Discussion:
Request for feedback on draft: DEP-18: Enable true open collaboration on all Debian packages
Add Reply
Otto Kekäläinen
2024-07-27 22:40:01 UTC
Reply
Permalink
Hi all,

I have drafted a new DEP at
https://salsa.debian.org/dep-team/deps/-/merge_requests/8 titled "DEP-18:
Enable true open collaboration on all Debian packages".

Direct link to raw text:
https://salsa.debian.org/dep-team/deps/-/raw/798bfa5a1e1609afd4e48ee20aff80a82bcd4a2f/web/deps/dep18.mdwn

This would have been a great topic to discuss in person at DebConf, but
unfortunately I can't attend this year, so I'll just kick this off on the
mailing list.

This is continuation to the 'single maintainership' discussions earlier
this year. I also think that more unified and open collaboration processes
could help decrease maintainer burnout, lower barrier for existing and new
maintainers to help with multiple packages, and overall perhaps also
improve quality of uploads by having more attention on the source code
prior to upload.

If you think this proposal makes sense, please press the thumbs up button.

If you have comments, please share them here or on the draft itself.

Thanks,

Otto
Jonas Smedegaard
2024-07-27 23:50:02 UTC
Reply
Permalink
Hi Otto,

Quoting Otto KekÀlÀinen (2024-07-28 00:38:40)
Post by Otto Kekäläinen
Hi all,
I have drafted a new DEP at
Enable true open collaboration on all Debian packages".
https://salsa.debian.org/dep-team/deps/-/raw/798bfa5a1e1609afd4e48ee20aff80a82bcd4a2f/web/deps/dep18.mdwn
This would have been a great topic to discuss in person at DebConf, but
unfortunately I can't attend this year, so I'll just kick this off on the
mailing list.
This is continuation to the 'single maintainership' discussions earlier
this year. I also think that more unified and open collaboration processes
could help decrease maintainer burnout, lower barrier for existing and new
maintainers to help with multiple packages, and overall perhaps also
improve quality of uploads by having more attention on the source code
prior to upload.
If you think this proposal makes sense, please press the thumbs up button.
If you have comments, please share them here or on the draft itself.
I like how Debian discussions are email-based. It means less work
depends on being online. I can read conversations without worrying about
tolls on network activities, and can search my private archive of
historical conversations however I want to set that up (e.g. using
notmuch).

DEP-18 mandates (or more accurately it "should-ifies") web-based
conversations. Not for bugs, specifically, but for other conversations
where I consider Debbugs and mailinglists as reasonable alternatives.
(yes, I understand that some disagree with me, and find email clumsy
and Salsa web interfaces far better).

In section 4, we "should" enable discussion and review of merge requests
as web-based Salsa conversations, which means those conversations will
not happen on mailinglists or in Debbugs. That section also says that
there is no pressure on the maintainer to engage in those conversations,
it is all about letting others contribute, but it is in the best case
confusing for contributors if their contributions are ignored, and more
likely that is perceived as quite rude behaviour of the maintainer.
To not accidentally come across as rude, I have consistently enabled
only the ability to *fork* but disabled all other more "chatty" features
because while I *do* want "true collaboration", I dislike the web-based
conversation platform offered as part of Salsa, and unfortunately Salsa
cannot be told to redirect to anywhere else, so the best I can do to
signal "I am not hanging out here, please look for me elsewhere" is to
turn those features off.

Sorry, but I disagree that the only true collaboration is Salsa-rich
collaboration. Where are my options to mirror the data at Salsa, as I
can do with mailinglists and Debbugs, to work with it also offline?

Regards,

- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Jonas Smedegaard
2024-07-28 08:50:01 UTC
Reply
Permalink
Quoting Jonas Smedegaard (2024-07-28 01:48:10)
Post by Jonas Smedegaard
Hi Otto,
Quoting Otto KekÀlÀinen (2024-07-28 00:38:40)
Post by Otto Kekäläinen
Hi all,
I have drafted a new DEP at
Enable true open collaboration on all Debian packages".
https://salsa.debian.org/dep-team/deps/-/raw/798bfa5a1e1609afd4e48ee20aff80a82bcd4a2f/web/deps/dep18.mdwn
This would have been a great topic to discuss in person at DebConf, but
unfortunately I can't attend this year, so I'll just kick this off on the
mailing list.
I think it is great that you started a conversation here on our d-devel
mailinglist: Not all of Debian is at Debconf.

Also great if those at Debconf discuss this topic there - and then
share valuable points at those conversations here at the larger forum of
Debian as a whole.

Speaking of multiple conversation platforms: I received a followup to my
previou post here on this mailinglist, posted through one of those
multiple Salsa conversation spots. I received that followup post by
email, but when I replied, my reply was rejected for being from a wrong
email address.

@Otto: You should have received a copy of my reply. Please consider
reposting that forked conversation here on the mailinglist, to help keep
the conversation going - not splintering it by shifting platform mid-way
through the conversation.

- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Otto Kekäläinen
2024-08-01 05:40:01 UTC
Reply
Permalink
Hi!
Post by Jonas Smedegaard
Post by Otto Kekäläinen
I have drafted a new DEP at
Enable true open collaboration on all Debian packages".
https://salsa.debian.org/dep-team/deps/-/raw/798bfa5a1e1609afd4e48ee20aff80a82bcd4a2f/web/deps/dep18.mdwn
..
Post by Jonas Smedegaard
Sorry, but I disagree that the only true collaboration is Salsa-rich
collaboration. Where are my options to mirror the data at Salsa, as I
can do with mailinglists and Debbugs, to work with it also offline?
First of all, thanks for maintaining 650+ packages in Debian. You have
for sure developed an optimal workflow for yourself. I also do a lot
of email based stuff myself and often work offline. Note that GitLab
does allow responding by email to notifications and to carry reviews
by email. Depending on configuration, one could even submit patches by
email[1]. There are also command-line tools that allow various actions
without having to use the browser [2,3]. I do however understand that
people who already have an optimal workflow are probably not keen to
change it unless the new workflow is vastly superior, and GitLab/Salsa
isn't always perfect in all regards. I do however believe that in the
grand scheme of things promoting the five key principles outlined in
DEP-18 would benefit Debian as a whole.

Also, I can see that you are already following principles 1 and 2 of
the proposal by having almost all of your packages in git and on
salsa.debian.org. As the DEP-18 draft text says, strict enforcement is
not a wise tactic in the context of fostering collaboration, and I
would not expect you to move away from what you are doing now, as it
works for you and benefits Debian with 650+ packages. In your case
following the principles 3, 4 and 5 would probably not be appropriate
in cost vs benefit. For example running Salsa CI or asking for code
reviews prior to upload would probably just slow things down too much
without the gain in your case.

However, I would still argue that DEP-18 would be useful as a general
guideline in Debian and in particular for team maintained packages and
important packages (as discussed in the "end single maintainership
thread"). Having such principles published would help maintainers (at
least new maintainers) to align on a set of basic principles that help
drive more collaborative development.

[1] https://docs.gitlab.com/ee/user/project/merge_requests/creating_merge_requests.html
[2] https://manpages.debian.org/unstable/devscripts/salsa.1.en.html
[3] https://manpages.debian.org/unstable/glab/glab.1.en.html
Jonas Smedegaard
2024-08-01 08:50:01 UTC
Reply
Permalink
Quoting Otto KekÀlÀinen (2024-08-01 07:30:18)
Post by Otto Kekäläinen
Post by Jonas Smedegaard
Post by Otto Kekäläinen
I have drafted a new DEP at
Enable true open collaboration on all Debian packages".
https://salsa.debian.org/dep-team/deps/-/raw/798bfa5a1e1609afd4e48ee20aff80a82bcd4a2f/web/deps/dep18.mdwn
..
Post by Jonas Smedegaard
Sorry, but I disagree that the only true collaboration is Salsa-rich
collaboration. Where are my options to mirror the data at Salsa, as I
can do with mailinglists and Debbugs, to work with it also offline?
First of all, thanks for maintaining 650+ packages in Debian.
Ideally those are all team-maintained. Please get in touch if you (yes
you reading this text) want to help with any of them. Here is the
list: https://qa.debian.org/developer.php?email=dr%40jones.dk
Post by Otto Kekäläinen
You have for sure developed an optimal workflow for yourself.
Then I have failed: I have strived towards a collaborative workflow.

Just not a web-centered collaborative workflow, but an email- and chat-
based one.
Post by Otto Kekäläinen
I also do a lot of email based stuff myself and often work offline.
Note that GitLab does allow responding by email to notifications and
to carry reviews by email. Depending on configuration, one could even
submit patches by email[1]. There are also command-line tools that
allow various actions without having to use the browser [2,3].
Non-web access to Gitlab is secondary. Unless you access via web, you
see only fragments.
Post by Otto Kekäläinen
I do however understand that people who already have an optimal
workflow are probably not keen to change it unless the new workflow is
vastly superior, and GitLab/Salsa isn't always perfect in all regards.
I do not agree with framing my criticism of Gitlab as me requiring it to
be "vastly superior" to consider it. In fact, I find that framing
offensive: I say that I want A and don't need B, you reframe that as I
require B to be A+B which makes it look like my demand is unreasonable.

To me, it is not a matter of inferior or superior, but instead different
core designs: web-centric versus decentral and offline-first.

Oh, and a side note: The concept of "offline-first" is most often used
about offline-first *web* designs, which does not mean that they are
"vastly superior" to e.g. mailinglists. And the concept of "decentral"
is also used for blockchain-based designs. Complexity and bloat is both
superior and inferior, depending on qualities viewed and who gets to pay
the costs: Web-based systems have some costs at the server side which
are "hidden" by the user (except indirectly through e.g. slow response
times as we experience at the moment with Gitlab), and some costs
offloaded to the client commonly through JavaScript (Gitlab is somewhat
heavy here, but not the worst: I notice how the fan often kicks in when
my friends open Facebook on their somewhat-aged laptop).
This talk about systems being light or heavy (which eventually affects
our environment) is sidestepping my core argument, however: Yes, I do
prefer lightweight systems, but my main point in this discussion is
only the ability for each maintainer to *choose* their poison. Because
collaboration is still very much possible without mono-culture.

Imagine that I argued that I prefer Emacs-ish keybindings, and you then
rephrase that as I want collaboration to follow the GNU principles, so
all tools must be GNU-compatible. That was not my point, my point was
that each of us has a favorite set of keybindings and we need not all
agree on a single set of keybindings - unless we choose to use systems
that include user interfaces (like web-based ones).

I want to be able to use emacs. But only as an example. I want each of
my team members to be able to continue their personal optimized working
style. Some of us use notmuch-related email, others use Evolution or
Gmail.
Post by Otto Kekäläinen
I do however believe that in the grand scheme of things promoting the
five key principles outlined in DEP-18 would benefit Debian as a
whole.
It benefits Debian as a whole to switch to Emacs. But is that the
Debian we want?

What I want for Debian, and what I assume is also what you want, is a
more collaborative Debian.

I don't say that collaboration requires a system vastly superior to
Gitlab. I say that collaboration through Gitlab alienates workflows
which I find problematic to discourage.

I find it problematic to discourage workflows done by old farts. This is
not a joke: Some in Debian have used Emacs so much in their life that it
is truly difficult for them to switch, and (not mandating, yet, only)
favoring another UI means that these folks are less efficient. Now, this
is not an emacs-versus-vim debate (and I use neither of those myself),
but the comparison seems apt, because Debian works fine with each of us
using whatever UI we prefer, but moving to a web-centric UI we need to
agree on a universal UI.

Essentially I don't like the Gitlab UI. Maybe the majority of Debian are
ok with the UI of Gitlab, but if it is sane for UI choice to be decided
democratically, then why not have a vote on editor choice as well? and
while at it, let's vote on KDE vs. GNOME (and not even waste time on
snowflakes like Sway or Xfce). That would be a different community than
the Debian I like to collaborate within.

...and I *do* mean "collaborate", not "cooperate". I do want
collaboration, even if my too many packages can be seen as a "smell"
that personally I have failed at collaborating. Yes, collaboration is
likely ensured with a platform like Gitlab, but no, mono-cultural
collaboration is not the only form of collaboration, and I find it a
problematic one.
Post by Otto Kekäläinen
Also, I can see that you are already following principles 1 and 2 of
the proposal by having almost all of your packages in git and on
salsa.debian.org. As the DEP-18 draft text says, strict enforcement is
not a wise tactic in the context of fostering collaboration, and I
would not expect you to move away from what you are doing now, as it
works for you and benefits Debian with 650+ packages. In your case
following the principles 3, 4 and 5 would probably not be appropriate
in cost vs benefit. For example running Salsa CI or asking for code
reviews prior to upload would probably just slow things down too much
without the gain in your case.
If you mean to say that my current contributions to Debian comply with
DEP-18, then I am surprised, and I think the text need a heavy rewrite.

In its current form, I would expect the next revision of codesmells to
have me smelling badly of non-collaborative.

You may find my ways of contributing to Debian perfectly fine, but I
have a hard time not seeing this draft formalisation of what constitutes
good collaborative manners in Debian as a strong tool for pressuring
those collaborating differently into "getting in line" - conforming.
Conforming on choice of editor is, I think, a repulsive thought to most
if not all of us in Debian, but e.g. from a sustainability PoV I find it
quite harmless compared to conforming on collaboration as web-based,
as opposed to decentral and offline-first.
Post by Otto Kekäläinen
However, I would still argue that DEP-18 would be useful as a general
guideline in Debian and in particular for team maintained packages and
important packages (as discussed in the "end single maintainership
thread"). Having such principles published would help maintainers (at
least new maintainers) to align on a set of basic principles that help
drive more collaborative development.
I agree that DEP-18 represent "principles that help drive more
collaborative development", but I disagree that they are "basic", since
3 of 5 principles are strongly tied to a specific UI.

Yes, that UI allows multiple workflows, and DEP-18 sensibly steers clear
of promoting a specific workflow. But implicitly the text discrouages
e.g. decentral and offline-first workflows that I find important.

Thanks a lot for all the time you put into this. Despite my strong
opinion, I do see the value of pushing this agenda, and of exploring
the boundaries of the forge we have currently invested in using.

- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Luca Boccassi
2024-08-01 11:30:01 UTC
Reply
Permalink
Quoting Otto Kekäläinen (2024-08-01 07:30:18)
Post by Otto Kekäläinen
You have for sure developed an optimal workflow for yourself.
Then I have failed: I have strived towards a collaborative workflow.
Just not a web-centered collaborative workflow, but an email- and chat-
based one.
Emails are actually a barrier against collaboration, and actively
hinder it by preventing new people from joining in. Please understand
that, outside of the demographic group of people who started using
computers in the 70s and 80s, the vast majority of opinions on the
topic of email as a collaborative tool range from "barely tolerated"
to "deeply hated". Emails sucks, it's horrible and outdated stuff
based on horrible and outdated procolos and ideas, and today it is by
and large a system to deliver spam, phishing and malware, with
occasional barely useful things like confirming registration on a new
website or resetting a lost password. The vast majority of people who
are forced to use emails do so for work via a
work-mediated/administered interface that tries to make it somewhat
tolerable, like Outlook or Gmail. By and large people born this side
of the millennium look at people running their own email workflows as
you would look at someone programming with punchcards - an interesting
curiosity if found in a museum re-enactment or a history book
photograph, and a strong reason to get the heck out of there
otherwise. And outside of the tech bubble it's even worse. Some
projects like the kernel can afford to let the curmudgeons continue to
dictate its use because it's a de-facto monopoly and if one wants to
get things merged in Linux there is no alternative, and even then
there are continuous grumblings and attempts by the IT infra managers
to build bridges with the 21st century with custom and bespoke
kernel-specific kludges, to the point where some subtree maintainers
have just gone "fuck this" and set up their own Gitlab repos for their
own subtrees. We don't have that luxury: there are plenty of
alternatives to Debian that work just as well for the same use cases.

The number of people involved in programming, software engineering, IT
and any other related field has absolutely exploded since the 90s. The
number of Debian project members has remained pretty much flat at
~1000 people, and we just about manage to backfill retirements/MIAs.
To pick a random example, a less well known, less used, less popular
distribution like Nixos has 7000+ contributors listed on Github. It
would be wise to stop and reflect on why this is the case every now
and then. The passage of time and demographics are cruel and
merciless.

And the fact that, two decades or so after it became standard practice
in the industry, there is _still_ resistance against having CI runs
_before_ pushing things out simply boggles my mind. This is a no
brainer: run a CI before uploading, even a very basic one is just
fine, better than nothing. It's 2024, "but but but the Gitlab UI
doesn't display nicely on my 80x24 green phosphor monochrome monitor"
just doesn't cut it anymore, sorry.
Charles Plessy
2024-08-01 12:50:01 UTC
Reply
Permalink
run a CI before uploading, even a very basic one is just fine, better
than nothing.
Thanks for the remider ! I will have a closer look at Salsa CI instead
of trying to understand how to run autopkgtests locally.

Would there be a way to get Salsa upload and tag the package if the CI
tests pass and the changelog signals a release? Or does somebody has a
script which can screen a Salsa group for ready uploads, and run clone
&& buildpackage && dput automatically ?

Cheers,

Charles
--
Charles Plessy Nagahama, Yomitan, Okinawa, Japan
Debian Med packaging team http://www.debian.org/devel/debian-med
Tooting from work, https://fediscience.org/@charles_plessy
Tooting from home, https://framapiaf.org/@charles_plessy
Luca Boccassi
2024-08-01 13:00:01 UTC
Reply
Permalink
Post by Charles Plessy
run a CI before uploading, even a very basic one is just fine, better
than nothing.
Thanks for the remider ! I will have a closer look at Salsa CI instead
of trying to understand how to run autopkgtests locally.
Would there be a way to get Salsa upload and tag the package if the CI
tests pass and the changelog signals a release? Or does somebody has a
script which can screen a Salsa group for ready uploads, and run clone
&& buildpackage && dput automatically ?
See https://www.debian.org/vote/2024/vote_002 and the associated email
threads on debian-vote
Sean Whitton
2024-08-01 13:50:01 UTC
Reply
Permalink
Yes, tag2upload. It’s almost ready :)

Please wait a little longer.
--
Sean Whitton

Please excuse top-posting and brevity. I am writing to you from a mobile phone.
Post by Charles Plessy
run a CI before uploading, even a very basic one is just fine, better
than nothing.
Thanks for the remider ! I will have a closer look at Salsa CI instead
of trying to understand how to run autopkgtests locally.
Would there be a way to get Salsa upload and tag the package if the CI
tests pass and the changelog signals a release? Or does somebody has a
script which can screen a Salsa group for ready uploads, and run clone
&& buildpackage && dput automatically ?
Cheers,
Charles
--
Charles Plessy Nagahama, Yomitan, Okinawa, Japan
Debian Med packaging team http://www.debian.org/devel/debian-med
Marco d'Itri
2024-08-01 13:30:02 UTC
Reply
Permalink
Post by Luca Boccassi
Emails are actually a barrier against collaboration, and actively
hinder it by preventing new people from joining in. Please understand
No, email is the only inclusive collaboration platform.
I can use email while traveling and when the least possible connectivity
is available.
Of course, if you are forced to use an inefficient webmail instead of
a real mail reader then your experience may be suboptimal.
Post by Luca Boccassi
To pick a random example, a less well known, less used, less popular
distribution like Nixos has 7000+ contributors listed on Github. It
And I highly doubt that they vet their contributors the same way that we
do.
--
ciao,
Marco
Marc Haber
2024-08-01 17:20:01 UTC
Reply
Permalink
Post by Luca Boccassi
The vast majority of people who
are forced to use emails do so for work via a
work-mediated/administered interface that tries to make it somewhat
tolerable, like Outlook or Gmail.
This must be the least accurate statement about Outlook that I have
ever read. Outlook does not have a single feature that makes email
more tolerable in any way. Au contraire. The feature called threading
is incompatible with the rest of the world and not even very useful in
an outlook-only environment, the search function finds everything but
the mail you're looking for, and Outlook's disability to quote
decently is notorious for having led to the whole world generating
only top-posting replies.

Outlook is essentially responsible for making email so much worse
today than it was in the 1990s.

Even Salsa's and github's praised way to communitate in an MR is
VASTLY inferior to a decently threading mail client like mutt or even
Thunderbird.

I violently disagree with the rest of the message as well and am not
willing to spoil the rest of my day by replying in detail. I'd prefer
learning a bit more Slowfoxtrot later tonight.

