up the people who care
> with
>  the packages they care about. Using main admin as a indicator of who
>  cares for the package doesn't seem right to me. You can definitely have
>  cases of packages where multiple people work on it, or cases where just
>  one person does, but they aren't the main admin.
>  

But this is typically problem of inactive maintainers. And I am looking 
forward to the current activity of identifying the inactive packagers. I 
truly believe this cleanup will help to deliver better content.


>  Anyhow, the only real reason we need main admin is that bugzilla needs 1
>  specific user to assign bugs to. Perhaps we could consider this when/if
>  we ever move off bugzilla.
>  

+1


Vít


>  kevin
>
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
>

[Vít Ondruch]

Dne 06. 09. 22 v 9:20 Vít Ondruch napsal(a):
>  Dne 06. 09. 22 v 0:25 Kevin Fenzi napsal(a):
> > On Mon, Sep 05, 2022 at 12:13:26PM +0200, Miro Hrončok wrote:
> >> On 05. 09. 22 11:07, Vít Ondruch wrote:
> >>> Apart from that, I don't think that the pseudo-users or group 
> >>> ownership
> >>> would work. I saw a good amount of people giving the packages to some
> >>> groups or pseudo-users, but in turn, that meant there is nobody who
> >>> would care about such package.
> >> +100
> > While that can surely happen, it can and does also happen when someone
> > is 'main admin' of a package. :) You can't make someone care.
>
>
>  Right, but we have a process to identify inactive maintainers. If 
>  there is no maintainer left, the package is orphaned. The ownership 
>  should never be moved to the group. It is much harder to identify 
>  identify packages which are assigned to certain group, because the 
>  groups often are active.
>
>  And as I said, being member of ruby-packagers-sig, it is not straight 
>  forward to remove group from packages. Even though it has admin 
>  privileges, it cannot be removed from the package by the group member. 
>  Maybe I should report this somewhere officially ...
>  

Here we go:

https://pagure.io/fedora-infrastructure/issue/10882


Not sure if this is the right place, maybe it should have been reported 
against pagure-dist-git ...


Vít


> > I think the best thing we can do is match up the people who care with
> > the packages they care about. Using main admin as a indicator of who
> > cares for the package doesn't seem right to me. You can definitely have
> > cases of packages where multiple people work on it, or cases where just
> > one person does, but they aren't the main admin.
>
>
>  But this is typically problem of inactive maintainers. And I am 
>  looking forward to the current activity of identifying the inactive 
>  packagers. I truly believe this cleanup will help to deliver better 
>  content.
>
>
> >
> > Anyhow, the only real reason we need main admin is that bugzilla needs 1
> > specific user to assign bugs to. Perhaps we could consider this when/if
> > we ever move off bugzilla.
>
>
>  +1
>
>
>  Vít
>
>
> >
> > kevin
> >
> > _______________________________________________
> > devel mailing list -- devel(a)lists.fedoraproject.org
> > To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct: 
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: 
> > https://lists.fedoraproject.org/archives/list/[e-mail]
> > Do not reply to spam, report it: 
> > https://pagure.io/fedora-infrastructure/new_issue
>

[Kevin Fenzi]

On Wed, Aug 24, 2022 at 05:30:35PM +0000, Mattia Verga via devel wrote:
>  Following my comment in
>  https://pagure.io/fesco/issue/2856#comment-812870 I wrote a simple
>  script to check how many users have commit rights onto some project in
>  src.fp.o, but aren't (anymore) members of the `packager` group:
>  
>  ```
>  Found 31 users with commit privileges but not in packager group:
>  packaging-team
>  stefanok
>  mmcgrath
>  kernel-maint
>  oddshocks
>  systemd-maint
>  lvm-team
>  abrt-team
>  i18n-team
>  amahdal
>  jvlomax
>  coremodule
>  libvirt-maint
>  sonkun
>  fonts-sig
>  narasim
>  perl-sig
>  dcr226
>  gecko-maint
>  ozamosi
>  sheltren
>  anaconda-maint
>  java-sig
>  duriantang
>  dracut-maint
>  ipa-maint
>  kmod-maint
>  mariobl
>  mck182
>  design-sw
>  cdeccio
>  ```
>  
>  With the exclusion of *-team, *-sig and *-maint, I think packaging
>  rights should be removed from those users. 
I think these are users who manually removed themselves from the
packager group, but didn't remove all their acls first. (and legit
groups/sigs).