Best regards
Marc
--
----------------------------------------------------------------------------
Marc Haber | " Questions are the | Mailadresse im Header
Rhein-Neckar, DE | Beginning of Wisdom " |
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 6224 1600402
Luca Boccassi
2024-08-01 17:40:01 UTC
Reply
Permalink
Post by Marc Haber
Post by Luca Boccassi
The vast majority of people who
are forced to use emails do so for work via a
work-mediated/administered interface that tries to make it somewhat
tolerable, like Outlook or Gmail.
This must be the least accurate statement about Outlook that I have
ever read. Outlook does not have a single feature that makes email
more tolerable in any way. Au contraire. The feature called threading
is incompatible with the rest of the world and not even very useful in
an outlook-only environment, the search function finds everything but
the mail you're looking for, and Outlook's disability to quote
decently is notorious for having led to the whole world generating
only top-posting replies.
Outlook is essentially responsible for making email so much worse
today than it was in the 1990s.
Even Salsa's and github's praised way to communitate in an MR is
VASTLY inferior to a decently threading mail client like mutt or even
Thunderbird.
I violently disagree with the rest of the message as well and am not
willing to spoil the rest of my day by replying in detail. I'd prefer
learning a bit more Slowfoxtrot later tonight.
Again, please understand that outside of the bubble of tech nerds of
the 70s/80s, saying out loud phrases such as "The only right way to
collaborate is reading and writing emails is in my terminal" means
getting looked at like being a dinosaur just escaped from a museum.
The rest of the universe just doesn't work like that, sorry. There's
nothing wrong with being a dinosaur for an individual of course, we
will all become one at some point, but optimizing for making dinosaurs
happy from the simple perspective of demographics is a sure way for a
project to slowly slide into irrelevance. The fact that the project
membership has just about managed to remain flat while the tech sector
absolutely exploded in size should send shivers down everyone's
spines.
Marc Haber
2024-08-01 21:00:01 UTC
Reply
Permalink
Post by Luca Boccassi
Post by Marc Haber
Post by Luca Boccassi
The vast majority of people who
are forced to use emails do so for work via a
work-mediated/administered interface that tries to make it somewhat
tolerable, like Outlook or Gmail.
This must be the least accurate statement about Outlook that I have
ever read. Outlook does not have a single feature that makes email
more tolerable in any way. Au contraire. The feature called threading
is incompatible with the rest of the world and not even very useful in
an outlook-only environment, the search function finds everything but
the mail you're looking for, and Outlook's disability to quote
decently is notorious for having led to the whole world generating
only top-posting replies.
Outlook is essentially responsible for making email so much worse
today than it was in the 1990s.
Even Salsa's and github's praised way to communitate in an MR is
VASTLY inferior to a decently threading mail client like mutt or even
Thunderbird.
I violently disagree with the rest of the message as well and am not
willing to spoil the rest of my day by replying in detail. I'd prefer
learning a bit more Slowfoxtrot later tonight.
Again, please understand that outside of the bubble of tech nerds of
the 70s/80s, saying out loud phrases such as "The only right way to
collaborate is reading and writing emails is in my terminal" means
getting looked at like being a dinosaur just escaped from a museum.
The rest of the universe just doesn't work like that, sorry. There's
nothing wrong with being a dinosaur for an individual of course, we
will all become one at some point, but optimizing for making dinosaurs
happy from the simple perspective of demographics is a sure way for a
project to slowly slide into irrelevance. The fact that the project
membership has just about managed to remain flat while the tech sector
absolutely exploded in size should send shivers down everyone's
spines.
Now that you have added personal insult while not adding anything for
the cause, I recuse myself from continuing this situation. I am happy
that I don't need to collaborate with you in my Debian efforts.
--
----------------------------------------------------------------------------
Marc Haber | " Questions are the | Mailadresse im Header
Rhein-Neckar, DE | Beginning of Wisdom " |
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 6224 1600402
Luca Boccassi
2024-08-01 21:10:01 UTC
Reply
Permalink
Post by Marc Haber
Post by Luca Boccassi
Post by Marc Haber
Post by Luca Boccassi
The vast majority of people who
are forced to use emails do so for work via a
work-mediated/administered interface that tries to make it somewhat
tolerable, like Outlook or Gmail.
This must be the least accurate statement about Outlook that I have
ever read. Outlook does not have a single feature that makes email
more tolerable in any way. Au contraire. The feature called threading
is incompatible with the rest of the world and not even very useful in
an outlook-only environment, the search function finds everything but
the mail you're looking for, and Outlook's disability to quote
decently is notorious for having led to the whole world generating
only top-posting replies.
Outlook is essentially responsible for making email so much worse
today than it was in the 1990s.
Even Salsa's and github's praised way to communitate in an MR is
VASTLY inferior to a decently threading mail client like mutt or even
Thunderbird.
I violently disagree with the rest of the message as well and am not
willing to spoil the rest of my day by replying in detail. I'd prefer
learning a bit more Slowfoxtrot later tonight.
Again, please understand that outside of the bubble of tech nerds of
the 70s/80s, saying out loud phrases such as "The only right way to
collaborate is reading and writing emails is in my terminal" means
getting looked at like being a dinosaur just escaped from a museum.
The rest of the universe just doesn't work like that, sorry. There's
nothing wrong with being a dinosaur for an individual of course, we
will all become one at some point, but optimizing for making dinosaurs
happy from the simple perspective of demographics is a sure way for a
project to slowly slide into irrelevance. The fact that the project
membership has just about managed to remain flat while the tech sector
absolutely exploded in size should send shivers down everyone's
spines.
Now that you have added personal insult while not adding anything for
the cause, I recuse myself from continuing this situation. I am happy
that I don't need to collaborate with you in my Debian efforts.
What are you on about? What personal insult?
Salvo Tomaselli
2024-08-01 22:40:01 UTC
Reply
Permalink
Post by Luca Boccassi
saying out loud phrases such as "The only right way to
collaborate is reading and writing emails is in my terminal"
Please. This feels like trolling.

You're literally making up a quote and then you reply to it.

Nobody said that. This is not useful.

Also, there's IRC/matrix for more real time communication, but I challenge you
to follow those long threads on d-devel on something like teams or slack.

Best
--
Salvo Tomaselli

"Io non mi sento obbligato a credere che lo stesso Dio che ci ha dotato di
senso, ragione ed intelletto intendesse che noi ne facessimo a meno."
-- Galileo Galilei

https://ltworf.codeberg.page/
Jonas Smedegaard
2024-08-02 06:20:01 UTC
Reply
Permalink
Quoting Salvo Tomaselli (2024-08-02 00:38:15)
Post by Salvo Tomaselli
Post by Luca Boccassi
saying out loud phrases such as "The only right way to
collaborate is reading and writing emails is in my terminal"
Please. This feels like trolling.
You're literally making up a quote and then you reply to it.
Nobody said that. This is not useful.
Also, there's IRC/matrix for more real time communication, but I challenge you
to follow those long threads on d-devel on something like teams or slack.
Please, let's focus on the topic of this conversation:

Are conversations like this (modulo insults¹) not considered a part of
"true open collaboration", or are they reasonably and sensibly possible
to conduct through Gitlab notification/issue/code comment/MR comment
channels, instead of this "dinosaur¹ channel"
/whatever -
i.e. the communication channels part of the "true open collaboration"
on topic here, instead of the "dinosaur open collaboration" practiced
through this very mailinglist.

- Jonas

¹ If I understand you correctly, Luca, you do not consider the term
"dinosaur" an insult. I do find it insulting, but perhaps I simply
misunderstand and I should not translate it to "obsolete", but I don't
have the energy to even have a conversation about that so just dump my
refelctions in this footnote less inviting for further conversation.
In retrospect, I realize that my use of the term "old farts" might be
seen as an insult as well: I found it funny to use that because it
chimed with my references to "smelly" usage patterns, and I thought it
safe to use because I was myself included in the subset of Debian
members that I was referring to - if anyone found it insulting then I am
interested in (not debating, but) understanding that better: Please then
consider sharing why you found it insulting, perhaps through an
intermediary if (like me, se abov) you don't have (or want to waste) the
energy in facing me for providing me the criticism.
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Blair Noctis
2024-08-02 11:50:01 UTC
Reply
Permalink
Post by Salvo Tomaselli
Also, there's IRC/matrix for more real time communication, but I challenge you
to follow those long threads on d-devel on something like teams or slack.
Discourse. Or some other "forum" software. IMO online forums and mailing lists
are pretty similar in core functions (threaded conversations), they just differ
in UI.
--
Sdrager,
Blair Noctis
Jeremy Stanley
2024-08-01 17:30:02 UTC
Reply
Permalink
On 2024-08-01 12:23:43 +0100 (+0100), Luca Boccassi wrote:
[...]
Post by Luca Boccassi
To pick a random example, a less well known, less used, less
popular distribution like Nixos has 7000+ contributors listed on
Github.
[...]

Just to pick on this particular point, because I see this metric
used all the time by projects trying to inflate public impressions
of their size: you're aware that GitHub counts someone as a
"contributor" even if all the do is leave a comment on a bug report,
right? By that gauge, Debian is probably orders of magnitude larger.
--
Jeremy Stanley
Luca Boccassi
2024-08-01 21:20:01 UTC
Reply
Permalink
Post by Jeremy Stanley
[...]
Post by Luca Boccassi
To pick a random example, a less well known, less used, less
popular distribution like Nixos has 7000+ contributors listed on
Github.
[...]
Just to pick on this particular point, because I see this metric
used all the time by projects trying to inflate public impressions
of their size: you're aware that GitHub counts someone as a
"contributor" even if all the do is leave a comment on a bug report,
right? By that gauge, Debian is probably orders of magnitude larger.
I'm not, no, I thought it was committers/authors? But I haven't really
looked it up so you might very well be right. Where did you find that
defined?
Jeremy Stanley
2024-08-02 02:20:01 UTC
Reply
Permalink
Post by Luca Boccassi
Post by Jeremy Stanley
[...]
Post by Luca Boccassi
To pick a random example, a less well known, less used, less
popular distribution like Nixos has 7000+ contributors listed on
Github.
[...]
Just to pick on this particular point, because I see this metric
used all the time by projects trying to inflate public impressions
of their size: you're aware that GitHub counts someone as a
"contributor" even if all the do is leave a comment on a bug report,
right? By that gauge, Debian is probably orders of magnitude larger.
I'm not, no, I thought it was committers/authors? But I haven't really
looked it up so you might very well be right. Where did you find that
defined?
Okay, it looks like I was conflating what GitHub counts as a
"contribution" vs what kind of contribution makes someone a project
"contributor."

<URL: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/viewing-contributions-on-your-profile#what-counts-as-a-contribution>

It was contribution counts I was remembering being inflated, not
contributor counts. My apologies for the noise.
--
Jeremy Stanley
Salvo Tomaselli
2024-08-01 22:30:01 UTC
Reply
Permalink
Post by Jeremy Stanley
Just to pick on this particular point, because I see this metric
used all the time by projects trying to inflate public impressions
of their size: you're aware that GitHub counts someone as a
"contributor" even if all the do is leave a comment on a bug report,
right? By that gauge, Debian is probably orders of magnitude larger.
No, I just double checked. It counts the unique authors of commits.
--
Salvo Tomaselli

"Io non mi sento obbligato a credere che lo stesso Dio che ci ha dotato di
senso, ragione ed intelletto intendesse che noi ne facessimo a meno."
-- Galileo Galilei

https://ltworf.codeberg.page/
Salvo Tomaselli
2024-07-28 08:00:01 UTC
Reply
Permalink
Hello,

I see several problems with the proposal.

In general I think it seems to assume that there are way more contributors
than there are in reality.

Then it makes no effort to define communication channels. Before making some
time consuming change, it's usually better to just ask if that's a good idea
or not. Not doing so means that the person proposing the change will
inevitably have a bad feeling if it gets rejected. Which can be avoided by
communicating in advance.

It seems that the idea for packages that violate this is to open bug reports.
This would be very noisy and not very useful in my opinion, especially since
in several cases there would be no way to fix the bug.
anybody reading the source code can easily view everyindividual change and
to review when and how a specific line of code was changed, and reason about
why it was changed.
Then the document should enforce a particular commit style. I've seen several
people who do a bunch of unrelated changes in a single commit.

I've had a boss (who worked at amazon before) who was imposing to use a single
commit per ticket.
the package should at least be mirrored on Salsa for the sake of
facilitating collaboration
How would that facilitate collaboration, if whatever happens on the salsa
mirror is invisible to the real contributors on the real place where
development happens?
Run Salsa CI at least once before every upload to ensure minimal level of
quality
Can you tell me how to do a CI for python3-motor, given that it's a client for
a proprietary database?

Testing GUI packages, or fonts packages, or clients is generally very difficult
if not impossible. What's the plan in those cases?

I presume writing a "return true" CI is not what we are trying to do here.
While collaboration can happen based purely on developers submitting patch
files as email attachments directly to each other, to mailing lists or in bug
reports, it does not scale well.
It scales better than having to open salsa, find out the git:// url, add a new
remote in the local git, diff the patch locally, then of course I can't just
merge the patch locally because salsa doesn't know about that, so I have to go
again on salsa and click to merge.

All of this with salsa being not fast nor responsive by any definition of those
terms.
nor even that they must spend time doing code reviews
So it must be possible to send merge requests, but it's ok to completely
ignore all of them. This doesn't seem very ideal to me.
Allow changes to be reviewed before uploads to Debian
I guess this means that we should have some mandatory waiting time from the
last commit to the upload. How long would this time be? Would it apply even if
we're talking about fixing a libc upload that will break any system where it
gets installed?

Best
--
Salvo Tomaselli

"Io non mi sento obbligato a credere che lo stesso Dio che ci ha dotato di
senso, ragione ed intelletto intendesse che noi ne facessimo a meno."
-- Galileo Galilei

https://ltworf.codeberg.page/
Otto Kekäläinen
2024-08-01 06:20:01 UTC
Reply
Permalink
Hi!
Post by Salvo Tomaselli
Then it makes no effort to define communication channels. Before making some
time consuming change, it's usually better to just ask if that's a good idea
..
Post by Salvo Tomaselli
Then the document should enforce a particular commit style. I've seen several
people who do a bunch of unrelated changes in a single commit.
The idea in DEP-18 is to define a few key principles that enable collaboration.

There is no need to publish recommendations on communicating channels
or git commit message styles. We have maintainer guides, team-specific
guides and a lot of other documentation for that kind of stuff. Also,
for a DEP to recommend something it should already be popular and
widely supported by maintainers, hence the five principles it now has.
Post by Salvo Tomaselli
Run Salsa CI at least once before every upload to ensure minimal level of
quality
Can you tell me how to do a CI for python3-motor, given that it's a client for
a proprietary database?
Testing GUI packages, or fonts packages, or clients is generally very difficult
if not impossible. What's the plan in those cases?
Salsa CI mimics what the official Debian QA systems do. You don't need
to write tests specific for Salsa CI. In the case of python3-motor,
just improve on the autopkgtests it has, and both Salsa CI and Debian
CI will run them. Salsa CI just brings the benefit that you can more
easily catch regressions in packaging or new upstream versions
_before_ uploading to Debian, thus protecting the quality of the
packages in official repositories.
Post by Salvo Tomaselli
While collaboration can happen based purely on developers submitting patch
files as email attachments directly to each other, to mailing lists or in bug
reports, it does not scale well.
It scales better than having to open salsa, find out the git:// url, add a new
remote in the local git, diff the patch locally, then of course I can't just
merge the patch locally because salsa doesn't know about that, so I have to go
again on salsa and click to merge.
You can find the git url in the package debian/control Vcs-* fields.
No matter what way you do a patch, you need to download the sources in
some way. Doing a git clone isn't really extra work. I am not sure I
followed your description, but if you merge something locally and push
to Salsa, it will automatically detect that a commit in a Merge
Request landed on the target branch and mark the Merge Request merged
on git push.
Post by Salvo Tomaselli
All of this with salsa being not fast nor responsive by any definition of those
terms.
I agree that Salsa is sometimes a bit sluggish
(https://salsa.debian.org/salsa/support/-/issues/395), but I hope we
can do something to improve it and it is now a permanent reason to not
use Salsa.
Post by Salvo Tomaselli
Allow changes to be reviewed before uploads to Debian
I guess this means that we should have some mandatory waiting time from the
last commit to the upload. How long would this time be? Would it apply even if
we're talking about fixing a libc upload that will break any system where it
gets installed?
I will try to reword "5. Allow changes to be reviewed before uploads
to Debian" to be explicit about not prescribing anything too specific.
It is up to each team and maintainer to decide what and when to ask
for reviews. The main point in DEP-18 is that when you use
salsa.debian.org, the code is published as source first, tested with
Salsa CI and potentially reviewed instead of just being uploaded
directly without any room for collaboration.


- Otto
Otto Kekäläinen
2024-08-13 15:10:01 UTC
Reply
Permalink
Hi!

In the DEP-18 thread surprisingly many (e.g. Salvo, Johannes, Andrea,
Gioele) complained about Salsa being slow to load, or having
connectivity issues.

I am thus happy to note that the Salsa admins posted in
https://salsa.debian.org/salsa/support/-/issues/395 a comment stating
that salsa.debian.org is about to get a hardware update which should
make it a tad snappier.

Salsa recently gained a shared riscv64 runner so you can now test a
new architecture in Salsa-CI, and based on
https://salsa.debian.org/salsa/support/-/issues/266 and
https://salsa.debian.org/salsa/support/-/issues/301 more shared
runners on various architectures might be coming.

Salvo and others also pointed out that "git push" occasionally failed.
According to https://salsa.debian.org/salsa/support/-/issues/381 that
issue should be fixed by now. I also remember seeing this earlier, but
I have not experienced it a single time in at least two weeks.

One remaining thing that affects negatively salsa.debian.org are
occasional HTTP/2 errors. If you also experience these, you might want
to +1 the issue https://salsa.debian.org/salsa/support/-/issues/404 or
help the Salsa admins debug it.


As you probably guessed, I am a heavy user of Salsa, and very grateful
to Salsa admin for maintaining it!

- Otto
Johannes Schauer Marin Rodrigues
2024-08-01 09:40:01 UTC
Reply
Permalink
Hi Otto,

Quoting Otto KekÀlÀinen (2024-07-28 00:38:40)
Post by Otto Kekäläinen
I have drafted a new DEP at
Enable true open collaboration on all Debian packages".
https://salsa.debian.org/dep-team/deps/-/raw/798bfa5a1e1609afd4e48ee20aff80a82bcd4a2f/web/deps/dep18.mdwn
This would have been a great topic to discuss in person at DebConf, but
unfortunately I can't attend this year, so I'll just kick this off on the
mailing list.
thank you for working on this.
Post by Otto Kekäläinen
This is continuation to the 'single maintainership' discussions earlier this
year. I also think that more unified and open collaboration processes could
help decrease maintainer burnout, lower barrier for existing and new
maintainers to help with multiple packages, and overall perhaps also improve
quality of uploads by having more attention on the source code prior to
upload.
A slightly related topic: what is everybody's opinion on maybe starting with
some of the basic items of DEP-18, lets say items 1-3, and prescribe them to
only a very small set of packages in Debian. And which set of packages in
Debian should *especially* have easy open collaboration enabled if not the set
of source packages producing our Essential:yes packages? So why not start with
the source packages in the Essential:yes set, have them adhere to better
collaboration standards like packaging in git on salsa and with salsa CI
enabled?

I am aware that this might just be a pipe dream because at least in my personal
experience I observed very strong package ownership especially for packages in
the essential set. But I think it is the set of Essential:yes packages which
should set an example of how collaborative maintenance in Debian is supposed to
work because in contrast to other packages, the Essential:yes set is relevant
to literally all of us. Bugs in those packages affect us all, so we all should
have an easier time to collaborate on them, right?

Bugs like #1021336 had to be closed *twice* because of issues that would've
been caught by the salsa CI pipeline. It doesn't help that a MR enabling salsa
CI for that package is waiting to be acted upon by its maintainers since
October 2022. It is literally essential (pun intended) to all our work that
packages in the essential set do not accidentally break. The chance of this
happening can be greatly reduced by requiring a passing salsa ci pipeline with
successful autopkgtest, piuparts and lintian. What am I missing?

To those who refuse to work with salsa CI because it is slow (yes it is, I know
because my processor is probably 10 times slower than yours) I can warmly
recommend the glab utility from the package of the same name. My Debian
workflow has now these two commands added after I "git push" my work:

- glab ci status --live
- glab ci trace

The former will let me follow the pipeline for my last commit as it is running
without having to open it in my browser (which is painfully slow). The latter
will let me look at the stdout and stderr of the job of my choice (usually the
failing one) without some javascript deciding that it will remove the whole
text from my screen with the error message "An error occurred while fetching
the job."
Post by Otto Kekäläinen
If you think this proposal makes sense, please press the thumbs up button.
If you have comments, please share them here or on the draft itself.
I think I like all items you brought up except for item 5. At least in the part
of Debian where I am active, I find it very hard to find anybody reviewing my
stuff, probably because everybody else is already overworked themselves. So I
think it's nice but I do not see us having very much volunteer time to really
have this work in practice. But maybe there are teams for which this really
works well? In any case, nothing I'd like you to remove but maybe it's too much
of a dream? :)

Thanks!

cheers, josch
Luca Boccassi
2024-08-01 10:40:01 UTC
Reply
Permalink
On Thu, 1 Aug 2024 at 10:36, Johannes Schauer Marin Rodrigues
Post by Jonas Smedegaard
Hi Otto,
Quoting Otto Kekäläinen (2024-07-28 00:38:40)
Post by Otto Kekäläinen
I have drafted a new DEP at
Enable true open collaboration on all Debian packages".
https://salsa.debian.org/dep-team/deps/-/raw/798bfa5a1e1609afd4e48ee20aff80a82bcd4a2f/web/deps/dep18.mdwn
This would have been a great topic to discuss in person at DebConf, but
unfortunately I can't attend this year, so I'll just kick this off on the
mailing list.
thank you for working on this.
Post by Otto Kekäläinen
This is continuation to the 'single maintainership' discussions earlier this
year. I also think that more unified and open collaboration processes could
help decrease maintainer burnout, lower barrier for existing and new
maintainers to help with multiple packages, and overall perhaps also improve
quality of uploads by having more attention on the source code prior to
upload.
A slightly related topic: what is everybody's opinion on maybe starting with
some of the basic items of DEP-18, lets say items 1-3, and prescribe them to
only a very small set of packages in Debian. And which set of packages in
Debian should *especially* have easy open collaboration enabled if not the set
of source packages producing our Essential:yes packages? So why not start with
the source packages in the Essential:yes set, have them adhere to better
collaboration standards like packaging in git on salsa and with salsa CI
enabled?
This is a great idea, as it would provide a real testing ground while
having a clearly delineated and well defined scope, and with the
greatest potential return of investment.
Andrea Pappacoda
2024-08-02 09:30:01 UTC
Reply
Permalink
Hi Otto, and all the others participating in this thread :)

Il giorno sab 27 lug 2024 alle 15:38:40 -07:00:00, Otto Kekäläinen
Post by Otto Kekäläinen
I have drafted a new DEP at
https://salsa.debian.org/dep-team/deps/-/merge_requests/8 titled
"DEP-18: Enable true open collaboration on all Debian packages".
Thanks for your work on this. Trying to unify aspects of Debian
development is one of the things I think we need to do to not only
"enable true open collaboration", but also to attract more new
contributors.

While the proposal has good intentions and goals I agree with, it tries
to achieve it with tools which, to my eyes, don't really enable "true"
open collaboration, which Jonas has expressed really well already.

The issue to me is when you add the word "Salsa", or more precisely
"GitLab" to the mix. Don't get me wrong: these days development *has*
to be done with Git and with CI workflows, but having to use GitLab
just to have these two things is overkill.

Before a certain way of doing things can be mandated or "warmly
recommended", the technology has to be as flawless as possible - and
today I wouldn't call Salsa "flawless", would you? Issues with
Salsa/GitLab:

1. It is so slow that it makes me want to close by browser and do
something else instead
2. It doesn't support email-based workflows
3. It has a lot of features we don't need. Or rather, it has more
features we *don't* need than we do.
4. Its user interface is confusing, it's often hard to find what I'm
looking for
5. Did I mention how slow it is?
6. It is developed by a company who's philosophy and interests are
misaligned with Debian's
7. The product it tries to mimic, GitHub, is also misaligned with
Debian's philosophy and interests

While performance is something we could reasonably do something about,
all the other points are part of GitLab by design, and we're stuck with
them.

It has also been mentioned that email-based workflows are for
"dinosaurs". Well, I'm 21, so I'm a living example that that's not
necessarily true :)

But the point isn't that much about being able to use emails
specifically, it is about having the possibility of having a software
forge which is interoperable with a wide range of tools and can stay
out of the way if wanted. With GitLab, you either use the full package
(which includes browsing, reviewing, and commenting) or you get a
sub-optimal experience. But it doesn't have to be this way.

I'll now talk a bit about SourceHut. Not to suggest that we should use
that instead, but just to point out how things *can* be done.

1. It is really lightweight
2. It places emphasis on email-based workflows, while also providing a
web interface which can be used to view and interact with email
submissions.
3. It is modular. If you don't want the mailing list manager or the
issue tracker you can simply not install them.
4. The web interface exposes few things, maybe even too little
5. Yes, it's fast
6. Its developers truly value software freedom, just like Debian does
7. It tries to offer an independent product, without following GitHub's
lead

Since I'm lucky enough to still go to university, I conducted some
small scale experiment with a handful of students which were new to
software development. For their first Git group project, I let them use
SourceHut instead of GitHub, to see how accessible SourceHut was to new
users. They've been able to use it without issues, and I was happy.
Some time after this, they also had the opportunity of using GitHub,
which is not a surprise given its dominant position. The interesting
part though is that these students, when starting a new personal
project, chose to use SourceHut even if they also knew GitHub. They
found it more usable!

In conclusion, I think we should aim at providing a set of tools which
provides a "normalized view/workflow" which anyone can use, while also
giving the possibility to individuals to use their own preferred
personal workflow for their own work. GitLab provides this normalized
workflow, but by making it the only viable option. Just like how dgit
provides a canonical "dgit view" while letting maintainers user their
own packaging workflow, an ideal Debian code forge would provide, for
example, a canonical web UI which can also be interacted with by
email/command line, just like the rest of Debian's infrastructure.

I would've liked to provide concrete solutions, but for now I'll limit
myself at exposing problems :)

Bye!
Gioele Barabucci
2024-08-02 11:50:01 UTC
Reply
Permalink
Post by Andrea Pappacoda
1. It is so slow that it makes me want to close by browser and do
something else instead
[...]
5. Did I mention how slow it is?
Just as a side note: yes, salsa.d.o/GitLab is not the snappiest Web
application ever and sometimes it takes seconds for a page to appear,
but we are talking about Debian here, where bug reports are acknowledged
by debbugs minutes after being filed, uploaded packages are dinstalled
once every 6 hours, official CI builds take days to complete, patches
are merged months after being submitted.

BTW, the `glab` command-line program is a nice(r) and faster alternative
to the Web interface for interacting with salsa.d.o.

Regards,

--
Gioele Barabucci
Fabio Fantoni
2024-08-02 12:40:02 UTC
Reply
Permalink
Post by Andrea Pappacoda
Hi Otto, and all the others participating in this thread :)
Il giorno sab 27 lug 2024 alle 15:38:40 -07:00:00, Otto KekÀlÀinen
Post by Otto Kekäläinen
I have drafted a new DEP at
https://salsa.debian.org/dep-team/deps/-/merge_requests/8 titled
"DEP-18: Enable true open collaboration on all Debian packages".
Thanks for your work on this. Trying to unify aspects of Debian
development is one of the things I think we need to do to not only
"enable true open collaboration", but also to attract more new
contributors.
While the proposal has good intentions and goals I agree with, it
tries to achieve it with tools which, to my eyes, don't really enable
"true" open collaboration, which Jonas has expressed really well already.
The issue to me is when you add the word "Salsa", or more precisely
"GitLab" to the mix. Don't get me wrong: these days development *has*
to be done with Git and with CI workflows, but having to use GitLab
just to have these two things is overkill.
Having the packaging on git i think is very useful, whether it is on
salsa or another system it would bring benefits to some packages not
currently on git. Not to force to use it but at least recommend it (and
then later reconsider whether to force it)

One particular thing noticed in some cases (and I hope they are not
many) is the lack of use or especially updates of the Vcs-* fields in
d/control. I think is important point to packaging repository from the
tracker if present and to update it if moved, this can help
collaboration and reduce possible waste of time doing things that are
perhaps already done by others (or WIP) but which have not yet been
uploaded.
Post by Andrea Pappacoda
Before a certain way of doing things can be mandated or "warmly
recommended", the technology has to be as flawless as possible - and
today I wouldn't call Salsa "flawless", would you? Issues with
1. It is so slow that it makes me want to close by browser and do
something else instead
2. It doesn't support email-based workflows
3. It has a lot of features we don't need. Or rather, it has more
features we *don't* need than we do.
4. Its user interface is confusing, it's often hard to find what I'm
looking for
5. Did I mention how slow it is?
6. It is developed by a company who's philosophy and interests are
misaligned with Debian's
7. The product it tries to mimic, GitHub, is also misaligned with
Debian's philosophy and interests
While performance is something we could reasonably do something about,
all the other points are part of GitLab by design, and we're stuck
with them.
It has also been mentioned that email-based workflows are for
"dinosaurs". Well, I'm 21, so I'm a living example that that's not
necessarily true :)
I think that both email and systems like salsa/github/gitlab etc. are
useful, both with pros and cons. Forcing people to use only one or the
other could be counterproductive at the moment. One thing that I think
would be useful is to have certain, fast and simple information for each
package about which actual collaboration methods it uses and prefers.

For example seeing a package it would be very useful to know immediately
if it wants a collaboration only through bugtracker and patch, only
through vcs or both are accepted. If managed in a team point more easily
to information about the team and any pages with details (for example on
wiki).

I mainly use salsa, it has many advantages and could bring improvements
in many cases but as mentioned there are also disadvantages (partly
subjective) and therefore forcing it I don't think is a good thing,
rather recommending it instead.

But first of all I think it is essential to improve salsa performance
and reduce downtime and problems. Over the last few years I have found
myself too many times in cases where I could work on packages but salsa
was not working or very slow, and many cases where I needed salsa-ci for
quick checks but it had problems. This is discouraging for contributors
and counterproductive (especially for those with little time available).
Recently I think there has been some improvement compared to past
periods when it was worse both with salsa speed/reachability and
salsa-ci problems (which lasted longer), big thanks to all those who
work on it to improve it and I hope it will improve further in the future.

Another thing that seems underestimated and I think it is good to
emphasize is the excessive slowness of the wiki.debian.org, it seems
much worse than salsa to me, and I think it's important to solve. There
is a lot of useful (or in some cases essential) information on the wiki
for developers (and also for users), and finding yourself too often when
you need to read something there (or contribute to some page) that
doesn't load or takes a very long time is counterproductive.

Trying to help new contributors by pointing them in many cases to
information on the wiki and being told it doesn't load or is very slow
is not good. And also for contributors who search for information by
themselves and arrive at pages that they can't read at that moment or
that take a long time is a risk to the growth of contributors and
collaborations in Debian.

If someone thinks that these speed/reachabilityare not important because
they are used to even longer times for many operations, for example
regarding the bugtracker, tracker, upload etc., unfortunately we live in
an increasingly frenetic and continuously worsening world (this world
causes more and more stress and less and less time available).

And also another problem that I think is very relevant but
underestimated,even if in general nowadaystalk a lot about simplifying
and speeding up through technology I unfortunately in practicesee much
more often that things gets complicated and with additions that are more
of a burden than an advantage.

I therefore hope that any additions/modifications/obligations are
evaluated well and in the most objective way possible. I think that
participation in projects like Debian (and other open source projects)
should be a satisfaction and a pleasure for those who participate and
not an additional stress, this would bring greater results and benefits.
Post by Andrea Pappacoda
But the point isn't that much about being able to use emails
specifically, it is about having the possibility of having a software
forge which is interoperable with a wide range of tools and can stay
out of the way if wanted. With GitLab, you either use the full package
(which includes browsing, reviewing, and commenting) or you get a
sub-optimal experience. But it doesn't have to be this way.
I'll now talk a bit about SourceHut. Not to suggest that we should use
that instead, but just to point out how things *can* be done.
1. It is really lightweight
2. It places emphasis on email-based workflows, while also providing a
web interface which can be used to view and interact with email
submissions.
3. It is modular. If you don't want the mailing list manager or the
issue tracker you can simply not install them.
4. The web interface exposes few things, maybe even too little
5. Yes, it's fast
6. Its developers truly value software freedom, just like Debian does
7. It tries to offer an independent product, without following
GitHub's lead
Since I'm lucky enough to still go to university, I conducted some
small scale experiment with a handful of students which were new to
software development. For their first Git group project, I let them
use SourceHut instead of GitHub, to see how accessible SourceHut was
to new users. They've been able to use it without issues, and I was
happy. Some time after this, they also had the opportunity of using
GitHub, which is not a surprise given its dominant position. The
interesting part though is that these students, when starting a new
personal project, chose to use SourceHut even if they also knew
GitHub. They found it more usable!
In conclusion, I think we should aim at providing a set of tools which
provides a "normalized view/workflow" which anyone can use, while also
giving the possibility to individuals to use their own preferred
personal workflow for their own work. GitLab provides this normalized
workflow, but by making it the only viable option. Just like how dgit
provides a canonical "dgit view" while letting maintainers user their
own packaging workflow, an ideal Debian code forge would provide, for
example, a canonical web UI which can also be interacted with by
email/command line, just like the rest of Debian's infrastructure.
I would've liked to provide concrete solutions, but for now I'll limit
myself at exposing problems :)
Bye!
Jonas Smedegaard
2024-08-02 14:00:01 UTC
Reply
Permalink
Hi Fabio,

Quoting Fabio Fantoni (2024-08-02 14:31:04)
Post by Fabio Fantoni
One particular thing noticed in some cases (and I hope they are not
many) is the lack of use or especially updates of the Vcs-* fields in
d/control. I think is important point to packaging repository from the
tracker if present and to update it if moved, this can help
collaboration and reduce possible waste of time doing things that are
perhaps already done by others (or WIP) but which have not yet been
uploaded.
That's tracked as OLD key at https://qa.debian.org/cgi-bin/vcswatch -
also included in the Maintainer Dashboard for each package at
https://udd.debian.org/dmd.cgi

Whenever you stumble upon a package misaligned with its declared Vcs
metadata, please file a bugreport, and while doing so consider
encouraging the maintainer to use the Maintainer Dashboard.
Post by Fabio Fantoni
I think that both email and systems like salsa/github/gitlab etc. are
useful, both with pros and cons. Forcing people to use only one or the
other could be counterproductive at the moment. One thing that I think
would be useful is to have certain, fast and simple information for each
package about which actual collaboration methods it uses and prefers.
For example seeing a package it would be very useful to know immediately
if it wants a collaboration only through bugtracker and patch, only
through vcs or both are accepted. If managed in a team point more easily
to information about the team and any pages with details (for example on
wiki).
I guess that you mean something like this:
```patch
--- a/debian/control
+++ b/debian/control
@@ -60,6 +60,7 @@ Standards-Version: 4.7.0
Homepage: https://github.com/oxigraph/oxigraph
Vcs-Git: https://salsa.debian.org/debian/oxigraph.git
Vcs-Browser: https://salsa.debian.org/debian/oxigraph
+Contact: https://bugs.debian.org/oxigraph
Rules-Requires-Root: no

Package: oxigraph
```

In principle I find that an interesting suggestion, as I can imagine
such information being helpful in understanding if debbugs is used only
by "dinosaurs".

I see two problems, however:

a) Maintainers will be bothered to add that new field to every package
(or at least a substantial subset) for it to be of practical use.

b) Which other answers exist for that field? I mean, is it ok in Debian
for a maintainer to not use Debbugs? Is it ok in Debian for a
maintainer to also use another issue tracker and not replicate whatever
is collected elsewhere in Debbugs?

Or perhaps I am missing the point of your suggestion, and you do not
mean where *bug* chatter goes, but instead where *non-bug* conversations
go. If that is the case, then I believe we have a field already for
that, called "Maintainer:". If you mean neither issue tracking nor the
main contact information for a package, then please elaborate what you
had in mind, because that's pretty essential to get clarified before
discussing any further...
Post by Fabio Fantoni
Another thing that seems underestimated and I think it is good to
emphasize is the excessive slowness of the wiki.debian.org, it seems
much worse than salsa to me, and I think it's important to solve.
I don't think that the speed of wiki affects the use of Salsa.

Please stick to the topic - i.e. if you want to shift to another topic
then do so explicitly by changing the Subject: line in your email post.
Post by Fabio Fantoni
If someone thinks that these speed/reachabilityare not important because
they are used to even longer times for many operations, for example
regarding the bugtracker, tracker, upload etc., unfortunately we live in
an increasingly frenetic and continuously worsening world (this world
causes more and more stress and less and less time available).
If you mean psychological stress, then I find your reasoning flawed, as
that is about a *perceived* lack of time (or other pressure), not
necessarily actual lack of it. Possibly but not necessarily.

If you mean stress on the Earth, then I find it highly unlikely that we
can solve that crisis by speeding things up. Instead we need to find
ways to *reduce* the *amount* of computing we do, and find ways to time
that computing in ways that fit more optimally with the availability of
needed resources (e.g. consume less electricity when there is less wind
and sunny, to reduce stress on green parts of related electricity grid).

Please elaborate what kind of stress you are really talking about, and
again please consider the topic of the conversation (see above about
changing Subject: line).

Thanks for your inspiring input,

- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Fabio Fantoni
2024-08-02 22:00:01 UTC
Reply
Permalink
Post by Jonas Smedegaard
Hi Fabio,
Quoting Fabio Fantoni (2024-08-02 14:31:04)
Post by Fabio Fantoni
One particular thing noticed in some cases (and I hope they are not
many) is the lack of use or especially updates of the Vcs-* fields in
d/control. I think is important point to packaging repository from the
tracker if present and to update it if moved, this can help
collaboration and reduce possible waste of time doing things that are
perhaps already done by others (or WIP) but which have not yet been
uploaded.
That's tracked as OLD key at https://qa.debian.org/cgi-bin/vcswatch -
also included in the Maintainer Dashboard for each package at
https://udd.debian.org/dmd.cgi
Whenever you stumble upon a package misaligned with its declared Vcs
metadata, please file a bugreport, and while doing so consider
encouraging the maintainer to use the Maintainer Dashboard.
Thanks for your reply, I know about there and is useful for found vcs
not working but vcs working/reachable but no longer used, in favor of
something else they are not identifiable.

The system is only able to notify partially for those not updated but it
is not possible to identify if you are working on another repository it
is not identifiable but it will be only if the vcs field will be
manually changed, so it is up to the maintainer to change it, in
addition there is a slight problem that it changes only with a new
upload, if a lot of time were to pass and a lot of work was done during
it would not be possible to notice immediately. In some cases you could
move the repository or notify the move inside but unfortunately in the
case of repositories on which you do not have permissions (for example
in abandoned packages and someone is about to adopt or recover them).
They seem quite rare but unfortunately they happen. Even if it was
recommended to keep them updated and if it changed update them
immediately doing a new upload just for that doesn't seem like the best
to me, could it be useful to have another way, or is there already one?
anyway this is just a minor thing and even if it were to improve it
would have little influence compared to what I suppose is what has the
most influence
Post by Jonas Smedegaard
Post by Fabio Fantoni
I think that both email and systems like salsa/github/gitlab etc. are
useful, both with pros and cons. Forcing people to use only one or the
other could be counterproductive at the moment. One thing that I think
would be useful is to have certain, fast and simple information for each
package about which actual collaboration methods it uses and prefers.
For example seeing a package it would be very useful to know immediately
if it wants a collaboration only through bugtracker and patch, only
through vcs or both are accepted. If managed in a team point more easily
to information about the team and any pages with details (for example on
wiki).
```patch
--- a/debian/control
+++ b/debian/control
@@ -60,6 +60,7 @@ Standards-Version: 4.7.0
Homepage: https://github.com/oxigraph/oxigraph
Vcs-Git: https://salsa.debian.org/debian/oxigraph.git
Vcs-Browser: https://salsa.debian.org/debian/oxigraph
+Contact: https://bugs.debian.org/oxigraph
Rules-Requires-Root: no
Package: oxigraph
```
In principle I find that an interesting suggestion, as I can imagine
such information being helpful in understanding if debbugs is used only
by "dinosaurs".
a) Maintainers will be bothered to add that new field to every package
(or at least a substantial subset) for it to be of practical use.
b) Which other answers exist for that field? I mean, is it ok in Debian
for a maintainer to not use Debbugs? Is it ok in Debian for a
maintainer to also use another issue tracker and not replicate whatever
is collected elsewhere in Debbugs?
Or perhaps I am missing the point of your suggestion, and you do not
mean where *bug* chatter goes, but instead where *non-bug* conversations
go. If that is the case, then I believe we have a field already for
that, called "Maintainer:". If you mean neither issue tracking nor the
main contact information for a package, then please elaborate what you
had in mind, because that's pretty essential to get clarified before
discussing any further...
contact field don't exist now right? even if the contact field maybe
doesn't give you an idea, maybe something like "contributing" that links
to the bugtracker, to the repository MR/PR or a wiki page or site with
any details (especially in case of a group)

how to do it on a technical level, inside debian/control or in another
way if it was better I don't think it would be a problem, to not disturb
the maintainers too much if you add something you can only put it
recommended and not mandatory.

maybe I'm not good at explaining myself, I think the problem is that if
a contributor, maybe even new or who wants to make even occasional
contributions on specific packages is not able to find in a simple and
fast way about the package on which he wants to contribute as he should
(or is better to do), in some cases you can understand in short time by
looking a bit at the bugtracker and the vcs while, looking for any wiki
pages if he is part of a team but in many cases it is not simple/fast to
understand how he should contribute for that package in order to get the
best result. using patches on bugtracker or vcs (like salsa) is just one
part, then there could be more

you could say to force everyone to use the same system, in theory it
would solve the problem, but in practice I find it difficult and perhaps
more harmful. I try to summarize: the contributors are people and not
machines, moreover many do it as a passion in a little free time and not
as if it were a job.
Post by Jonas Smedegaard
Post by Fabio Fantoni
Another thing that seems underestimated and I think it is good to
emphasize is the excessive slowness of the wiki.debian.org, it seems
much worse than salsa to me, and I think it's important to solve.
I don't think that the speed of wiki affects the use of Salsa.
Please stick to the topic - i.e. if you want to shift to another topic
then do so explicitly by changing the Subject: line in your email post.
I think it is part of the main problem that is being discussed, not only
should we try to increase collaboration but I think it is useful, or
perhaps even more relevant, analyze carefully what the ways can help to
increase the contributions.

Increasing collaboration may indeed lead to improvement but increasing
contributions and contributors could in practice lead to even greater
overall results.

creating a single recommended method or collaborative forced more bring
could bring more contributions in different but there is also the risk
that they decrease in parte for unfavorable or struggling contributors
with any new obligations (this is why I think it is better to suggest or
recommend rather than force in some delicate parts such as those being
discussed here)

I would say to also think in terms of number of contributors and number
of contributions.

as for new contributors it is important to find the information needed
to learn and especially for those who want to try even just with
something small and targeted to succeed, the time spent is also relevant.

both general information about the packaging, and specifics of some less
common parts, and specifics regarding the development of the individual
packages (and the eventual team)

I think finding information quickly and easily is quite important, being
able to make the first contributions quickly enough and without
technical obstacles (from errors, temporary unattainability, frequent
minor slowdowns and occasional major ones) I think has a great influence
on the possible arrival of new contributors or even just occasional
contributions on single packages and I think more than the method used

for example if I was a new contributor or occasional contributor and I
tried to contribute and I found myself having problems on the wiki,
salsa or even packages.debian.org (as happened a few days ago) I would
90% give up

while the possible improvement of the collaboration method proposed here
I suppose could only influence between 10-30% more possible
contributions, but focusing all or mainly on salsa without having less
problems and slowdowns on it I think would increase the risk more rather
than any patches on the bugtracker via email which has little effect on
the fact even if it takes minutes to process the emails.

To sum up, I suppose that such things entail a high risk of losing
possible new contributors and/or contributions (even occasional ones), a
medium risk for occasional contributions from those who have already
contributed previously and a risk also of decreasing contributions from
those who contribute normally.

if you want even just a practical piece of data on some cases in which
the slowness, unattainability and problems of salsa, salsa-ci, wiki and
in some cases other parts have influenced my contributions:

there have been a few dozen times when I had some time and desire to
contribute but due to problems with salsa I gave up as soon as I started
for that day, others (also dozens) when I had started but then within a
maximum of half an hour or an hour with problems I stopped (there is
already work that stresses me, I don't want to try to contribute on open
source projects, in this case Debian is the same)

there have been cases in which I continued and did it even if it took
more time, with the same amount of time I could have done more without
any problems, but I don't know how to quantify it

there have also been cases where I wanted to make occasional
contributions to help packages that I use but do not maintain because I
have seen them with RC bugs, not updated for a long time or some rare
case for other problems but I have been discouraged by the difficulty
and the time required (even though many were small things). in these
cases you might think that the main problem was the difficulty of
collaboration of that package, to a large extent yes but less than you
might think, having all the projects on salsa and preferably in a team
would have helped in several of these cases but not many (right now I do
not have enough memories to give a possible quantity)

another thing that I think is a perhaps underestimated obstacle for new
contributors, and contributions. DD that help those trying to contribute
on mentors, possibly also DM to give advice, information, start
reviewing, at least someone I saw recently tried to give some visibility
to this problem here. you could advise new contributors about git, salsa
contribution methods, direct them to a team, if the package they want to
add could be in a team (these things for example are related to what you
would like to do in DEP-18). but then much more useful in practice is if
contributors find help, answers and if they manage to make good
contributions get accepted (preferably in a not too long time).

getting back to salsa here's a tip that I think would be a great help in
understanding how to proceed with DEP-18: make quick polls open to all
DDs, DMs and possibly other occasional contributors (mostly multiple
choice). to be able to know how good salsa is considered, how useful
they consider its use, what the main problems are (here I recommend
something specific at least to know how much they impact performance and
service issues in practice)

another practical thing prerequisite of DEP-18, it talks about a massive
use of salsa-ci, but are there resources to make it possible, and that
it works well? some possible limitations seem to be explained here
already:
https://salsa.debian.org/dep-team/deps/-/merge_requests/8#note_511732
but even if it became only recommended, as I also think it is very
useful for most packages (It helped me a lot to avoid some mistake and
improve the quality of the packages in less time, at least when it works
properly and in a fairly short time), it would have a significant weight
on the hardware level. furthermore, excessively long times due only or
almost only to overloads or failures not due to the package would weigh
negatively on the maintainers and if it were forced it would be a
negative weight I think greater than forcing the use of salsa

another thing i wonder are there any plans for improvement, someone know
what is needed? This is for both salsa-ci and salsa and wiki. would you
say if there is a need and how to contribute? I can't find anything
specific and the generic page on how to contribute
(https://www.debian.org/donations) seems a bit vague and lacking in
information, or I'm wrong?
Post by Jonas Smedegaard
Post by Fabio Fantoni
If someone thinks that these speed/reachabilityare not important because
they are used to even longer times for many operations, for example
regarding the bugtracker, tracker, upload etc., unfortunately we live in
an increasingly frenetic and continuously worsening world (this world
causes more and more stress and less and less time available).
If you mean psychological stress, then I find your reasoning flawed, as
that is about a *perceived* lack of time (or other pressure), not
necessarily actual lack of it. Possibly but not necessarily.
If you mean stress on the Earth, then I find it highly unlikely that we
can solve that crisis by speeding things up. Instead we need to find
ways to *reduce* the *amount* of computing we do, and find ways to time
that computing in ways that fit more optimally with the availability of
needed resources (e.g. consume less electricity when there is less wind
and sunny, to reduce stress on green parts of related electricity grid).
Please elaborate what kind of stress you are really talking about, and
again please consider the topic of the conversation (see above about
changing Subject: line).
this is complicated to explain, I'm not good at explaining nor in english^^'

staying on the subject of DEP-18 I think it could be relevant on stress
based on if/how it will be done and applied and what I wanted to bring
attention to is not to consider only the possible benefits on the
quality of the packages that it could bring but also the cost that it
could have on the people who contribute and try to be balanced

it is unfortunately common to think of profit at the expense of people,
in the case of Debian it would not be for profit but the impact on
contributions can be significant.