>  Also, as per my comment linked above, I think there should be some
> check
>  to prevent users removed from packager group to maintain commit rights.
>  No idea where/how to implement that. 
I don't think it happens too often. We could make a script that checks
it from time to time tho. Might be a good cadidate for a toddler (
https://pagure.io/toddlers)

In the mean time I agree we should remove the non team/sig/maint users
above. 

kevin

[Mattia Verga]

Il 26/08/22 19:00, Kevin Fenzi ha scritto:
>  On Wed, Aug 24, 2022 at 05:30:35PM +0000, Mattia Verga via devel
> wrote:
> > ...
> >
> > With the exclusion of *-team, *-sig and *-maint, I think packaging
> > rights should be removed from those users.
>  I think these are users who manually removed themselves from the
>  packager group, but didn't remove all their acls first. (and legit
>  groups/sigs). 
Is it possible for users to remove themselves from the packager
group?
I've looked into fedora accounts interface, but I didn't found how.
> > Also, as per my comment linked above, I think there should be
> some check
> > to prevent users removed from packager group to maintain commit rights.
> > No idea where/how to implement that.
>  I don't think it happens too often. We could make a script that checks
>  it from time to time tho. Might be a good cadidate for a toddler (
>  https://pagure.io/toddlers) 
I'll try to write one. I suppose we just want to be
notified of a list
of users, rather than automatically remove users permissions?
>  In the mean time I agree we should remove the non team/sig/maint users
>  above.
>  
Should I file a ticket to releng? Or to fedora-infra?

Mattia

[Kevin]

On Sat, Aug 27, 2022 at 07:12:46AM +0000, Mattia Verga via devel wrote:
>  Il 26/08/22 19:00, Kevin Fenzi ha scritto:
>  > On Wed, Aug 24, 2022 at 05:30:35PM +0000, Mattia Verga via devel wrote:
>  >> ...
>  >>
>  >> With the exclusion of *-team, *-sig and *-maint, I think packaging
>  >> rights should be removed from those users.
>  > I think these are users who manually removed themselves from the
>  > packager group, but didn't remove all their acls first. (and legit
>  > groups/sigs).
>  Is it possible for users to remove themselves from the packager group?
>  I've looked into fedora accounts interface, but I didn't found how. 
Login to accounts.fedoraproject.org, go to
https://accounts.fedoraproject.org/group/packager/ and then scroll way
down past all the sponsors and there should be a 'leave group' button on
the right side at the start of the users in the group list.

>  >> Also, as per my comment linked above, I think there should
> be some check
>  >> to prevent users removed from packager group to maintain commit rights.
>  >> No idea where/how to implement that.
>  > I don't think it happens too often. We could make a script that checks
>  > it from time to time tho. Might be a good cadidate for a toddler (
>  > https://pagure.io/toddlers)
>  I'll try to write one. I suppose we just want to be notified of a list
>  of users, rather than automatically remove users permissions? 
yeah. At least initially...

>  >
>  > In the mean time I agree we should remove the non team/sig/maint users
>  > above.
>  >
>  Should I file a ticket to releng? Or to fedora-infra? 
Infra I guess...

kevin

Packages going to be orphaned (was: Users with commit rights in src.fp.o but no more in packager group)

[Mattia Verga]

I've filed a ticket [1] to fedora-infrastructure and @kevin is going to
remove commit rights from users which are no longer packagers.

There are a few packages which are going to be orphaned after the main
admin is removed. Here it is the list:

- bumpversion
- dia-CMOS
- dia-Digital
- dia-electric2
- dia-electronic
- drawtiming
- dnsviz
- ell
- espresso-ab
- fortune-mod
- hct
- kicad
- monobristol
- msimonson-anonymouspro-fonts
- sticky-notes
- ytalk

If you spotted any package you're willing to take as main admin, let
@kevin known by commenting on the ticket (or replying here, I suppose).
Otherwise the packages will enter the usual 6 weeks limbo before being
retired.

Mattia

[1] https://pagure.io/fedora-infrastructure/issue/10869