the ideal thing would be that it increases the quality and also makes it
more efficient and less stressful to contribute but I fear that this is
utopian and it is much more likely that there will be fewer results than
hoped for and a higher cost (on the people who contribute)
Post by Jonas Smedegaard
Thanks for your inspiring input,
- Jonas
Jonas Smedegaard
2024-08-02 23:30:02 UTC
Reply
Permalink
Quoting Fabio Fantoni (2024-08-02 23:51:26)
Post by Fabio Fantoni
Post by Jonas Smedegaard
Post by Fabio Fantoni
I think that both email and systems like salsa/github/gitlab etc. are
useful, both with pros and cons. Forcing people to use only one or the
other could be counterproductive at the moment. One thing that I think
would be useful is to have certain, fast and simple information for each
package about which actual collaboration methods it uses and prefers.
For example seeing a package it would be very useful to know immediately
if it wants a collaboration only through bugtracker and patch, only
through vcs or both are accepted. If managed in a team point more easily
to information about the team and any pages with details (for example on
wiki).
```patch
--- a/debian/control
+++ b/debian/control
@@ -60,6 +60,7 @@ Standards-Version: 4.7.0
Homepage: https://github.com/oxigraph/oxigraph
Vcs-Git: https://salsa.debian.org/debian/oxigraph.git
Vcs-Browser: https://salsa.debian.org/debian/oxigraph
+Contact: https://bugs.debian.org/oxigraph
Rules-Requires-Root: no
Package: oxigraph
```
In principle I find that an interesting suggestion, as I can imagine
such information being helpful in understanding if debbugs is used only
by "dinosaurs".
a) Maintainers will be bothered to add that new field to every package
(or at least a substantial subset) for it to be of practical use.
b) Which other answers exist for that field? I mean, is it ok in Debian
for a maintainer to not use Debbugs? Is it ok in Debian for a
maintainer to also use another issue tracker and not replicate whatever
is collected elsewhere in Debbugs?
Or perhaps I am missing the point of your suggestion, and you do not
mean where *bug* chatter goes, but instead where *non-bug* conversations
go. If that is the case, then I believe we have a field already for
that, called "Maintainer:". If you mean neither issue tracking nor the
main contact information for a package, then please elaborate what you
had in mind, because that's pretty essential to get clarified before
discussing any further...
contact field don't exist now right? even if the contact field maybe
doesn't give you an idea, maybe something like "contributing" that links
to the bugtracker, to the repository MR/PR or a wiki page or site with
any details (especially in case of a group)
Yes, the contact field exists:
https://www.debian.org/doc/debian-policy/ch-controlfields.html#maintainer
Post by Fabio Fantoni
maybe I'm not good at explaining myself, I think the problem is that if
a contributor, maybe even new or who wants to make even occasional
contributions on specific packages is not able to find in a simple and
fast way about the package on which he wants to contribute as he should
(or is better to do), in some cases you can understand in short time by
looking a bit at the bugtracker and the vcs while, looking for any wiki
pages if he is part of a team but in many cases it is not simple/fast to
understand how he should contribute for that package in order to get the
best result. using patches on bugtracker or vcs (like salsa) is just one
part, then there could be more
you could say to force everyone to use the same system, in theory it
would solve the problem, but in practice I find it difficult and perhaps
more harmful. I try to summarize: the contributors are people and not
machines, moreover many do it as a passion in a little free time and not
as if it were a job.
We all do it as a passion in little free time and not if it were a job.
Also Maintainers. What is the point of introducing additional ways to
interact with maintainers than the ones that already exist and (as I
understand it) is mandatory: A general contact *email* address, and tied
to that a connection to the *Debbugs* issue tracker.

If a new contributor is unable to contact a package maintainer through
that main contact address, then I am concerned about their ability to
help out. Don't get me wrong, I do understand how some people can be
excellent coders or testers or translators without ever using email, but
how can those who are fluent in Gitlab but unable to send and receive
emails avoid being a burden in their offers for help to a software
distribution which at its very core is email-based?

As I see it, those maintainers in Debian - single persons or persons
part of a larger team, who chooses to not only handle the mandatory
communication channel of Debian, which is email, are free to act as
proxies for communication at Gitlab, Matrix and whatever else, as long
as they ensure that the communication is proxied (e.g. summarized) to
the mandatory communication channels of Debian.

It feels backwards to me to start with opening up for more channels,
based on a concern for lack of free time, when effectively that is
simply pushing the burden to the maintainers to invest the needed time
instead.

...unless it is implied that conversations need not reach the current
communication channels - which I would find problematic.


[comments on wiki disregarded]
Post by Fabio Fantoni
Post by Jonas Smedegaard
Post by Fabio Fantoni
If someone thinks that these speed/reachabilityare not important because
they are used to even longer times for many operations, for example
regarding the bugtracker, tracker, upload etc., unfortunately we live in
an increasingly frenetic and continuously worsening world (this world
causes more and more stress and less and less time available).
If you mean psychological stress, then I find your reasoning flawed, as
that is about a *perceived* lack of time (or other pressure), not
necessarily actual lack of it. Possibly but not necessarily.
If you mean stress on the Earth, then I find it highly unlikely that we
can solve that crisis by speeding things up. Instead we need to find
ways to *reduce* the *amount* of computing we do, and find ways to time
that computing in ways that fit more optimally with the availability of
needed resources (e.g. consume less electricity when there is less wind
and sunny, to reduce stress on green parts of related electricity grid).
Please elaborate what kind of stress you are really talking about, and
again please consider the topic of the conversation (see above about
changing Subject: line).
this is complicated to explain, I'm not good at explaining nor in english^^'
staying on the subject of DEP-18 I think it could be relevant on stress
based on if/how it will be done and applied and what I wanted to bring
attention to is not to consider only the possible benefits on the
quality of the packages that it could bring but also the cost that it
could have on the people who contribute and try to be balanced
it is unfortunately common to think of profit at the expense of people,
in the case of Debian it would not be for profit but the impact on
contributions can be significant.
the ideal thing would be that it increases the quality and also makes it
more efficient and less stressful to contribute but I fear that this is
utopian and it is much more likely that there will be fewer results than
hoped for and a higher cost (on the people who contribute)
Yes, this is not about money.

Maintainers contribute, and should ideally not be stressed by doing so.

New contributors are certainly most welcome, and should not be stressed
either. And their needs should not cause stress for maintainers.

Is that also what you mean, or are you only talking about the needs of
new contributors here?


- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Fabio Fantoni
2024-08-03 10:00:01 UTC
Reply
Permalink
Post by Jonas Smedegaard
Quoting Fabio Fantoni (2024-08-02 23:51:26)
Post by Fabio Fantoni
Post by Jonas Smedegaard
Post by Fabio Fantoni
I think that both email and systems like salsa/github/gitlab etc. are
useful, both with pros and cons. Forcing people to use only one or the
other could be counterproductive at the moment. One thing that I think
would be useful is to have certain, fast and simple information for each
package about which actual collaboration methods it uses and prefers.
For example seeing a package it would be very useful to know immediately
if it wants a collaboration only through bugtracker and patch, only
through vcs or both are accepted. If managed in a team point more easily
to information about the team and any pages with details (for example on
wiki).
```patch
--- a/debian/control
+++ b/debian/control
@@ -60,6 +60,7 @@ Standards-Version: 4.7.0
Homepage: https://github.com/oxigraph/oxigraph
Vcs-Git: https://salsa.debian.org/debian/oxigraph.git
Vcs-Browser: https://salsa.debian.org/debian/oxigraph
+Contact: https://bugs.debian.org/oxigraph
Rules-Requires-Root: no
Package: oxigraph
```
In principle I find that an interesting suggestion, as I can imagine
such information being helpful in understanding if debbugs is used only
by "dinosaurs".
a) Maintainers will be bothered to add that new field to every package
(or at least a substantial subset) for it to be of practical use.
b) Which other answers exist for that field? I mean, is it ok in Debian
for a maintainer to not use Debbugs? Is it ok in Debian for a
maintainer to also use another issue tracker and not replicate whatever
is collected elsewhere in Debbugs?
Or perhaps I am missing the point of your suggestion, and you do not
mean where *bug* chatter goes, but instead where *non-bug* conversations
go. If that is the case, then I believe we have a field already for
that, called "Maintainer:". If you mean neither issue tracking nor the
main contact information for a package, then please elaborate what you
had in mind, because that's pretty essential to get clarified before
discussing any further...
contact field don't exist now right? even if the contact field maybe
doesn't give you an idea, maybe something like "contributing" that links
to the bugtracker, to the repository MR/PR or a wiki page or site with
any details (especially in case of a group)
https://www.debian.org/doc/debian-policy/ch-controlfields.html#maintainer
I spent a lot of time writing but it seems I didn't manage to convey
most of what I mean :(

DEP-18 doesn't seem to me to want to change existing contact methods but
to standardize/improve the collaboration part regarding contributing to
the development of packages, or am I perhaps missing something?

and I was just thinking about that part and thinking about how to
contribute in a package then I did a more extensive and practical
reasoning and it seems that in most of what I said I was unable to
explain myself

in theory DEP-18 would be great and could produce great results but in
practice I suppose there are not enough contributors and enough
participation to make it possible (or at most it will be possible on a
small part of packages) and so I was thinking about what would be a
prerequisite to have more possibilities of contributors and
contributions and also possible small improvements on the situation from
which we start
Post by Jonas Smedegaard
Post by Fabio Fantoni
maybe I'm not good at explaining myself, I think the problem is that if
a contributor, maybe even new or who wants to make even occasional
contributions on specific packages is not able to find in a simple and
fast way about the package on which he wants to contribute as he should
(or is better to do), in some cases you can understand in short time by
looking a bit at the bugtracker and the vcs while, looking for any wiki
pages if he is part of a team but in many cases it is not simple/fast to
understand how he should contribute for that package in order to get the
best result. using patches on bugtracker or vcs (like salsa) is just one
part, then there could be more
you could say to force everyone to use the same system, in theory it
would solve the problem, but in practice I find it difficult and perhaps
more harmful. I try to summarize: the contributors are people and not
machines, moreover many do it as a passion in a little free time and not
as if it were a job.
We all do it as a passion in little free time and not if it were a job.
Also Maintainers. What is the point of introducing additional ways to
interact with maintainers than the ones that already exist and (as I
understand it) is mandatory: A general contact *email* address, and tied
to that a connection to the *Debbugs* issue tracker.
If a new contributor is unable to contact a package maintainer through
that main contact address, then I am concerned about their ability to
help out. Don't get me wrong, I do understand how some people can be
excellent coders or testers or translators without ever using email, but
how can those who are fluent in Gitlab but unable to send and receive
emails avoid being a burden in their offers for help to a software
distribution which at its very core is email-based?
As I see it, those maintainers in Debian - single persons or persons
part of a larger team, who chooses to not only handle the mandatory
communication channel of Debian, which is email, are free to act as
proxies for communication at Gitlab, Matrix and whatever else, as long
as they ensure that the communication is proxied (e.g. summarized) to
the mandatory communication channels of Debian.
It feels backwards to me to start with opening up for more channels,
based on a concern for lack of free time, when effectively that is
simply pushing the burden to the maintainers to invest the needed time
instead.
...unless it is implied that conversations need not reach the current
communication channels - which I would find problematic.
staying on the DEP-18 based on what you wrote I'll try another way to
explain some concepts I have in mind: if many packages have maintainers
who don't even answer emails or take a long time to answer, could making
them use a system that requires more time and often has slowness and
unreachability problems improve? Telling them that they should pass
before each salsa-ci upload with the times that it can require (and that
will get worse if it is used even more massively) and often has blocking
problems can improve something?

In my opinion, first of all we should improve the system that we want to
propose to use more

and before than proposing DEP-18, which I think is in theory very good
in general I think we should first focus on other ways to make it more
likely that those who try to contribute will stay, DEP-18 is thought to
be able to help with this but I think having all the information you
need in a simple and fast way always and help is in practice much more
effective.

It seems to me that for the most part we only think from the perspective
of expert and very patient DDs, who already know most of the
information, who therefore have to use wikis and searches little, who
even if they find themselves with wiki, salsa, salsa-ci, or other parts
not working, very slow or with other problems, know and use workarounds
via documentation and local tools.

and this does not help at all to increase contributors and contributions
and without them you can also make the best possible system (as quality
of packages it could produce), starting from DEP-18 or even more but you
will not be able to have great results

you can also have a great system, a great CI, methods that can speed up
some operations (like what will be done with tag2upload for example) but
you still need people who do it (and more is better), who have the
desire and the time to do it

Am I perhaps the only one who sees certain problems?


I'm curious to know if I'm the only one who experiences things like
this: spend more than 2 hours doing things that should be done in half
an hour maximum if salsa, salsa-ci, wiki and packages worked well
(example "extreme" but it actually happened to me a few weeks ago).
Post by Jonas Smedegaard
[comments on wiki disregarded]
Post by Fabio Fantoni
Post by Jonas Smedegaard
Post by Fabio Fantoni
If someone thinks that these speed/reachabilityare not important because
they are used to even longer times for many operations, for example
regarding the bugtracker, tracker, upload etc., unfortunately we live in
an increasingly frenetic and continuously worsening world (this world
causes more and more stress and less and less time available).
If you mean psychological stress, then I find your reasoning flawed, as
that is about a *perceived* lack of time (or other pressure), not
necessarily actual lack of it. Possibly but not necessarily.
If you mean stress on the Earth, then I find it highly unlikely that we
can solve that crisis by speeding things up. Instead we need to find
ways to *reduce* the *amount* of computing we do, and find ways to time
that computing in ways that fit more optimally with the availability of
needed resources (e.g. consume less electricity when there is less wind
and sunny, to reduce stress on green parts of related electricity grid).
Please elaborate what kind of stress you are really talking about, and
again please consider the topic of the conversation (see above about
changing Subject: line).
this is complicated to explain, I'm not good at explaining nor in english^^'
staying on the subject of DEP-18 I think it could be relevant on stress
based on if/how it will be done and applied and what I wanted to bring
attention to is not to consider only the possible benefits on the
quality of the packages that it could bring but also the cost that it
could have on the people who contribute and try to be balanced
it is unfortunately common to think of profit at the expense of people,
in the case of Debian it would not be for profit but the impact on
contributions can be significant.
the ideal thing would be that it increases the quality and also makes it
more efficient and less stressful to contribute but I fear that this is
utopian and it is much more likely that there will be fewer results than
hoped for and a higher cost (on the people who contribute)
Yes, this is not about money.
Maintainers contribute, and should ideally not be stressed by doing so.
New contributors are certainly most welcome, and should not be stressed
either. And their needs should not cause stress for maintainers.
Is that also what you mean, or are you only talking about the needs of
new contributors here?
The needs for any contributors
Post by Jonas Smedegaard
- Jonas
Otto Kekäläinen
2024-08-02 15:30:02 UTC
Reply
Permalink
Hi!

On Fri, 2 Aug 2024 at 02:27, Andrea Pappacoda <***@pappacoda.it> wrote:
..
Post by Andrea Pappacoda
Before a certain way of doing things can be mandated or "warmly
recommended", the technology has to be as flawless as possible - and
today I wouldn't call Salsa "flawless", would you? Issues with
1. It is so slow that it makes me want to close by browser and do
something else instead
2. It doesn't support email-based workflows
3. It has a lot of features we don't need. Or rather, it has more
features we *don't* need than we do.
4. Its user interface is confusing, it's often hard to find what I'm
looking for
5. Did I mention how slow it is?
6. It is developed by a company who's philosophy and interests are
misaligned with Debian's
7. The product it tries to mimic, GitHub, is also misaligned with
Debian's philosophy and interests
While performance is something we could reasonably do something about,
all the other points are part of GitLab by design, and we're stuck with
them.
GitLab of course has more features than what we need; it does not mean
it has to be used. The basic feature set in GitLab to browse
repositories, show and compare history, show CI status, list MRs,
separate drafts and ready ones, show approvals, show assignees etc
work well. GitHub has done many things well and trying to compete with
them is a good thing. Both GitLab and GitHub also support email
workflows to some degree (but of course most people use them via the
UI as the UI offers many things email does not and never will).

I agree that Salsa is sometimes a bit sluggish
(https://salsa.debian.org/salsa/support/-/issues/395), but I hope we
can do something to improve it and it is now a permanent reason to not
use Salsa.

...
Post by Andrea Pappacoda
But the point isn't that much about being able to use emails
specifically, it is about having the possibility of having a software
forge which is interoperable with a wide range of tools and can stay
out of the way if wanted. With GitLab, you either use the full package
(which includes browsing, reviewing, and commenting) or you get a
sub-optimal experience. But it doesn't have to be this way.
I'll now talk a bit about SourceHut. Not to suggest that we should use
that instead, but just to point out how things *can* be done.
I have a paid SourceHut account and have been testing it for some
time. I can see the appeal of simplicity, but for actual team work it
is *too* simple. It will probably take a couple of years for it to
mature.

Note that a DEP is not a vehicle to drive out new version control
systems or source forges. It is a vehicle to formalize something that
is already popular as an official best practice. The salsa.debian.org
is what we have today, and Debian has been using for a 5+ years. If
some day in the future something vastly superior to git or GitLab
surfaces and a lot of people start using it, the DEP could be updated.
But I would not today recommend new Debian maintainers to host on
SourceHut nor GitHub nor self-host. They can mirror there if they
want, but for collaboration prior to uploading to work well the source
code should be on salsa.debian.org for now.

When I today reviewed recent submissions on mentors.debian.net, most
of them were hosted on Salsa, but 4 on GitHub and 1 in nowhere in git
at all. As it currently stands, there is no official document I could
lean on to ask the submitters to please use salsa.debian.org instead.
This is one of the motivations for this DEP.
Johannes Schauer Marin Rodrigues
2024-08-02 23:30:02 UTC
Reply
Permalink
Hi,

Quoting Otto KekÀlÀinen (2024-08-02 17:23:51)
Post by Otto Kekäläinen
I agree that Salsa is sometimes a bit sluggish
(https://salsa.debian.org/salsa/support/-/issues/395),
what kind of hardware do you have? For people like me who are on slower
hardware, the web experience is absolutely not funny and "a bit sluggish"
doesn't begin to describe it. It is hard to find any other website I'm visiting
that is slower than gitlab. For example, when I run this on my Firefox I get a
score of 1.53: https://browserbench.org/Speedometer3.0/#summary

On an intel core i7 1280P you will get around 7. If the result on your machine
is towards the latter instead of the former, then I understand how you would
describe the gitlab experience only as "a bit sluggish" instead of "atrocious".
Post by Otto Kekäläinen
but I hope we can do something to improve it and it is now a permanent reason
to not use Salsa.
You now said "I hope we can do something to improve it and it is now a
permanent reason to not use Salsa." twice:

https://lists.debian.org/CAOU6tADWMNc__rVqpob7a1+zyySnGoTFiQ4i+***@mail.gmail.com

Did you typo it twice or do you actually mean that it's now a permanent reason
to not use salsa?

I am not suggesting salsa use because I think it's the best thing since the
invention of sliced bread. But personally, I rather use something suboptimal if
it means that we can more or less agree on a "default" and I think that the
current situation (submission of patches by mail and the debian archive is the
bts) is deterring to newcomers. I know that most people probably have faster
machines than I. As it was pointed out elsewhere in this thread, Debian work
already implies a lot more waiting than "a few seconds" for salsa to finish
loading a page or finish yet another animation, so meh. With the glab tool I
think I can be happy enough.

Thanks!

cheers, josch
Otto Kekäläinen
2024-08-03 04:40:01 UTC
Reply
Permalink
Hi,

On Fri, 2 Aug 2024 at 16:27, Johannes Schauer Marin Rodrigues
Quoting Otto Kekäläinen (2024-08-02 17:23:51)
Post by Otto Kekäläinen
I agree that Salsa is sometimes a bit sluggish
(https://salsa.debian.org/salsa/support/-/issues/395),
what kind of hardware do you have? For people like me who are on slower
I have a 4-year old Dell XPS 13 (that came with Ubuntu preinstalled
and has perfect Linux support, great laptop by the way).
hardware, the web experience is absolutely not funny and "a bit sluggish"
doesn't begin to describe it. It is hard to find any other website I'm visiting
that is slower than gitlab. For example, when I run this on my Firefox I get a
score of 1.53: https://browserbench.org/Speedometer3.0/#summary
I got 9.25.

Some of the GitLab slowness is due to the server side, and some due to
JavaScript. I prefer to use mild terms "a bit sluggish" out of empathy
to the people who maintain Salsa, as it is probably not fun for them
to read too vocal complaints after the incredible amount of work they
have put in to get us this far. I am very grateful for their work and
with the language in the bug report I try to be constructive on what
things to prioritize next.

...
You now said "I hope we can do something to improve it and it is now a
Did you typo it twice or do you actually mean that it's now a permanent reason
to not use salsa?
Thanks for pointing out the typo. I meant 'not a permanent reason'. I
typo now/not frequently for some odd reason and since both words are
in the dictionary, my spell checker does not flag it.
I am not suggesting salsa use because I think it's the best thing since the
invention of sliced bread. But personally, I rather use something suboptimal if
it means that we can more or less agree on a "default" and I think that the
current situation (submission of patches by mail and the debian archive is the
bts) is deterring to newcomers. I know that most people probably have faster
machines than I. As it was pointed out elsewhere in this thread, Debian work
already implies a lot more waiting than "a few seconds" for salsa to finish
loading a page or finish yet another animation, so meh. With the glab tool I
think I can be happy enough.
This I think summarizes well the opinion of most people I have spoken
with. GitLab is not perfect, but it was chosen and we have been using
it for 5+ years mostly successfully. Most packages are there and we
should state that it is the recommended option. Currently the second
most popular option is to use GitHub, or not use any vcs at all.

A lot of this thread has gone into people expressing their dislike for
Salsa. Most people still use Salsa - I guess the silent mass isn't
chiming in in this thread that much now. Some people probably have
very optimized email workflows, and nobody can argue against the
statement that a pure email workflow for sure is simple, and has its
elegance. But it also has shortcomings such as no lack of
metadata/status, no built-in way to run CI and share the code+logs+CI
results etc.

Following the principles 1 (use git) and 2 (use Salsa) allows for the
next principles 3, 4 and 5 to take place. I would be curious to hear
more views about them.

DEP-18 summary (https://salsa.debian.org/dep-team/deps/-/merge_requests/8):
1. Have package source code in version control, using git
2. Host package source on Debian's code forge Salsa
3. Run Salsa CI at least once before every upload to ensure minimal
level of quality
4. Allow Merge Requests to be submitted
5. Allow changes to be reviewed before uploads to Debian

My plan is to summarize the discussion and update the proposal in the
coming days, incorporating as many views as possible. I will also in
the next update include additional relevant context info such as
tag2upload, glab and examples of how to easily work with both Debian
bug tracker and MRs in parallel.

Please share your views, and also +1 or -1 the proposal on Salsa so we
can incorporate that too in measuring the support of this.

Remember that DEPs are soft rules - unlike General Resolutions (GRs) -
and maintainers who have specific reasons to not want to use git or
Salsa will not be forced to do so.
Jonas Smedegaard
2024-08-03 06:30:01 UTC
Reply
Permalink
Quoting Otto KekÀlÀinen (2024-08-03 06:38:38)
Post by Otto Kekäläinen
Post by Johannes Schauer Marin Rodrigues
I am not suggesting salsa use because I think it's the best thing since the
invention of sliced bread. But personally, I rather use something suboptimal if
it means that we can more or less agree on a "default" and I think that the
current situation (submission of patches by mail and the debian archive is the
bts) is deterring to newcomers. I know that most people probably have faster
machines than I. As it was pointed out elsewhere in this thread, Debian work
already implies a lot more waiting than "a few seconds" for salsa to finish
loading a page or finish yet another animation, so meh. With the glab tool I
think I can be happy enough.
This I think summarizes well the opinion of most people I have spoken
with. GitLab is not perfect, but it was chosen and we have been using
it for 5+ years mostly successfully. Most packages are there and we
should state that it is the recommended option. Currently the second
most popular option is to use GitHub, or not use any vcs at all.
A lot of this thread has gone into people expressing their dislike for
Salsa. Most people still use Salsa - I guess the silent mass isn't
chiming in in this thread that much now. Some people probably have
very optimized email workflows, and nobody can argue against the
statement that a pure email workflow for sure is simple, and has its
elegance. But it also has shortcomings such as no lack of
metadata/status, no built-in way to run CI and share the code+logs+CI
results etc.
Following the principles 1 (use git) and 2 (use Salsa) allows for the
next principles 3, 4 and 5 to take place. I would be curious to hear
more views about them.
1. Have package source code in version control, using git
2. Host package source on Debian's code forge Salsa
3. Run Salsa CI at least once before every upload to ensure minimal
level of quality
4. Allow Merge Requests to be submitted
5. Allow changes to be reviewed before uploads to Debian
My plan is to summarize the discussion and update the proposal in the
coming days, incorporating as many views as possible. I will also in
the next update include additional relevant context info such as
tag2upload, glab and examples of how to easily work with both Debian
bug tracker and MRs in parallel.
Please share your views, and also +1 or -1 the proposal on Salsa so we
can incorporate that too in measuring the support of this.
Remember that DEPs are soft rules - unlike General Resolutions (GRs) -
and maintainers who have specific reasons to not want to use git or
Salsa will not be forced to do so.
My problem with DEP-18 is that people who have zero problem with using
git and are also not fundamentally against using salsa, but have
reservations surrounding *which parts* of salsa to use and the
consequences for related already used tooling.

I am also not against being welcoming to newcomers, but I am concerned
if the focus on tose unreasonably reshapes the tooling for all of us.

Essentially, my concern is that DEP-18 reduces a spectrum of options to
"either you are for or against true collaboration".

Leaning more on Gitlab is not the "true" choice, but the pragmatic one,
because yes, we have invested in it, and some parts of it might be made
to better use for use.

I imagine that some in the silent crowd hesitate to chime in due to that
lumping together the use of git and the use of Gitlab into an
all-or-nothing choice. I think you intended that reduction, for the
purpose of simplifying the conversation. I don't think that
simplification is helpfull, however.


- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Shengjing Zhu
2024-08-03 06:50:01 UTC
Reply
Permalink
Post by Jonas Smedegaard
My problem with DEP-18 is that people who have zero problem with using
git and are also not fundamentally against using salsa, but have
reservations surrounding *which parts* of salsa to use and the
consequences for related already used tooling.
I am also not against being welcoming to newcomers, but I am concerned
if the focus on tose unreasonably reshapes the tooling for all of us.
Essentially, my concern is that DEP-18 reduces a spectrum of options to
"either you are for or against true collaboration".
Leaning more on Gitlab is not the "true" choice, but the pragmatic one,
because yes, we have invested in it, and some parts of it might be made
to better use for use.
I imagine that some in the silent crowd hesitate to chime in due to that
lumping together the use of git and the use of Gitlab into an
all-or-nothing choice. I think you intended that reduction, for the
purpose of simplifying the conversation. I don't think that
simplification is helpfull, however.
+1

I also feel uncomfortable with this proposal that pushes the use of
Gitlab in the name of true collaboration.
--
Shengjing Zhu
PICCA Frederic-Emmanuel
2024-08-03 07:40:01 UTC
Reply
Permalink
Hello, I like the dgit idea, produce a git repository for people who want to use git and let other use whatever they want.

Maybe uploading a paquage to Debian could push automatically into dgit. (maybe this is already the case)

Is it possible then to mirror this dgit repository in salsa ?

Fred
Sean Whitton
2024-08-07 07:50:01 UTC
Reply
Permalink
Hello,
Post by PICCA Frederic-Emmanuel
Hello, I like the dgit idea, produce a git repository for people who want to
use git and let other use whatever they want.
Maybe uploading a paquage to Debian could push automatically into dgit. (maybe
this is already the case)
If the upload is done with dgit or tag2upload this is already the case.
For other uploads, 'dgit clone' constructs the dgit view on-the-fly.

We could consider having this done in advance. It would make 'dgit
clone much faster' and it would enable importing into salsa as you also
suggest.
--
Sean Whitton
Soren Stoutner
2024-08-03 18:30:02 UTC
Reply
Permalink
Post by Jonas Smedegaard
I imagine that some in the silent crowd hesitate to chime in due to that
lumping together the use of git and the use of Gitlab into an
all-or-nothing choice. I think you intended that reduction, for the
purpose of simplifying the conversation. I don't think that
simplification is helpfull, however.
I am one of the silent crowd who has followed this discussion.

I have three feelings.

1. Debian workflows are too fractured. The project would be better if we asked people to
standardize around a single (or a small number) of workflows. To do so, the workflow
would need to be flexible enough to handle the wide range of technical needs of all the
packages and upstream configurations.

2. Standardizing around a single (or small number of) workflows will make some people
unhappy. But that is an acceptable price to pay because of the general benefit to the
project *as long as the correct solution is adopted*. Unity is more important than
minority opinions on this particular issue.

3. I do not yet have the wisdom to ascertain what the correct solution is. Until I do, I
applaud those who attempt to push this discussion forward, and I follow it closely, but I
haven’t commented. I think adopting an incorrect mandated (or maybe even
recommended) workflow is worse than the fractured status quo.

Number 3 is why I haven’t previously commented. In regards to DEP-18, I don’t know if it is
the correct way to go for many of the criticisms that have already been expressed. But, if it
isn’t DEP-18, I think it will eventually be something. And, although this might not be a
popular opinion among some, I think Debian should get to the point that there is one
workflow (or a very small number of workflows) that all packages are expected to follow,
both for packaging and for collaboration.
--
Soren Stoutner
***@debian.org
Salvo Tomaselli
2024-08-03 20:40:01 UTC
Reply
Permalink
Post by Soren Stoutner
2. Standardizing around a single (or small number of) workflows will make
some people unhappy. But that is an acceptable price to pay because of the
general benefit to the project *as long as the correct solution is
adopted*. Unity is more important than minority opinions on this
particular issue.
Keep in mind that unhappy people quit.

I don't think that unity is so important that we're willing to sacrifice
project members.

What exact issue are we trying to fix?

At the bottom, is it ok for a package to have a single maintainer or not?

Perhaps we should start with a vote on this. So far it has been completely ok.
If as a project this has to change, I think a vote is warranted.

If that should pass, we can decide which specific tools impose on people.

Best
--
Salvo Tomaselli

"Io non mi sento obbligato a credere che lo stesso Dio che ci ha dotato di
senso, ragione ed intelletto intendesse che noi ne facessimo a meno."
-- Galileo Galilei

https://ltworf.codeberg.page/
Soren Stoutner
2024-08-03 20:50:01 UTC
Reply
Permalink
Post by Salvo Tomaselli
Post by Soren Stoutner
2. Standardizing around a single (or small number of) workflows will make
some people unhappy. But that is an acceptable price to pay because of the
general benefit to the project *as long as the correct solution is
adopted*. Unity is more important than minority opinions on this
particular issue.
Keep in mind that unhappy people quit.
I don't think that unity is so important that we're willing to sacrifice
project members.
Yes, but based on my work helping new contributors start working on Debian, I
think the number of people the project would gain would far exceed those who
would leave.
Post by Salvo Tomaselli
What exact issue are we trying to fix?
The core of the issue is that it is far too hard for a new contributor to
figure out how to contribute to Debian, and far too hard for an experienced DD
to figure out how to contribute to a package that is based on a workflow with
which they are not familiar.
Post by Salvo Tomaselli
At the bottom, is it ok for a package to have a single maintainer or not?
Yes, as I have written elsewhere, I am a proponent of a strong package
maintainer orientation.

However, even single maintainer packages periodically need input from other
developers, either as an NMU or as an adoption or because of a mass bug report
or a transition or various other things. Having one workflow that everyone
understands is a strong benefit for all packages, whether or not they are team
maintained.
Post by Salvo Tomaselli
If as a project this has to change, I think a vote is warranted.
Absolutely. This is such a core aspect of Debian that any changes or mandates
would need to involve a vote.
--
Soren Stoutner
***@debian.org
Paul Gevers
2024-08-04 09:00:01 UTC
Reply
Permalink
Hi all,
Post by Salvo Tomaselli
At the bottom, is it ok for a package to have a single maintainer or not?
I have never wanted to be the single maintainer of a package, and here I
am, I'm member of a bunch of teams, but most of my packages uploads (not
a lot luckily) are for packages that nobody else uploads. The people
that believe that package should not be single person maintained, please
become co-maintainer of all the packages I list below, you're welcome.

In this discussion about single maintainer packages I nearly feel
guilty, while at the same time I don't *want* to be the single
maintainer. Actually, I don't want to maintain packages at all, my joy
is elsewhere in Debian.

I'm on LowThresholdNMU and LowThresholdAdoption lists. I guess I should
have created a wnpp RFH" bug for all my packages? Not that those really
work either (see e.g. #846328, it's still open). So we have established
processes, but apparently they don't work as intended. Now we trying to
*add* to the set. Maybe we should clean up older processes at the same
time because additions just make it even more difficult. XKCD 927 comes
to mind [1].

I'm the single maintainer for the following package, only to reflect
reality, not because I consider myself "owner". E.g. for years there was
a different person in the maintainer field for liferea, but de-facto I
was the real maintainer. If people recognize a good team for them, we
should make a team maintainer of these:
dbconfig-common -> in the debian namespace
liferea -> in the debian namespace
viking -> in the debian namespace

I'm the only member of the teams maintaining:
* cacti and cacti-spine -> in the debian namespace (bit complicated
packaging due to upstream vendoring stuff; receives quite some CVE's)
* siridb, libcleri, qpack, siridb-connector and siridb-admin -> in the
siridb-team namespace, but I'd happily move them to the debian
namespace if it would help (I don't expect it would, see
dbconfig-common, liferea and viking).

Feel free to enable all ci pipelines that work for those packages (I
couldn't get cacti to build on salsa last time I tried, would love to
see that fixed, I now use debomatic to try run builds). I'm not sure if
I receive MR message if somebody would try to create one for these packages.

Paul

[1] https://xkcd.com/927/
Andrey Rakhmatullin
2024-08-04 13:20:02 UTC
Reply
Permalink
Post by Salvo Tomaselli
Post by Soren Stoutner
2. Standardizing around a single (or small number of) workflows will make
some people unhappy. But that is an acceptable price to pay because of the
general benefit to the project *as long as the correct solution is
adopted*. Unity is more important than minority opinions on this
particular issue.
Keep in mind that unhappy people quit.
Yes, people will resign, but (other) people resign because they got tired
of Debian not having standartized workflows, and the "1000 DDs status quo"
problem also means that more people leave than join *anyway*.
Post by Salvo Tomaselli
I don't think that unity is so important that we're willing to sacrifice
project members.
Not the unity per se, but having significantly lower barriers to start
contributing.
--
WBR, wRAR
Otto Kekäläinen
2024-08-03 21:30:02 UTC
Reply
Permalink
Hi!
Post by Soren Stoutner
I have three feelings.
1. Debian workflows are too fractured. The project would be better if we asked people to standardize around a single (or a small number) of workflows. To do so, the workflow would need to be flexible enough to handle the wide range of technical needs of all the packages and upstream configurations.
2. Standardizing around a single (or small number of) workflows will make some people unhappy. But that is an acceptable price to pay because of the general benefit to the project as long as the correct solution is adopted. Unity is more important than minority opinions on this particular issue.
3. I do not yet have the wisdom to ascertain what the correct solution is. Until I do, I applaud those who attempt to push this discussion forward, and I follow it closely, but I haven’t commented. I think adopting an incorrect mandated (or maybe even recommended) workflow is worse than the fractured status quo.
Number 3 is why I haven’t previously commented. In regards to DEP-18, I don’t know if it is the correct way to go for many of the criticisms that have already been expressed. But, if it isn’t DEP-18, I think it will eventually be something. And, although this might not be a popular opinion among some, I think Debian should get to the point that there is one workflow (or a very small number of workflows) that all packages are expected to follow, both for packaging and for collaboration.
Thanks for voicing this! I think a lot of people have the same feeling
that if there were a bit more common principles and practices across
all packages and maintainers, contributing to multiple different
packages would be easier for old maintainers, and learning how to
contribute efficiently in the first place would be easier for new
maintainers.

Also I fully agree that suddenly forcing everybody to do something
unpractical would be detrimental to Debian. Therefore the DEP-18
proposal is based on the principles most packages and teams already
follow based on trends.debian.net and what I know about e.g. Python,
Golang and kernel team policies.

There is also no way a volunteer project such as Debian could mandate
a two-person-rule as it would instantly grind all single-maintainer
packages to a halt. It is and will be OK to have single maintainer
packages now and going forward if there is just one person interested
in the package. DEP-18 hopefully helps to unify some things and allow
for more people to step up and help with packages they have not worked
on before, but I intentionally want it to be a fairly soft mechanism,
and not overly prescriptive in the details.

I also object to having any votes or mandatory rules on this. This is
just a DEP on purpose and not a GR. Who knows if a superior
alternative to for example git surfaces in the next 15 years. If at
that time people *really* want to move away from git they should be
allowed to do so and not be prohibited by too strict rules.

For the reasons 2 and 3 in Soren's list, let's continue to discuss
what are the best practices and principles. I am sure we can
eventually get a consensus that suits most people and creates the best
environment for easier collaboration.
Sean Whitton
2024-08-07 08:00:01 UTC
Reply
Permalink
Hello,
Post by Soren Stoutner
1. Debian workflows are too fractured. The project would be better if we asked people
to standardize around a single (or a small number) of workflows. To do so, the workflow
would need to be flexible enough to handle the wide range of technical needs of all the
packages and upstream configurations.
2. Standardizing around a single (or small number of) workflows will make some people
unhappy. But that is an acceptable price to pay because of the general benefit to the
project as long as the correct solution is adopted. Unity is more important than minority
opinions on this particular issue.
3. I do not yet have the wisdom to ascertain what the correct solution is. Until I do, I
applaud those who attempt to push this discussion forward, and I follow it closely, but I
haven’t commented. I think adopting an incorrect mandated (or maybe even
recommended) workflow is worse than the fractured status quo.
We need to distinguish different workflows or workflow stages.

There is the git hosting workflow -- gitlab vs. github vs. personal
server. This seems solely about what people like to use.
I agree with you that we should probably pick just one of these
-- not even a small number.

But there is also the git->dsc workflow -- gbp vs. dpm vs. debrebase
vs. debcherry. The crucial difference is that in this area it's not
just personal preferences, but that different packages have different
needs. A small Python library is vastly different to, say, SBCL or Xen.

My two favourite git->dsc workflows are documented in
dgit-maint-merge(7) and dgit-maint-rebase(7).
These manpages include some explanations as to what sort of packages are
best suited to each of them.
--
Sean Whitton
Sean Whitton
2024-08-07 07:50:01 UTC
Reply
Permalink
Hello,
Post by Jonas Smedegaard
My problem with DEP-18 is that people who have zero problem with using
git and are also not fundamentally against using salsa, but have
reservations surrounding *which parts* of salsa to use and the
consequences for related already used tooling.
This describes me.

I use and am enthusiastic about git, and when the workflow is not
obvious from team policy or whatever, I document it in README.source.
I took time to write up the complex workflow emacs.git uses (not
developed by me) precisely so that more people could become involved.

I am happy to use salsa for git hosting and access management.
I love that I can easily grant push access to my non-DD team members.

But, I turn off salsa MRs for the repos of all packages I regularly
upload. I would hope that this DEP can be written such as to account
for these sorts of choices.
--
Sean Whitton
Salvo Tomaselli
2024-08-03 13:50:01 UTC
Reply
Permalink
Post by Otto Kekäläinen
A lot of this thread has gone into people expressing their dislike for
Salsa. Most people still use Salsa - I guess the silent mass isn't
chiming in in this thread that much now.
Using salsa to do "git push" once a day is not the same as using the CI and
merge requests and all those complicated permissions from the website.

Occasionally even git push fails. I can just run it the next day. No problem.

But if I were to rely on it more heavily, it would be a problem. Because
tomorrow I might be busy. It shouldn't be salsa's availability to dictate my
schedule.
--
Salvo Tomaselli

"Io non mi sento obbligato a credere che lo stesso Dio che ci ha dotato di
senso, ragione ed intelletto intendesse che noi ne facessimo a meno."
-- Galileo Galilei

https://ltworf.codeberg.page/
Charles Plessy
2024-08-03 07:20:01 UTC
Reply
Permalink
Post by Otto Kekäläinen
I have drafted a new DEP at
Enable true open collaboration on all Debian packages".
Hi Otto,

thank you for your initiative,

one problem I have with NMUs in team-maintained package is that they
often bypass Salsa… Would it make sense to add to the DEP a request
that NMUs are started from and pushed to the default branch?

Have a nice week-end,

Charles
--
Charles Plessy Nagahama, Yomitan, Okinawa, Japan
Debian Med packaging team http://www.debian.org/devel/debian-med
Tooting from work, https://fediscience.org/@charles_plessy
Tooting from home, https://framapiaf.org/@charles_plessy
Noah Meyerhans
2024-08-03 07:40:01 UTC
Reply
Permalink
Post by Jonas Smedegaard
Post by Otto Kekäläinen
I have drafted a new DEP at
Enable true open collaboration on all Debian packages".
Hi Otto,
thank you for your initiative,
one problem I have with NMUs in team-maintained package is that they
often bypass Salsa… Would it make sense to add to the DEP a request
that NMUs are started from and pushed to the default branch?
+1

Regardless of what VCS is used, an NMU that bypasses it just makes more
work for the maintainer. If not pushed, there should at minimum be an
open merge request that applies cleanly to whatever was in the archive
prior to the NMU. It would be nice to codify this.

noah
Andrey Rakhmatullin
2024-08-04 13:40:01 UTC
Reply
Permalink
Post by Charles Plessy
one problem I have with NMUs in team-maintained package is that they
often bypass Salsa
 Would it make sense to add to the DEP a request
that NMUs are started from and pushed to the default branch?
Only if DEP-18 also includes an easy way to find the workflow used by the
repo, which I'm not seeing there (which may be my fault).
--
WBR, wRAR
Fabio Fantoni
2024-08-04 14:20:02 UTC
Reply
Permalink
Post by Andrey Rakhmatullin
Post by Charles Plessy
one problem I have with NMUs in team-maintained package is that they
often bypass Salsa
 Would it make sense to add to the DEP a request
that NMUs are started from and pushed to the default branch?
Only if DEP-18 also includes an easy way to find the workflow used by the
repo, which I'm not seeing there (which may be my fault).
something like wrote here can help for you?

https://lists.debian.org/debian-devel/2024/08/msg00058.html

https://lists.debian.org/debian-devel/2024/08/msg00062.html

I think something like this could be useful, even in a possible future
where all packages would use git and salsa; but from the answers
received so far it seems to be considered a useless thing. I would be
curious to know the opinion of more people.
Andrey Rakhmatullin
2024-08-05 01:20:01 UTC
Reply
Permalink
Post by Fabio Fantoni
Post by Andrey Rakhmatullin
Post by Charles Plessy
one problem I have with NMUs in team-maintained package is that they
often bypass Salsa
 Would it make sense to add to the DEP a request
that NMUs are started from and pushed to the default branch?
Only if DEP-18 also includes an easy way to find the workflow used by the
repo, which I'm not seeing there (which may be my fault).
something like wrote here can help for you?
https://lists.debian.org/debian-devel/2024/08/msg00058.html
https://lists.debian.org/debian-devel/2024/08/msg00062.html
I think something like this could be useful, even in a possible future where
all packages would use git and salsa; but from the answers received so far
it seems to be considered a useless thing. I would be curious to know the
opinion of more people.
It's similar but different: I'm talking about workflows to build a package
from the repo (e.g. "gbp with gbp-pq and importing upstream tarballs").
And yeah it could be a metadata field.
--
WBR, wRAR
Fabio Fantoni
2024-08-05 08:20:01 UTC
Reply
Permalink
Post by Andrey Rakhmatullin
Post by Fabio Fantoni
Post by Andrey Rakhmatullin
Post by Charles Plessy
one problem I have with NMUs in team-maintained package is that they
often bypass Salsa
 Would it make sense to add to the DEP a request
that NMUs are started from and pushed to the default branch?
Only if DEP-18 also includes an easy way to find the workflow used by the
repo, which I'm not seeing there (which may be my fault).
something like wrote here can help for you?
https://lists.debian.org/debian-devel/2024/08/msg00058.html
https://lists.debian.org/debian-devel/2024/08/msg00062.html
I think something like this could be useful, even in a possible future where
all packages would use git and salsa; but from the answers received so far
it seems to be considered a useless thing. I would be curious to know the
opinion of more people.
It's similar but different: I'm talking about workflows to build a package
from the repo (e.g. "gbp with gbp-pq and importing upstream tarballs").
And yeah it could be a metadata field.
Thanks for reply, what I mean is precisely a standard field that points
to a file, inside the package or even an url as already explained can be
very useful in most cases) that contains all the useful information for
contributing to that package, including the one you mention. even if
everyone applied DEP-14 and DEP-18 there would be some differences that
could be useful to know in a simple and immediate way. and I think this
is even more useful with the current situation and also very useful in
case of any future migrations to more standardized systems.

currently you find such information from a simple search and/or looking
a bit in the source, in the possible git in a few minutes only in part
of cases, in many other cases instead it requires more time, the
possible contact of the maintainer, attempts (and then eventually feel
that it would be better to "improve" your contributions using other
methods).

a single standard field (to be added optionally) and adding links to
that file or url in the tracker (if present) I think would bring
advantages and save time for both contributors and maintainers in many
cases (when used)
Simon Richter
2024-08-05 08:50:01 UTC
Reply
Permalink
Hi,
Post by Fabio Fantoni
currently you find such information from a simple search and/or looking
a bit in the source, in the possible git in a few minutes only in part
of cases, in many other cases instead it requires more time, the
possible contact of the maintainer, attempts (and then eventually feel
that it would be better to "improve" your contributions using other
methods).
This information should be in debian/README.source.

Simon
Fabio Fantoni
2024-08-05 11:10:01 UTC
Reply
Permalink
Post by Simon Richter
Hi,
Post by Fabio Fantoni
currently you find such information from a simple search and/or
looking a bit in the source, in the possible git in a few minutes
only in part of cases, in many other cases instead it requires more
time, the possible contact of the maintainer, attempts (and then
eventually feel that it would be better to "improve" your
contributions using other methods).
This information should be in debian/README.source.
   Simon
debian/README.source can be used for that, this according to the current
documentation does partially that, make it standard also for other parts
mentioned, more known thing and change/improve the documentation, for
example in
https://www.debian.org/doc/debian-policy/ch-source.html#source-package-handling-debian-readme-source
as at the moment reading at the beginning it leaves to understand to a
restricted use of it, can be an improvement with minimal effort.
Post by Simon Richter
|debian/README.source| may also include any other information that
would be helpful to someone modifying the source package. Even if the
package doesn’t fit the above description, maintainers are encouraged
to document in a |debian/README.source| file any source package with a
particularly complex or unintuitive source layout or build system (for
example, a package that builds the same source multiple times to
generate different binary packages).
that it may suggest a greater use than what I saw and remembered but at
least something like this should be put at the beginning of the
description: "debian/README.source may include any information that
would be helpful to someone modifying the source package and how to
contribute to it"

could suggest to optionally add other parts on how to contribute that
have been discussed, to insert any external links where to find the
information (in order to update a single page/file even for a big amount
of packages, but leaving README.source unchanged, so I guess it would be
much more used thanks to less effort from the maintainers)
Simon Richter
2024-08-05 09:40:01 UTC
Reply
Permalink
Hi,
 * Does this package use `gbp dch` [...]
 * Does this package use some form of automatic formatting [...]
 * Does the maintainer prefer MR via salsa or BTS [...]
 * Does the maintainer prefer dgit and if so, which of its 5+ different
   documented workflows should I follow?
The thing is: all of these things are really interfaces, but they have
not been designed as interfaces, they are just exposed parts of the
implementation.

What we want is a single machine readable interface that allows updating
packages. What we get in this way is a selector for an open set of
possible interfaces, all with their individual drawbacks.

To really use that in an automated fashion, someone will have to develop
a software package that has a single interface and several plugins that
implement this interface, and that abstract away the differences between
the exposed-implementation-details-as-interface.

So this does not save us from designing a proper interface, so we might
as well get this done and then add the abstraction layer for the tools
directly into the tools themselves.

Such an interface would assume a backend data model that can accurately
represent the timeline of Debian packaging, including

- taking upstream source
- from tarball
- from git
- leave option to support other VCS, but do not waste effort
- removing DFSG non-compliant files
- demarcating the separation between "upstream" and "Debian"
- producing a reproducible .orig archive (with no limit on format)
- adding and updating packaging metadata
- adding, updating and removing patches to the upstream source
(ideally tracking patch author information and patch metadata
information separately
- producing a reproducible .debian archive (with no limit on format)
- listing package history, with events classed accordingly

There needs to be some allowance for backends to be unable to retrieve
some information, simply because the Debian archive does not track
contributions line-by-line, and several of the git backends have also
lost information along the way, like the original commit message for a
patch that got copied into debian/patches.

A successful abstraction, in my view, hides the existence of the
debian/patches directory, and represents it as metadata, with the
metadata fields from the patch files themselves, and includes an
interface for "add this patch to the upstream sources at this point in
the patch stack and rebase everything." Whether that uses git rebase or
quilt refresh in the background is of no concern to the interface user.

Of course that will lose most of the "usefulness" of salsa, which does
not expose this high-level view, and cannot easily be made to do so. The
point I was trying to make all along was that this was always a red
herring, and if we want to have good tools, then we cannot tie packaging
workflows to the back of a software development workflow just so we
could reuse some of their shiny tools.

Simon
Sean Whitton
2024-08-07 08:00:01 UTC
Reply
Permalink
Hello,
Post by Andrey Rakhmatullin
It's similar but different: I'm talking about workflows to build a package
from the repo (e.g. "gbp with gbp-pq and importing upstream tarballs").
And yeah it could be a metadata field.
Just to note that once people are using tag2upload, this information
will start being recorded on salsa, as a side-effect. I've filed
#1078016 about exposing this information in a machine-readable way.
--
Sean Whitton
Sean Whitton
2024-08-08 00:30:01 UTC
Reply
Permalink
[resending to your correct address]

Hello,
Post by Andrey Rakhmatullin
It's similar but different: I'm talking about workflows to build a package
from the repo (e.g. "gbp with gbp-pq and importing upstream tarballs").
And yeah it could be a metadata field.
Just to note that once people are using tag2upload, this information
will start being recorded on salsa, as a side-effect. I've filed
#1078016 about exposing this information in a machine-readable way.
--
Sean Whitton
Kentaro Hayashi
2024-08-03 12:50:01 UTC
Reply
Permalink
Hi,

Even though +1 for DEP-18 basically, I think that it might be better
to add an option
to formalize package owner's (single person maintainer) collaboration policy
especially about non-team maintained packages under
https://salsa.debian.org/debian/.

If such a package repository enables merge request feature, then I
will send merge request and
send E-mail to bugs.d.o about url of the MR to notify it.
But it is not true that such MR is merged in timely manner.
(Surely collaboration takes longer time, I know.)

If the package owner expresses a collaboration policy in advance, it
can improve such a situation
in a particular case and we can respect it.

NOTE: The following idea might be out-of-scope in DEP-18, but specific
use-case to improve
collaboration in Debian, IMHO.

Here is just an idea: put collaboration policy metadata in debian/control.
(The following idea assumes that non-maintainer DD tend to hesitate to
commit/merge it)

* Collaboration-Policy: debian/CONTRIBUTION.md
Yes, we have README.source already, but it might be better to note
in a separate file about collaboration.
* Collaboration-Policy-Commit: yes
It declares that the package owner encourages non-maintainer DD to
commit directly without merge request.
* Collaboration-Policy-Merge: yes
It declares that the package owner encourages non-maintainer DD to
allow merge requests.
(DD has maintainer right in salsa.d.o by default as you know, but
you can merge without worry if there is it.)
* Collaboration-Policy-LowThresholdNmu: yes
It declares that LowThresholdNmu rule [1] is applied.
* Collabollation-Policy-NMU-Delay: 15
It declares that NMU delay the package owner wants.

[1] https://wiki.debian.org/LowThresholdNmu

Pros:
* DD/DM and contributors can respect the package owner's intent about
the package collaboration.
* Reduce a chance to cause inconsistency between the content of each
package repository on salsa.d.o and NMU'ed package source.
* Because other DD (non package owner) can commit/merge, then ship
NMU package.
Cons:
* Maintainers will be bothered to add that new field to every package
(If there is no Collaboration-Policy, it is safe that sending merge
request and let it the package manager, thus nothing changed)
* No mechanism to enforce Collaboration-Policy-Commit: no or
Collaboration-Policy-Merge: no policy
because DD has maintainer rights on salsa.d.o and can commit/merge
it in reality.

It might worry too much, but it might be able to block an unfortunate
accident, a so-called package hijack
with incomplete communication in some cases.

Regards,
Post by Otto Kekäläinen
Hi all,
I have drafted a new DEP at https://salsa.debian.org/dep-team/deps/-/merge_requests/8 titled "DEP-18: Enable true open collaboration on all Debian packages".
Direct link to raw text: https://salsa.debian.org/dep-team/deps/-/raw/798bfa5a1e1609afd4e48ee20aff80a82bcd4a2f/web/deps/dep18.mdwn
This would have been a great topic to discuss in person at DebConf, but unfortunately I can't attend this year, so I'll just kick this off on the mailing list.
This is continuation to the 'single maintainership' discussions earlier this year. I also think that more unified and open collaboration processes could help decrease maintainer burnout, lower barrier for existing and new maintainers to help with multiple packages, and overall perhaps also improve quality of uploads by having more attention on the source code prior to upload.
If you think this proposal makes sense, please press the thumbs up button.
If you have comments, please share them here or on the draft itself.
Thanks,
Otto
--
Kentaro Hayashi <***@gmail.com>
Kentaro Hayashi
2024-08-03 13:10:01 UTC
Reply
Permalink
Hi, Tobias.

Thank you for kindly advice, I've misunderstood about debian/ namespace.
Please ignore the previous my post. [1]

I felt sorry posting just a noise.

[1] https://lists.debian.org/debian-devel/2024/08/msg00052.html

Regards,
Post by Kentaro Hayashi
Hi,
Even though +1 for DEP-18 basically, I think that it might be better
to add an option
to formalize package owner's (single person maintainer) collaboration policy
especially about non-team maintained packages under
https://salsa.debian.org/debian/.
(...)
Post by Kentaro Hayashi
If such a package repository enables merge request feature, then I
will send merge request and
send E-mail to bugs.d.o about url of the MR to notify it.
But it is not true that such MR is merged in timely manner.
(Surely collaboration takes longer time, I know.)
If the package owner expresses a collaboration policy in advance, it
can improve such a situation
in a particular case and we can respect it.
NOTE: The following idea might be out-of-scope in DEP-18, but specific
use-case to improve
collaboration in Debian, IMHO.
Here is just an idea: put collaboration policy metadata in debian/control.
(The following idea assumes that non-maintainer DD tend to hesitate to
commit/merge it)
* Collaboration-Policy: debian/CONTRIBUTION.md
Yes, we have README.source already, but it might be better to note
in a separate file about collaboration.
* Collaboration-Policy-Commit: yes
It declares that the package owner encourages non-maintainer DD to
commit directly without merge request.
* Collaboration-Policy-Merge: yes
It declares that the package owner encourages non-maintainer DD to
allow merge requests.
(DD has maintainer right in salsa.d.o by default as you know, but
you can merge without worry if there is it.)
* Collaboration-Policy-LowThresholdNmu: yes
It declares that LowThresholdNmu rule [1] is applied.
* Collabollation-Policy-NMU-Delay: 15
It declares that NMU delay the package owner wants.
[1] https://wiki.debian.org/LowThresholdNmu
* DD/DM and contributors can respect the package owner's intent about
the package collaboration.
* Reduce a chance to cause inconsistency between the content of each
package repository on salsa.d.o and NMU'ed package source.
* Because other DD (non package owner) can commit/merge, then ship
NMU package.
* Maintainers will be bothered to add that new field to every package
(If there is no Collaboration-Policy, it is safe that sending merge
request and let it the package manager, thus nothing changed)
* No mechanism to enforce Collaboration-Policy-Commit: no or
Collaboration-Policy-Merge: no policy
because DD has maintainer rights on salsa.d.o and can commit/merge
it in reality.
It might worry too much, but it might be able to block an unfortunate
accident, a so-called package hijack
with incomplete communication in some cases.
by placing a package in the debian namespace on salsa, the packagee is
declared as team maintained by everyone, so above is alrady today
acceptble, even without explict placet by the maintainer.
https://wiki.debian.org/Salsa/Doc#Collaborative_Maintenance:_.22Debian.22_group
--
tobi
--
Kentaro Hayashi <***@gmail.com>
Jonas Smedegaard
2024-08-03 13:20:01 UTC
Reply
Permalink
Quoting Kentaro Hayashi (2024-08-03 14:40:51)
Post by Kentaro Hayashi
Hi,
Even though +1 for DEP-18 basically, I think that it might be better
to add an option
to formalize package owner's (single person maintainer) collaboration policy
especially about non-team maintained packages under
https://salsa.debian.org/debian/.
If such a package repository enables merge request feature, then I
will send merge request and
send E-mail to bugs.d.o about url of the MR to notify it.
But it is not true that such MR is merged in timely manner.
(Surely collaboration takes longer time, I know.)
If the package owner expresses a collaboration policy in advance, it
can improve such a situation
in a particular case and we can respect it.
NOTE: The following idea might be out-of-scope in DEP-18, but specific
use-case to improve
collaboration in Debian, IMHO.
Here is just an idea: put collaboration policy metadata in debian/control.
(The following idea assumes that non-maintainer DD tend to hesitate to
commit/merge it)
* Collaboration-Policy: debian/CONTRIBUTION.md
Yes, we have README.source already, but it might be better to note
in a separate file about collaboration.
* Collaboration-Policy-Commit: yes
It declares that the package owner encourages non-maintainer DD to
commit directly without merge request.
* Collaboration-Policy-Merge: yes
It declares that the package owner encourages non-maintainer DD to
allow merge requests.
(DD has maintainer right in salsa.d.o by default as you know, but
you can merge without worry if there is it.)
* Collaboration-Policy-LowThresholdNmu: yes
It declares that LowThresholdNmu rule [1] is applied.
* Collabollation-Policy-NMU-Delay: 15
It declares that NMU delay the package owner wants.
[1] https://wiki.debian.org/LowThresholdNmu
* DD/DM and contributors can respect the package owner's intent about
the package collaboration.
* Reduce a chance to cause inconsistency between the content of each
package repository on salsa.d.o and NMU'ed package source.
* Because other DD (non package owner) can commit/merge, then ship
NMU package.
* Maintainers will be bothered to add that new field to every package
(If there is no Collaboration-Policy, it is safe that sending merge
request and let it the package manager, thus nothing changed)
* No mechanism to enforce Collaboration-Policy-Commit: no or
Collaboration-Policy-Merge: no policy
because DD has maintainer rights on salsa.d.o and can commit/merge
it in reality.
It might worry too much, but it might be able to block an unfortunate
accident, a so-called package hijack
with incomplete communication in some cases.
What is the core purpose of adding these suggested new metadata fields?

An NMU is non-collaborative - it is a non-maintainer that not only
offers a contribution but bypasses maintainers and issues a release with
the contribution integrated.

It makes sense for me that we have ways for maintainers to communicate
ahead of time, how NMUs are acceptable, because NMUs lack collaboration.

I was under the impression that collaboration was, well, collaborative.
That it was about collaboration between contributors and maintainers.
Am I mistaken, and it is instead about collaboration between
contributors and non-maintainer mentors, which potentially ends in an
NMU?

If not - if it is collaboration with maintainers - then I don't
understand the need for signalling ahead of time how maintainers prefer
to work, as contributors can simply ask the maintainer.


- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Fabio Fantoni
2024-08-03 14:00:02 UTC
Reply
Permalink
Post by Jonas Smedegaard
Quoting Kentaro Hayashi (2024-08-03 14:40:51)
Post by Kentaro Hayashi
Hi,
Even though +1 for DEP-18 basically, I think that it might be better
to add an option
to formalize package owner's (single person maintainer) collaboration policy
especially about non-team maintained packages under
https://salsa.debian.org/debian/.
If such a package repository enables merge request feature, then I
will send merge request and
send E-mail to bugs.d.o about url of the MR to notify it.
But it is not true that such MR is merged in timely manner.
(Surely collaboration takes longer time, I know.)
If the package owner expresses a collaboration policy in advance, it
can improve such a situation
in a particular case and we can respect it.
NOTE: The following idea might be out-of-scope in DEP-18, but specific
use-case to improve
collaboration in Debian, IMHO.
Here is just an idea: put collaboration policy metadata in debian/control.
(The following idea assumes that non-maintainer DD tend to hesitate to
commit/merge it)
* Collaboration-Policy: debian/CONTRIBUTION.md
Yes, we have README.source already, but it might be better to note
in a separate file about collaboration.
* Collaboration-Policy-Commit: yes
It declares that the package owner encourages non-maintainer DD to
commit directly without merge request.
* Collaboration-Policy-Merge: yes
It declares that the package owner encourages non-maintainer DD to
allow merge requests.
(DD has maintainer right in salsa.d.o by default as you know, but
you can merge without worry if there is it.)
* Collaboration-Policy-LowThresholdNmu: yes
It declares that LowThresholdNmu rule [1] is applied.
* Collabollation-Policy-NMU-Delay: 15
It declares that NMU delay the package owner wants.
[1] https://wiki.debian.org/LowThresholdNmu
* DD/DM and contributors can respect the package owner's intent about
the package collaboration.
* Reduce a chance to cause inconsistency between the content of each
package repository on salsa.d.o and NMU'ed package source.
* Because other DD (non package owner) can commit/merge, then ship
NMU package.
* Maintainers will be bothered to add that new field to every package
(If there is no Collaboration-Policy, it is safe that sending merge
request and let it the package manager, thus nothing changed)
* No mechanism to enforce Collaboration-Policy-Commit: no or
Collaboration-Policy-Merge: no policy
because DD has maintainer rights on salsa.d.o and can commit/merge
it in reality.
It might worry too much, but it might be able to block an unfortunate
accident, a so-called package hijack
with incomplete communication in some cases.
What is the core purpose of adding these suggested new metadata fields?
An NMU is non-collaborative - it is a non-maintainer that not only
offers a contribution but bypasses maintainers and issues a release with
the contribution integrated.
It makes sense for me that we have ways for maintainers to communicate
ahead of time, how NMUs are acceptable, because NMUs lack collaboration.
I was under the impression that collaboration was, well, collaborative.
That it was about collaboration between contributors and maintainers.
Am I mistaken, and it is instead about collaboration between
contributors and non-maintainer mentors, which potentially ends in an
NMU?
If not - if it is collaboration with maintainers - then I don't
understand the need for signalling ahead of time how maintainers prefer
to work, as contributors can simply ask the maintainer.
there is a purpose and that is what I was trying to explain in a part of
one of my emails: to have certain information on how to contribute in a
simple and fast way, without having to write emails to which you might
never receive a reply, or after days or even weeks

so you can instead immediately proceed to contribute in the preferred
methods indicated and even if there is no response

less emails to answer from maintainers and instead spend that time
analyzing the contributions received (maybe more likely as he or his
team prefers)

more chance of contributions, rather than maybe sending an email to the
maintainer, waiting and since he doesn't respond you think it's useless
to contribute there and you avoid it (in some packages where I wanted to
contribute occasionally I ended up doing that). once there are
contributions there is a greater chance that they will be made NMU by DD
(especially if RC), if already mostly ready, more chance that they will
be used by other DD in case of team packages, or possibly by
contributors trying to save an abandoned package, and these are some
examples that come to mind
Post by Jonas Smedegaard
- Jonas
Tobias Frost
2024-08-03 13:20:01 UTC
Reply
Permalink
Post by Kentaro Hayashi
Hi,
Even though +1 for DEP-18 basically, I think that it might be better
to add an option
to formalize package owner's (single person maintainer) collaboration policy
especially about non-team maintained packages under
https://salsa.debian.org/debian/.
(...)
Post by Kentaro Hayashi
If such a package repository enables merge request feature, then I
will send merge request and
send E-mail to bugs.d.o about url of the MR to notify it.
But it is not true that such MR is merged in timely manner.
(Surely collaboration takes longer time, I know.)
If the package owner expresses a collaboration policy in advance, it
can improve such a situation
in a particular case and we can respect it.
NOTE: The following idea might be out-of-scope in DEP-18, but specific
use-case to improve
collaboration in Debian, IMHO.
Here is just an idea: put collaboration policy metadata in debian/control.
(The following idea assumes that non-maintainer DD tend to hesitate to
commit/merge it)
* Collaboration-Policy: debian/CONTRIBUTION.md
Yes, we have README.source already, but it might be better to note
in a separate file about collaboration.
* Collaboration-Policy-Commit: yes
It declares that the package owner encourages non-maintainer DD to
commit directly without merge request.
* Collaboration-Policy-Merge: yes
It declares that the package owner encourages non-maintainer DD to
allow merge requests.
(DD has maintainer right in salsa.d.o by default as you know, but
you can merge without worry if there is it.)
* Collaboration-Policy-LowThresholdNmu: yes
It declares that LowThresholdNmu rule [1] is applied.
* Collabollation-Policy-NMU-Delay: 15
It declares that NMU delay the package owner wants.
[1] https://wiki.debian.org/LowThresholdNmu
* DD/DM and contributors can respect the package owner's intent about
the package collaboration.
* Reduce a chance to cause inconsistency between the content of each
package repository on salsa.d.o and NMU'ed package source.
* Because other DD (non package owner) can commit/merge, then ship
NMU package.
* Maintainers will be bothered to add that new field to every package
(If there is no Collaboration-Policy, it is safe that sending merge
request and let it the package manager, thus nothing changed)
* No mechanism to enforce Collaboration-Policy-Commit: no or
Collaboration-Policy-Merge: no policy
because DD has maintainer rights on salsa.d.o and can commit/merge
it in reality.
It might worry too much, but it might be able to block an unfortunate
accident, a so-called package hijack
with incomplete communication in some cases.
by placing a package in the debian namespace on salsa, the packagee is
declared as team maintained by everyone, so above is alrady today
acceptble, even without explict placet by the maintainer.

https://wiki.debian.org/Salsa/Doc#Collaborative_Maintenance:_.22Debian.22_group
--
tobi
Fabio Fantoni
2024-08-03 13:40:01 UTC
Reply
Permalink
Post by Kentaro Hayashi
Hi,
Even though +1 for DEP-18 basically, I think that it might be better
to add an option
to formalize package owner's (single person maintainer) collaboration policy
especially about non-team maintained packages under
https://salsa.debian.org/debian/.
If such a package repository enables merge request feature, then I
will send merge request and
send E-mail to bugs.d.o about url of the MR to notify it.
But it is not true that such MR is merged in timely manner.
(Surely collaboration takes longer time, I know.)
If the package owner expresses a collaboration policy in advance, it
can improve such a situation
in a particular case and we can respect it.
NOTE: The following idea might be out-of-scope in DEP-18, but specific
use-case to improve
collaboration in Debian, IMHO.
Here is just an idea: put collaboration policy metadata in debian/control.
(The following idea assumes that non-maintainer DD tend to hesitate to
commit/merge it)
* Collaboration-Policy: debian/CONTRIBUTION.md
Yes, we have README.source already, but it might be better to note
in a separate file about collaboration.
* Collaboration-Policy-Commit: yes
It declares that the package owner encourages non-maintainer DD to
commit directly without merge request.
* Collaboration-Policy-Merge: yes
It declares that the package owner encourages non-maintainer DD to
allow merge requests.
(DD has maintainer right in salsa.d.o by default as you know, but
you can merge without worry if there is it.)
* Collaboration-Policy-LowThresholdNmu: yes
It declares that LowThresholdNmu rule [1] is applied.
* Collabollation-Policy-NMU-Delay: 15
It declares that NMU delay the package owner wants.
[1] https://wiki.debian.org/LowThresholdNmu
* DD/DM and contributors can respect the package owner's intent about
the package collaboration.
* Reduce a chance to cause inconsistency between the content of each
package repository on salsa.d.o and NMU'ed package source.
* Because other DD (non package owner) can commit/merge, then ship
NMU package.
* Maintainers will be bothered to add that new field to every package
(If there is no Collaboration-Policy, it is safe that sending merge
request and let it the package manager, thus nothing changed)
* No mechanism to enforce Collaboration-Policy-Commit: no or
Collaboration-Policy-Merge: no policy
because DD has maintainer rights on salsa.d.o and can commit/merge
it in reality.
It might worry too much, but it might be able to block an unfortunate
accident, a so-called package hijack
with incomplete communication in some cases.
Hi, this I think is can be useful (beyond the example use of
salsa/debian packages which is not necessary as replied by Tobias
Frost), I think will be better with only one additional (and optional)
field in d/control, like Collaboration-Policy that point a file or url,
this I think that can decrease the possible annoyance and in the case of
teams or even single maintainers having a single policy file to point to
and update in a simpler and faster way (especially if there were the
same policies for dozens of packages or more, there could be also
hundreds or thousands)

Also the local file or via url to which it points I think should have
both predefined and machine readable fields and the possibility of
having other text or other links for further details

as an additional field I think it is useful to add one regarding the
preferred method for contributing, patches on bugtracker (if there were
those who would prefer to continue on those even if DEP-18 recommended
salsa), or via vcs (be it MR on salsa, PR on github etc.) depending on
what you use, or both (if both are welcome)

alternatively to not have an extra field in d/control simply use
debian/CONTRIBUTION.md, if it exists and if you want to do it in a
simple/fast way with a single one on many packages pointing to the url
insert there a single machine readable case that points to the url that
would have been put in d/control instead
Post by Kentaro Hayashi
Regards,
Post by Otto Kekäläinen
Hi all,
I have drafted a new DEP at https://salsa.debian.org/dep-team/deps/-/merge_requests/8 titled "DEP-18: Enable true open collaboration on all Debian packages".
Direct link to raw text: https://salsa.debian.org/dep-team/deps/-/raw/798bfa5a1e1609afd4e48ee20aff80a82bcd4a2f/web/deps/dep18.mdwn
This would have been a great topic to discuss in person at DebConf, but unfortunately I can't attend this year, so I'll just kick this off on the mailing list.
This is continuation to the 'single maintainership' discussions earlier this year. I also think that more unified and open collaboration processes could help decrease maintainer burnout, lower barrier for existing and new maintainers to help with multiple packages, and overall perhaps also improve quality of uploads by having more attention on the source code prior to upload.
If you think this proposal makes sense, please press the thumbs up button.
If you have comments, please share them here or on the draft itself.
Thanks,
Otto
Jonas Smedegaard
2024-08-03 14:10:01 UTC
Reply
Permalink
Quoting Fabio Fantoni (2024-08-03 15:39:00)
Post by Fabio Fantoni
Post by Kentaro Hayashi
Hi,
Even though +1 for DEP-18 basically, I think that it might be better
to add an option
to formalize package owner's (single person maintainer) collaboration policy
especially about non-team maintained packages under
https://salsa.debian.org/debian/.
If such a package repository enables merge request feature, then I
will send merge request and
send E-mail to bugs.d.o about url of the MR to notify it.
But it is not true that such MR is merged in timely manner.
(Surely collaboration takes longer time, I know.)
If the package owner expresses a collaboration policy in advance, it
can improve such a situation
in a particular case and we can respect it.
NOTE: The following idea might be out-of-scope in DEP-18, but specific
use-case to improve
collaboration in Debian, IMHO.
Here is just an idea: put collaboration policy metadata in debian/control.
(The following idea assumes that non-maintainer DD tend to hesitate to
commit/merge it)
* Collaboration-Policy: debian/CONTRIBUTION.md
Yes, we have README.source already, but it might be better to note
in a separate file about collaboration.
* Collaboration-Policy-Commit: yes
It declares that the package owner encourages non-maintainer DD to
commit directly without merge request.
* Collaboration-Policy-Merge: yes
It declares that the package owner encourages non-maintainer DD to
allow merge requests.
(DD has maintainer right in salsa.d.o by default as you know, but
you can merge without worry if there is it.)
* Collaboration-Policy-LowThresholdNmu: yes
It declares that LowThresholdNmu rule [1] is applied.
* Collabollation-Policy-NMU-Delay: 15
It declares that NMU delay the package owner wants.
[1] https://wiki.debian.org/LowThresholdNmu
* DD/DM and contributors can respect the package owner's intent about
the package collaboration.
* Reduce a chance to cause inconsistency between the content of each
package repository on salsa.d.o and NMU'ed package source.
* Because other DD (non package owner) can commit/merge, then ship
NMU package.
* Maintainers will be bothered to add that new field to every package
(If there is no Collaboration-Policy, it is safe that sending merge
request and let it the package manager, thus nothing changed)
* No mechanism to enforce Collaboration-Policy-Commit: no or
Collaboration-Policy-Merge: no policy
because DD has maintainer rights on salsa.d.o and can commit/merge
it in reality.
It might worry too much, but it might be able to block an unfortunate
accident, a so-called package hijack
with incomplete communication in some cases.
Hi, this I think is can be useful (beyond the example use of
salsa/debian packages which is not necessary as replied by Tobias
Frost), I think will be better with only one additional (and optional)
field in d/control, like Collaboration-Policy that point a file or url,
this I think that can decrease the possible annoyance and in the case of
teams or even single maintainers having a single policy file to point to
and update in a simpler and faster way (especially if there were the
same policies for dozens of packages or more, there could be also
hundreds or thousands)
What annoyance are you referring to?

Are some new contributors annoyed by the lack of formalized rules for
collaboration?

Are some maintainers annoyed by how some new contributors initiate
collaborative contributions?

As a maintainer, I can imagine getting annoyed by *non-collaborative*
contributions done in ways that I feel leaves an extra burden on me.
One description for that is "drive-by contributions", meaning that
someone contributes without having the time to *collaborate* on it,
to align the contribution with how the package is maintained.
But since this whole thread is about "true open collaboration", I
assume that you are talking about *collaborative* work, and then I
cannot recognize what is the kind of annoyance you are referring to.


Kind regards,

- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Fabio Fantoni
2024-08-03 14:50:01 UTC
Reply
Permalink
Post by Jonas Smedegaard
Quoting Fabio Fantoni (2024-08-03 15:39:00)
Post by Fabio Fantoni
Post by Kentaro Hayashi
Hi,
Even though +1 for DEP-18 basically, I think that it might be better
to add an option
to formalize package owner's (single person maintainer) collaboration policy
especially about non-team maintained packages under
https://salsa.debian.org/debian/.
If such a package repository enables merge request feature, then I
will send merge request and
send E-mail to bugs.d.o about url of the MR to notify it.
But it is not true that such MR is merged in timely manner.
(Surely collaboration takes longer time, I know.)
If the package owner expresses a collaboration policy in advance, it
can improve such a situation
in a particular case and we can respect it.
NOTE: The following idea might be out-of-scope in DEP-18, but specific
use-case to improve
collaboration in Debian, IMHO.
Here is just an idea: put collaboration policy metadata in debian/control.
(The following idea assumes that non-maintainer DD tend to hesitate to
commit/merge it)
* Collaboration-Policy: debian/CONTRIBUTION.md
Yes, we have README.source already, but it might be better to note
in a separate file about collaboration.
* Collaboration-Policy-Commit: yes
It declares that the package owner encourages non-maintainer DD to
commit directly without merge request.
* Collaboration-Policy-Merge: yes
It declares that the package owner encourages non-maintainer DD to
allow merge requests.
(DD has maintainer right in salsa.d.o by default as you know, but
you can merge without worry if there is it.)
* Collaboration-Policy-LowThresholdNmu: yes
It declares that LowThresholdNmu rule [1] is applied.
* Collabollation-Policy-NMU-Delay: 15
It declares that NMU delay the package owner wants.
[1] https://wiki.debian.org/LowThresholdNmu
* DD/DM and contributors can respect the package owner's intent about
the package collaboration.
* Reduce a chance to cause inconsistency between the content of each
package repository on salsa.d.o and NMU'ed package source.
* Because other DD (non package owner) can commit/merge, then ship
NMU package.
* Maintainers will be bothered to add that new field to every package
(If there is no Collaboration-Policy, it is safe that sending merge
request and let it the package manager, thus nothing changed)
* No mechanism to enforce Collaboration-Policy-Commit: no or
Collaboration-Policy-Merge: no policy
because DD has maintainer rights on salsa.d.o and can commit/merge
it in reality.
It might worry too much, but it might be able to block an unfortunate
accident, a so-called package hijack
with incomplete communication in some cases.
Hi, this I think is can be useful (beyond the example use of
salsa/debian packages which is not necessary as replied by Tobias
Frost), I think will be better with only one additional (and optional)
field in d/control, like Collaboration-Policy that point a file or url,
this I think that can decrease the possible annoyance and in the case of
teams or even single maintainers having a single policy file to point to
and update in a simpler and faster way (especially if there were the
same policies for dozens of packages or more, there could be also
hundreds or thousands)
What annoyance are you referring to?
annoyance maintainers for update it on many package, with a url that
point to an external file can be update once for even on tens, hundreds
or more packages it could be set on
Post by Jonas Smedegaard
Are some new contributors annoyed by the lack of formalized rules for
collaboration?
not only new but also any contributors that want to contribute on other
package, also about that I tried to explain something in one of my
previous mail
Post by Jonas Smedegaard
Are some maintainers annoyed by how some new contributors initiate
collaborative contributions?
I don't know how likely it is, I hope it's very rare
Post by Jonas Smedegaard
As a maintainer, I can imagine getting annoyed by *non-collaborative*
contributions done in ways that I feel leaves an extra burden on me.
One description for that is "drive-by contributions", meaning that
someone contributes without having the time to *collaborate* on it,
to align the contribution with how the package is maintained.
But since this whole thread is about "true open collaboration", I
assume that you are talking about *collaborative* work, and then I
cannot recognize what is the kind of annoyance you are referring to.
There is a lot of other information that may vary on how to contribute
in certain packages or teams beyond what is already listed, here only
some example:

Debian Python Team -
https://salsa.debian.org/python-team/tools/python-modules/blob/master/policy.rst

Java team - https://www.debian.org/doc/packaging-manuals/java-policy/

Rust team - https://wiki.debian.org/Teams/RustPackaging

go team - https://go-team.pages.debian.net/packaging.html
Post by Jonas Smedegaard
Kind regards,
- Jonas
Jonas Smedegaard
2024-08-03 16:40:01 UTC
Reply
Permalink
Quoting Fabio Fantoni (2024-08-03 16:45:24)
Post by Fabio Fantoni
Post by Jonas Smedegaard
Quoting Fabio Fantoni (2024-08-03 15:39:00)
Post by Fabio Fantoni
Post by Kentaro Hayashi
Hi,
Even though +1 for DEP-18 basically, I think that it might be better
to add an option
to formalize package owner's (single person maintainer) collaboration policy
especially about non-team maintained packages under
https://salsa.debian.org/debian/.
If such a package repository enables merge request feature, then I
will send merge request and
send E-mail to bugs.d.o about url of the MR to notify it.
But it is not true that such MR is merged in timely manner.
(Surely collaboration takes longer time, I know.)
If the package owner expresses a collaboration policy in advance, it
can improve such a situation
in a particular case and we can respect it.
NOTE: The following idea might be out-of-scope in DEP-18, but specific
use-case to improve
collaboration in Debian, IMHO.
Here is just an idea: put collaboration policy metadata in debian/control.
(The following idea assumes that non-maintainer DD tend to hesitate to
commit/merge it)
* Collaboration-Policy: debian/CONTRIBUTION.md
Yes, we have README.source already, but it might be better to note
in a separate file about collaboration.
* Collaboration-Policy-Commit: yes
It declares that the package owner encourages non-maintainer DD to
commit directly without merge request.
* Collaboration-Policy-Merge: yes
It declares that the package owner encourages non-maintainer DD to
allow merge requests.
(DD has maintainer right in salsa.d.o by default as you know, but
you can merge without worry if there is it.)
* Collaboration-Policy-LowThresholdNmu: yes
It declares that LowThresholdNmu rule [1] is applied.
* Collabollation-Policy-NMU-Delay: 15
It declares that NMU delay the package owner wants.
[1] https://wiki.debian.org/LowThresholdNmu
* DD/DM and contributors can respect the package owner's intent about
the package collaboration.
* Reduce a chance to cause inconsistency between the content of each
package repository on salsa.d.o and NMU'ed package source.
* Because other DD (non package owner) can commit/merge, then ship
NMU package.
* Maintainers will be bothered to add that new field to every package
(If there is no Collaboration-Policy, it is safe that sending merge
request and let it the package manager, thus nothing changed)
* No mechanism to enforce Collaboration-Policy-Commit: no or
Collaboration-Policy-Merge: no policy
because DD has maintainer rights on salsa.d.o and can commit/merge
it in reality.
It might worry too much, but it might be able to block an unfortunate
accident, a so-called package hijack
with incomplete communication in some cases.
Hi, this I think is can be useful (beyond the example use of
salsa/debian packages which is not necessary as replied by Tobias
Frost), I think will be better with only one additional (and optional)
field in d/control, like Collaboration-Policy that point a file or url,
this I think that can decrease the possible annoyance and in the case of
teams or even single maintainers having a single policy file to point to
and update in a simpler and faster way (especially if there were the
same policies for dozens of packages or more, there could be also
hundreds or thousands)
What annoyance are you referring to?
annoyance maintainers for update it on many package, with a url that
point to an external file can be update once for even on tens, hundreds
or more packages it could be set on
Post by Jonas Smedegaard
Are some new contributors annoyed by the lack of formalized rules for
collaboration?
not only new but also any contributors that want to contribute on other
package, also about that I tried to explain something in one of my
previous mail
Post by Jonas Smedegaard
Are some maintainers annoyed by how some new contributors initiate
collaborative contributions?
I don't know how likely it is, I hope it's very rare
Post by Jonas Smedegaard
As a maintainer, I can imagine getting annoyed by *non-collaborative*
contributions done in ways that I feel leaves an extra burden on me.
One description for that is "drive-by contributions", meaning that
someone contributes without having the time to *collaborate* on it,
to align the contribution with how the package is maintained.
But since this whole thread is about "true open collaboration", I
assume that you are talking about *collaborative* work, and then I
cannot recognize what is the kind of annoyance you are referring to.
There is a lot of other information that may vary on how to contribute
in certain packages or teams beyond what is already listed, here only
Debian Python Team -
https://salsa.debian.org/python-team/tools/python-modules/blob/master/policy.rst
Java team - https://www.debian.org/doc/packaging-manuals/java-policy/
Rust team - https://wiki.debian.org/Teams/RustPackaging
go team - https://go-team.pages.debian.net/packaging.html
My understanding now, about the purpose of the suggested set of metadata
fields, is that it is to reduce annoyance for contributors: Be able to
read how a maintainer prefer to collaborate without needing to ask,
because asking involves waiting for the maintainer to respond.

I hope I understood that correctly - otherwise please do correct me.

Thank you for clarifying.

- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Otto Kekäläinen
2024-08-28 02:20:01 UTC
Reply
Permalink
Hi!

While I intend to continue on iterating DEP-18, here is a summary to
those who did not wade through the 140+ messages on the topic.
Unfortunately, the summary itself is also a bit long :)


********************************************************************************
Summary of mailing list discussion in
https://lists.debian.org/debian-devel/2024/07/msg00429.html

## Overall Sentiment

There was a broad consensus that Debian workflows are too fractured
and would benefit from more standardization and unification. However,
there were differing opinions on the right approach to achieve this.
1. Debian workflows are too fractured. The project would be better if we asked people to standardize around a single (or a small number) of workflows. To do so, the workflow would need to be flexible enough to handle the wide range of technical needs of all the packages and upstream configurations.
2. Standardizing around a single (or small number of) workflows wil make some people unhappy. But that is an acceptable price to pay because of the general benefit to the project as long as the correct solution is adopted. Unity is more important than minority opinions on this particular issue.
Similarly, Andrey Rakhmatullin argued that while some may resign, "the
'1000 DDs status quo' problem also means that more people leave than
join _anyway_. Not the unity per se, but having significantly lower
barriers to start contributing" is important.

## Git and Gitlab Usage

Multiple participants noted that most other Linux distributions use
Git as the primary version control system, often with GitLab or GitHub
for collaboration. Debian's multi-branch approach with pristine-tar
was seen as somewhat unique.

There were differing views on whether Debian should move closer to the
more common Git-based workflows used elsewhere, or maintain its own
custom approach, which of git-buildpackage and dgit are the most
common ones (both with multiple ways to use them).

## Mandatory vs Optional Policies

Some participants, like Salvo Tomaselli, felt DEP-18 was too
prescriptive in mandating specific tools and workflows, and that a
Keep in mind that unhappy people quit. I don't think that unity is so important that we're willing to sacrifice project members.
Others, including Soren Stoutner, argued that standardization was
important, even if it made some people initially unhappy, as long as
the right solution was adopted: "Unity is more important than minority
opinions on this particular issue."

## Maintainer Workflows

There were concerns that requiring specific Git and Gitlab practices
could create burdens for existing maintainers, especially
single-person maintainers. Sean Whitton described his own preferences
I am happy to use salsa for git hosting and access management. I love that I can easily grant push access to my non-DD team members. But, I turn off salsa MRs for the repos of all packages I regularly upload. I would hope that this DEP can be written such as to account for these sorts of choices. Fabio Fantoni suggested allowing maintainers to specify their preferred collaboration methods in a machine-readable way, for example through a "Collaboration-Policy" field in debian/control.
## Performance and Reliability

Multiple participants, including Salvo Tomaselli, Johannes Schauer
Marin Rodrigues, Andrea Pappacoda, and Gioele Barabucci, complained
about Salsa/GitLab being slow or unreliable at times, which deterred
contribution. Improvements to performance and uptime were seen as
important. In response, Otto Kekäläinen noted that the Salsa admins
had posted about upcoming hardware upgrades and other improvements to
address these issues at
https://salsa.debian.org/salsa/support/-/issues.

## Machine-Readable Metadata

Fabio Fantoni and Niels Thykier proposed including more
machine-readable metadata about packaging workflows (e.g. in
debian/control) to help automate contributor onboarding. Niels Thykier
Does this package use `gbp dch` (or some other mechanisms) to generate the changelog OR should I include a changelog entry with my patch. Does this package use some form of automatic formatting that I should apply when I do my changes (if `wrap-and-sort`, then which options)? Does the maintainer prefer MR via salsa or BTS with patches for when I want to submit my changes for review.
## Overall

There seemed to be general agreement that improving collaboration was
important, but the right approach was still being debated.

## Mailing list participants

- Jonas Smedegaard
- Salvo Tomaselli
- Luca Boccassi
- Charles Plessy
- Marco d'Itri
- Sean Whitton
- Marc Haber
- Jeremy Stanley
- Shengjing Zhu
- Noah Meyerhans
- PICCA Frederic-Emmanuel
- Fabio Fantoni
- Kentaro Hayashi
- Tobias Frost
- Gioele Barabucci
- Blair Noctis
- Andrea Pappacoda
- Soren Stoutner
- Andrey Rakhmatullin
- Paul Gevers
- Niels Thykier
- Simon Richter
- Chris Hofstaedtler
- Johannes Schauer Marin Rodrigues


********************************************************************************
Summary of the 70+ comments in this
https://salsa.debian.org/dep-team/deps/-/merge_requests/8

There were some differing viewpoints on this many parts of the
proposal, but also lots of support.

**Opposition to using Salsa/GitLab:**

* mirabilos strongly opposed using Salsa, stating "Salsa is inherently
a nōn-free tool...I strongly believe forcing people on GitLab is an
SC/DFSG violation."
* Joachim Zobel had the opposite view of caring purely about usability
and asking "Why is maintaining a Debian package on GitHub against
DEP-18?"
* Salsa could be viewed as a middle ground between the above options.
* Helmut Grohne raised concerns about lack of consensus, saying "Given
that there are at least two competing hosting options with similar
adoption, I question the unilateral choice of one of them."

**Concerns around merge request process:**

* Louis-Philippe Véronneau pointed out "MRs really don't work well
with some of the current git workflows...reviewing such contributions
is a ton of work."
* Simon Richter argued "The entire DEP except for this paragraph very
carefully avoids making any technical recommendation...If this DEP
should be useful at all, it needs to make a technical contribution."
* A future version needs to list examples of packages that have
reviews before upload to paint a picture how it works in practice (and
that it is doable)

**Support for using GitLab/Salsa:**

* Guido Günther said "Fragmentation...is an issue so recommending
salsa makes a lot of sense from Debian's PoV."
* Andreas Tille stated "We simply loose people who are frustrated that
its impossible to do Debian wide changes easily...Its simply not
sufficient for say running Janitor like tools on random Vcs locations
outside Salsa."
* Blair Noctis argued "At this stage of the free software movement
we...need more hands to compete with non-free things...Machines and
tools should adapt to people, not the other way around."

**Other viewpoints:**

* Chris Hofstaedtler asked "Please provide a clear definition of what
this DEP wants to achieve. Right now it lives off a headline of "true
open collaboration" without defining that."
* Bastian Venthur noted "DEP-14 is not accepted yet, but in the
candidate state since 2020."
* The discussion surfaced well what are the shared pain points in the
packaging workflow beyond just collaboration struggles. Work should
also continue on DEP-14, git-buildpackage, Salsa CI and other tools to
decrease the general friction, and in many places simple documentation
updates/overhaul is due to avoid unnecessary fragmentation in
workflows that isn't intentional so that we later can more clearly
focus on discussion the pros and cons of the intentionally different
workflows.
Fabio Fantoni
2024-08-28 17:00:02 UTC
Reply
Permalink
Post by Otto Kekäläinen
Hi!
While I intend to continue on iterating DEP-18, here is a summary to
those who did not wade through the 140+ messages on the topic.
Unfortunately, the summary itself is also a bit long :)
Big thanks for your work and of other people that are trying to improve
contribution and collaboration in Debian.
Post by Otto Kekäläinen
## Maintainer Workflows
There were concerns that requiring specific Git and Gitlab practices
could create burdens for existing maintainers, especially
single-person maintainers. Sean Whitton described his own preferences
I am happy to use salsa for git hosting and access management. I love that I can easily grant push access to my non-DD team members. But, I turn off salsa MRs for the repos of all packages I regularly upload. I would hope that this DEP can be written such as to account for these sorts of choices. Fabio Fantoni suggested allowing maintainers to specify their preferred collaboration methods in a machine-readable way, for example through a "Collaboration-Policy" field in debian/control.
As pointed by other people there is debian/README.source that can be
used for that.

So if don't want to add a new field/s to d/control, and/or a new file we
could simply use that one making this thing more known. and in the case
of teams or people who manage many packages (even hundreds or thousands)
with the same methods could put a link in d/README.source so as to point
to a single page/site/repository to keep updated in a simpler and faster
way with all the information
Post by Otto Kekäläinen
## Performance and Reliability
Multiple participants, including Salvo Tomaselli, Johannes Schauer
Marin Rodrigues, Andrea Pappacoda, and Gioele Barabucci, complained
about Salsa/GitLab being slow or unreliable at times, which deterred
contribution. Improvements to performance and uptime were seen as
important. In response, Otto KekÀlÀinen noted that the Salsa admins
had posted about upcoming hardware upgrades and other improvements to
address these issues at
https://salsa.debian.org/salsa/support/-/issues.
Thanks for working to improving Salsa.

However, there have also been numerous performance problems and
unavailability of other parts useful to both contributors and users, in
particular packages.debian.org and wiki.debian.org which don't seems has
been considered, or am I wrong?
Post by Otto Kekäläinen
## Machine-Readable Metadata
Fabio Fantoni and Niels Thykier proposed including more
machine-readable metadata about packaging workflows (e.g. in
debian/control) to help automate contributor onboarding. Niels Thykier
Does this package use `gbp dch` (or some other mechanisms) to generate the changelog OR should I include a changelog entry with my patch. Does this package use some form of automatic formatting that I should apply when I do my changes (if `wrap-and-sort`, then which options)? Does the maintainer prefer MR via salsa or BTS with patches for when I want to submit my changes for review.
Even if don't want to add them as Machine-Readable Metadata, I think can
put them at least in debian/README.source (more details above), I think
the important thing would be to advise maintainers more to make such
information easily available.
Otto Kekäläinen
2024-11-18 00:10:01 UTC
Reply
Permalink
Hi all,

I published a complete rewrite of the earlier draft as:

https://salsa.debian.org/dep-team/deps/-/merge_requests/12
DEP-18: Encourage Continuous Integration and Merge Request
based Collaboration for Debian packages

If you are in favor of having this as a DRAFT in the DEP directory,
please give it a thumbs up.

Summary of previous discussion below, but an even better summary was
written by LWN in https://lwn.net/Articles/986480/

Related to Salsa in general, I heard we have now new and faster
hardware (thanks Salsa Admins!), and related to Salsa CI there is also
an overhauled README
(https://salsa.debian.org/salsa-ci-team/pipeline/-/blob/master/README.md)
and lots of fixes by 7 different authors. I think a lot of people have
also practiced more code reviews and tested the Merge Request feature
on Salsa than before. Overall, I think we are on a good path to
evolving this way of working, and hopefully doing it in a way that it
does not stifle work for maintainers who prefer to continue their
single-maintainer habits, so nobody feels at loss.
Post by Otto Kekäläinen
Hi!
While I intend to continue on iterating DEP-18, here is a summary to
those who did not wade through the 140+ messages on the topic.
Unfortunately, the summary itself is also a bit long :)
********************************************************************************
Summary of mailing list discussion in
https://lists.debian.org/debian-devel/2024/07/msg00429.html
## Overall Sentiment
There was a broad consensus that Debian workflows are too fractured
and would benefit from more standardization and unification. However,
there were differing opinions on the right approach to achieve this.
1. Debian workflows are too fractured. The project would be better if we asked people to standardize around a single (or a small number) of workflows. To do so, the workflow would need to be flexible enough to handle the wide range of technical needs of all the packages and upstream configurations.
2. Standardizing around a single (or small number of) workflows wil make some people unhappy. But that is an acceptable price to pay because of the general benefit to the project as long as the correct solution is adopted. Unity is more important than minority opinions on this particular issue.
Similarly, Andrey Rakhmatullin argued that while some may resign, "the
'1000 DDs status quo' problem also means that more people leave than
join _anyway_. Not the unity per se, but having significantly lower
barriers to start contributing" is important.
## Git and Gitlab Usage
Multiple participants noted that most other Linux distributions use
Git as the primary version control system, often with GitLab or GitHub
for collaboration. Debian's multi-branch approach with pristine-tar
was seen as somewhat unique.
There were differing views on whether Debian should move closer to the
more common Git-based workflows used elsewhere, or maintain its own
custom approach, which of git-buildpackage and dgit are the most
common ones (both with multiple ways to use them).
## Mandatory vs Optional Policies
Some participants, like Salvo Tomaselli, felt DEP-18 was too
prescriptive in mandating specific tools and workflows, and that a
Keep in mind that unhappy people quit. I don't think that unity is so important that we're willing to sacrifice project members.
Others, including Soren Stoutner, argued that standardization was
important, even if it made some people initially unhappy, as long as
the right solution was adopted: "Unity is more important than minority
opinions on this particular issue."
## Maintainer Workflows
There were concerns that requiring specific Git and Gitlab practices
could create burdens for existing maintainers, especially
single-person maintainers. Sean Whitton described his own preferences
I am happy to use salsa for git hosting and access management. I love that I can easily grant push access to my non-DD team members. But, I turn off salsa MRs for the repos of all packages I regularly upload. I would hope that this DEP can be written such as to account for these sorts of choices. Fabio Fantoni suggested allowing maintainers to specify their preferred collaboration methods in a machine-readable way, for example through a "Collaboration-Policy" field in debian/control.
## Performance and Reliability
Multiple participants, including Salvo Tomaselli, Johannes Schauer
Marin Rodrigues, Andrea Pappacoda, and Gioele Barabucci, complained
about Salsa/GitLab being slow or unreliable at times, which deterred
contribution. Improvements to performance and uptime were seen as
important. In response, Otto Kekäläinen noted that the Salsa admins
had posted about upcoming hardware upgrades and other improvements to
address these issues at
https://salsa.debian.org/salsa/support/-/issues.
## Machine-Readable Metadata
Fabio Fantoni and Niels Thykier proposed including more
machine-readable metadata about packaging workflows (e.g. in
debian/control) to help automate contributor onboarding. Niels Thykier
Does this package use `gbp dch` (or some other mechanisms) to generate the changelog OR should I include a changelog entry with my patch. Does this package use some form of automatic formatting that I should apply when I do my changes (if `wrap-and-sort`, then which options)? Does the maintainer prefer MR via salsa or BTS with patches for when I want to submit my changes for review.
## Overall
There seemed to be general agreement that improving collaboration was
important, but the right approach was still being debated.
## Mailing list participants
- Jonas Smedegaard
- Salvo Tomaselli
- Luca Boccassi
- Charles Plessy
- Marco d'Itri
- Sean Whitton
- Marc Haber
- Jeremy Stanley
- Shengjing Zhu
- Noah Meyerhans
- PICCA Frederic-Emmanuel
- Fabio Fantoni
- Kentaro Hayashi
- Tobias Frost
- Gioele Barabucci
- Blair Noctis
- Andrea Pappacoda
- Soren Stoutner
- Andrey Rakhmatullin
- Paul Gevers
- Niels Thykier
- Simon Richter
- Chris Hofstaedtler
- Johannes Schauer Marin Rodrigues
********************************************************************************
Summary of the 70+ comments in this
https://salsa.debian.org/dep-team/deps/-/merge_requests/8
There were some differing viewpoints on this many parts of the
proposal, but also lots of support.
**Opposition to using Salsa/GitLab:**
* mirabilos strongly opposed using Salsa, stating "Salsa is inherently
a nōn-free tool...I strongly believe forcing people on GitLab is an
SC/DFSG violation."
* Joachim Zobel had the opposite view of caring purely about usability
and asking "Why is maintaining a Debian package on GitHub against
DEP-18?"
* Salsa could be viewed as a middle ground between the above options.
* Helmut Grohne raised concerns about lack of consensus, saying "Given
that there are at least two competing hosting options with similar
adoption, I question the unilateral choice of one of them."
**Concerns around merge request process:**
* Louis-Philippe Véronneau pointed out "MRs really don't work well
with some of the current git workflows...reviewing such contributions
is a ton of work."
* Simon Richter argued "The entire DEP except for this paragraph very
carefully avoids making any technical recommendation...If this DEP
should be useful at all, it needs to make a technical contribution."
* A future version needs to list examples of packages that have
reviews before upload to paint a picture how it works in practice (and
that it is doable)
**Support for using GitLab/Salsa:**
* Guido Günther said "Fragmentation...is an issue so recommending
salsa makes a lot of sense from Debian's PoV."
* Andreas Tille stated "We simply loose people who are frustrated that
its impossible to do Debian wide changes easily...Its simply not
sufficient for say running Janitor like tools on random Vcs locations
outside Salsa."
* Blair Noctis argued "At this stage of the free software movement
we...need more hands to compete with non-free things...Machines and
tools should adapt to people, not the other way around."
**Other viewpoints:**
* Chris Hofstaedtler asked "Please provide a clear definition of what
this DEP wants to achieve. Right now it lives off a headline of "true
open collaboration" without defining that."
* Bastian Venthur noted "DEP-14 is not accepted yet, but in the
candidate state since 2020."
* The discussion surfaced well what are the shared pain points in the
packaging workflow beyond just collaboration struggles. Work should
also continue on DEP-14, git-buildpackage, Salsa CI and other tools to
decrease the general friction, and in many places simple documentation
updates/overhaul is due to avoid unnecessary fragmentation in
workflows that isn't intentional so that we later can more clearly
focus on discussion the pros and cons of the intentionally different
workflows.
Fabio Fantoni
2024-11-18 12:30:01 UTC
Reply
Permalink
Post by Otto Kekäläinen
Hi all,
https://salsa.debian.org/dep-team/deps/-/merge_requests/12
DEP-18: Encourage Continuous Integration and Merge Request
based Collaboration for Debian packages
If you are in favor of having this as a DRAFT in the DEP directory,
please give it a thumbs up.
Summary of previous discussion below, but an even better summary was
written by LWN in https://lwn.net/Articles/986480/
Related to Salsa in general, I heard we have now new and faster
hardware (thanks Salsa Admins!), and related to Salsa CI there is also
an overhauled README
(https://salsa.debian.org/salsa-ci-team/pipeline/-/blob/master/README.md)
and lots of fixes by 7 different authors. I think a lot of people have
also practiced more code reviews and tested the Merge Request feature
on Salsa than before. Overall, I think we are on a good path to
evolving this way of working, and hopefully doing it in a way that it
does not stifle work for maintainers who prefer to continue their
single-maintainer habits, so nobody feels at loss.
Thanks to Salsa Admins, recently when I used salsa it went much better.

While unfortunately I still had many cases where packages.debian.org did
not load the pages or took a long time, several cases still for
wiki.debian.org too (even if maybe less), am I the only one who notices
or maybe the other DD/DMs do not use them or use them very little?

Thanks for including to recommend the use of README.source(.md), so if
it will be used more I think it will be easier and faster to understand
how to contribute to a given package whatever method or tool is used.
Andrey Rakhmatullin
2024-11-18 13:20:02 UTC
Reply
Permalink
Post by Fabio Fantoni
Thanks to Salsa Admins, recently when I used salsa it went much better.
While unfortunately I still had many cases where packages.debian.org did not
load the pages or took a long time, several cases still for wiki.debian.org
too (even if maybe less), am I the only one who notices or maybe the other
DD/DMs do not use them or use them very little?
Not sure how is this related but packages.debian.org is, or should, indeed
be used by maintainers only rarely.
--
WBR, wRAR
Richard Lewis
2024-11-20 20:50:02 UTC
Reply
Permalink
Post by Otto Kekäläinen
Hi all,
https://salsa.debian.org/dep-team/deps/-/merge_requests/12
DEP-18: Encourage Continuous Integration and Merge Request
based Collaboration for Debian packages
If you are in favor of having this as a DRAFT in the DEP directory,
please give it a thumbs up.
I think it's falling between two stools: are you giving project
improvement ideas or a personal view of how to package (which seems very
perscriptive and im afraid not clearly argued)?

I think the you could edit it to something much shorter
that said:

- all packages should be available in git via salsa.debian.org
- salsa CI should be enabled
- (sensible) merge requests on salsa should be accepted

this first doesnt preclude people having other workflows as well, but
the 3rd ensures people can take advantage of modern approaches
Otto Kekäläinen
2024-11-21 04:50:02 UTC
Reply
Permalink
Hi!
Post by Richard Lewis
Post by Otto Kekäläinen
https://salsa.debian.org/dep-team/deps/-/merge_requests/12
DEP-18: Encourage Continuous Integration and Merge Request
based Collaboration for Debian packages
If you are in favor of having this as a DRAFT in the DEP directory,
please give it a thumbs up.
I think it's falling between two stools: are you giving project
improvement ideas or a personal view of how to package (which seems very
perscriptive and im afraid not clearly argued)?
I think the you could edit it to something much shorter
- all packages should be available in git via salsa.debian.org
- salsa CI should be enabled
- (sensible) merge requests on salsa should be accepted
this first doesnt preclude people having other workflows as well, but
the 3rd ensures people can take advantage of modern approaches
Thanks for reading DEP-18. I am trying to help Debian here by
accelerating the convergence on common practices to make it easier for
people to collaborate using Salsa. These are not personal views, but
based on the analysis of all team policies in Debian and from
collecting stats from Debian packages, using for example data points
that 13573 packages in Debian have explicitly a debian/gbp.conf file
already.

The previous version also had more background info, but I was told
that it does not fit a DEP text, which I agree so I rewrote the whole
thing. I am trying to think if I should expand the Q&A section, or
perhaps publish elsewhere more docs / stories on how collaborative
maintenance using Salsa currently looks like in many teams/packages..
Thanks for the viewpoints and the input that further argumentation is
needed.

In the previous version
(https://salsa.debian.org/dep-team/deps/-/merge_requests/8, raw file
at https://salsa.debian.org/dep-team/deps/-/blob/f9ba136130ab02b9715d863aea948a604c278bff/web/deps/dep18.mdwn)
the suggestions were more high-level and in principle. The feedback
was that a DEP needs to be more prescriptive, thus in the rewrite I
among others added git-buildpackage, as that way maintainers will
automatically get the ability to easily gbp
clone/build/commit/push/merge etc the packaging code. This
recommendation is based on what most maintainers and teams already
use, and thus I don't think it is unreasonable. Anyway a DEP is not a
policy, and with the new title, this DEP only applies for a subset of
Debian packages and does not mandate that all packages should be on
salsa.debian.org, as in the previous feedback round many voiced that
they don't want to use Salsa.
Jonas Smedegaard
2024-11-21 07:30:01 UTC
Reply
Permalink
Quoting Otto Kekäläinen (2024-11-21 05:40:37)
Post by Otto Kekäläinen
Post by Richard Lewis
Post by Otto Kekäläinen
https://salsa.debian.org/dep-team/deps/-/merge_requests/12
DEP-18: Encourage Continuous Integration and Merge Request
based Collaboration for Debian packages
If you are in favor of having this as a DRAFT in the DEP directory,
please give it a thumbs up.
I think it's falling between two stools: are you giving project
improvement ideas or a personal view of how to package (which seems very
perscriptive and im afraid not clearly argued)?
I think the you could edit it to something much shorter
- all packages should be available in git via salsa.debian.org
- salsa CI should be enabled
- (sensible) merge requests on salsa should be accepted
this first doesnt preclude people having other workflows as well, but
the 3rd ensures people can take advantage of modern approaches
Thanks for reading DEP-18. I am trying to help Debian here by
accelerating the convergence on common practices to make it easier for
people to collaborate using Salsa. These are not personal views, but
based on the analysis of all team policies in Debian and from
collecting stats from Debian packages, using for example data points
that 13573 packages in Debian have explicitly a debian/gbp.conf file
already.
I guess those data points include how many packages use salsa, with
various Gitlab features enabled.

Since various Gitlab features are enabled by default, did they also
somehow include whether the package actually used the feature or not?

Otherwise I would argue that those data point do not really tell whether
that package "voted" for those Gitlab features to become recommended,
but instead voted "I don't care" on that topic.

- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Otto Kekäläinen
2024-11-21 08:40:02 UTC
Reply
Permalink
Post by Jonas Smedegaard
Post by Otto Kekäläinen
collecting stats from Debian packages, using for example data points
that 13573 packages in Debian have explicitly a debian/gbp.conf file
already.
I guess those data points include how many packages use salsa, with
various Gitlab features enabled.
Since various Gitlab features are enabled by default, did they also
somehow include whether the package actually used the feature or not?
This specific data point has nothing to do with Salsa. It is simply
the count of how many packages have a `debian/gbp.conf` file in the
Debian source package.
Jonas Smedegaard
2024-11-21 09:30:02 UTC
Reply
Permalink
Quoting Otto Kekäläinen (2024-11-21 09:30:12)
Post by Otto Kekäläinen
Post by Jonas Smedegaard
Post by Otto Kekäläinen
collecting stats from Debian packages, using for example data points
that 13573 packages in Debian have explicitly a debian/gbp.conf file
already.
I guess those data points include how many packages use salsa, with
various Gitlab features enabled.
Since various Gitlab features are enabled by default, did they also
somehow include whether the package actually used the feature or not?
This specific data point has nothing to do with Salsa. It is simply
the count of how many packages have a `debian/gbp.conf` file in the
Debian source package.
I agree with you that your simple example is, well, simple.

You gave a single example as a reply for a plural concern, however, so
I quoted a larger part (which you now snipped).

To emphasize (sorry if unclear previously): I am not asking specifically
about your single example, but more generally about your methodology
which I can imagine (for different data points than your simple example)
might be contentious.

Kind regards,

- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
* Sponsorship: https://ko-fi.com/drjones

[x] quote me freely [ ] ask before reusing [ ] keep private
Simon Josefsson
2024-11-21 09:00:01 UTC
Reply
Permalink
Post by Otto Kekäläinen
Hi all,
https://salsa.debian.org/dep-team/deps/-/merge_requests/12
DEP-18: Encourage Continuous Integration and Merge Request
based Collaboration for Debian packages
I think this will be more successful if you frame this as good patterns
to follow for people who wish to opt-in on the premise of adopting this
workflow. That framing follows other DEP's. Now it reads as a mandate
for everything. Acknowledging existance of exceptions to the rules
within the rules may also help to gain acceptance.

I support mandating something what you propose for all Debian packages.
I think we are more likely to get there in a sustainable way by
incrementally converting ideas into code. Rather than to fight over
what people should do, with no authority to demand people to perform the
resulting decision if you happen to win it.

I support going even further: I think the Debian build infrastructure
should over time be moved over to Salsa pipelines. GitLab pipelines
offer a lot of transparency, security and reproducability benefits
compared to the current Debian buildds which in my perception operate
under a "trust us we know what we are doing but we can't be bothered to
be transparent about it" policy that doesn't inspire confidence in me.

There is no discussion about Salsa Issues usage and how use of them
relate to stuff on bugs.debian.org. I find Salsa Issues useful for
internal maintainer discussions. I'm happy to receive end-user issues
for the few (but increasing) end-users who are gitlab savvy. Some
maintainers disable Issues in the salsa config and there is little
agreement on best practices here. I think it is simplest to say that
having Issues and Merge Requests enabled should be the preferred
configuration of Salsa projects.

/Simon
Philipp Kern
2024-11-21 10:40:01 UTC
Reply
Permalink
Post by Simon Josefsson
I support going even further: I think the Debian build infrastructure
should over time be moved over to Salsa pipelines. GitLab pipelines
offer a lot of transparency, security and reproducability benefits
compared to the current Debian buildds which in my perception operate
under a "trust us we know what we are doing but we can't be bothered to
be transparent about it" policy that doesn't inspire confidence in me.
Generally everything is in publicly available git repositories, if you
know where to look (somewhere distributed between wanna-build, buildd,
pybuildd, and dsa-puppet). The setup of the coordinator in particular
suffers from only having a single installation (not even a staging/test
one), though.

I agree in principle in that a lot of trust needs to be extended to the
management and operation here - and we could do much better. I'm not
sure if pipelines are any better if the runner could equally tamper with
the builds. But everything is in git somewhere.

One challenge in particular is that we don't have virtualization
available on all architectures equally, so we are operating with
machines that are not ephemeral. And we would not have the resources to
do extensive maintenance on a machine after every build. Hence
Reproducible Builds to keep us honest.

That said: There hasn't been much innovation in this space so far - in a
way that was usable by Debian. Making builds something based off tasks
(e.g. in a pipeline) when a package is uploaded rather than diffing the
archive and trying to match the intent is something I would have wanted
to see for a long time.

Kind regards
Philipp Kern
Simon Josefsson
2024-11-21 22:30:01 UTC
Reply
Permalink
Post by Philipp Kern
Post by Simon Josefsson
I support going even further: I think the Debian build infrastructure
should over time be moved over to Salsa pipelines. GitLab pipelines
offer a lot of transparency, security and reproducability benefits
compared to the current Debian buildds which in my perception operate
under a "trust us we know what we are doing but we can't be bothered to
be transparent about it" policy that doesn't inspire confidence in me.
Generally everything is in publicly available git repositories, if you
know where to look (somewhere distributed between wanna-build, buildd,
pybuildd, and dsa-puppet). The setup of the coordinator in particular
suffers from only having a single installation (not even a staging/test
one), though.
I agree in principle in that a lot of trust needs to be extended to the
management and operation here - and we could do much better. I'm not
sure if pipelines are any better if the runner could equally tamper with
the builds. But everything is in git somewhere.
I was thinking more about operations than source code availability.
Compare the effort that goes into the visibility and transparency of
things built through a GitLab pipelines. Who authorized what, and how
things were triggered, is chained back to users, in an authenticated
fashion that is simple to follow on a web page, with admin pages for the
credentials involved. Compare that with Debian. How can I find out who
triggered a binNMU to rebuild a package, for example? Where is the list
of credentials allowed to upload into the archive? How are they
managed?

Another example is SSH-signatures and Sigstore/Sigsum transparency chain
mechanisms to provide stronger security properties than PGP signatures.
From what I can tell, the apt team wish to prevent improvements in this
area, preventing us to protect users from attackers with that ability.

I disagree with the notion that everything is in git, Debian gave up on
that as a useful argument with the non-free firmware vote. We don't
have access to all source code. It could contain instructions that may
be triggered to alter the operations of the buildd infrastructure.
Other projects like Guix have mechanism to test and challenge the
integrity of offical builds to protect against these attacks. (No,
Debian's reproducible build doesn't do this.)

Don't get me wrong: I do appreciate the outcome from the current Debian
build machinery. And I do see a lot of problems in the GitLab/GitHub
world. They are a huge complex beast with many poor security practices
(oauth vs pgp, for example) and an unhealthy reliance on the web browser
compared to CLI tools.

But if I look from the outside and try to judge who is even attempting
to solve problems and build the state of the art secure infrastructure
to address supply chain software build attacks, my perception is that
the Debian/Ubuntu setup was overtaken by the GitLab/GitHub web kids five
years ago. I wish it weren't so, and I grow up in the old era and
prefer it, but let's not be blind to how things are due to nostalgia.

I believe that Otto's lets-standardize-on-salsa effort is fundamentally
a good thing. Let's help him flesh out the details.

/Simon

Jonathan Dowland
2024-08-31 22:30:01 UTC
Reply
Permalink
Thanks for working on this. I finally had a read over it today.

I've found the split in discussion between this list and the Merge Request comments
hard to manage. It would help a lot, I think, if some of the MR threads were marked
resolved, assuming the issues they describe are resolved. That would reduce the
amount of stuff to read.

I got random errors from Gitlab whilst trying to add comments myself
("Error dismissing suggestion popover. Please try again.") but perhaps they're
irrelevant (or perhaps nobody will see my comments).

My overall impression is that this is a bold attempt, but the document could do
with some copy-editing to whittle it down, make it more focussed, and possibly
narrow the scope. E.g. perhaps Gitlab CI is too much in one go? Could that be
done further down the line in a follow-up DEP?

There are a few references to DEP-14, which Bastian points out has been in
"candidate" state since 2020. Your proposal is not strictly depending on
DEP-14, but I wonder if someone invested should try and get that one over
the line as well (if not before). It would give me (and I wager others) more
confidence in the whole DEP process if more of the proposals made it into a
"final" state than are now.
Otto Kekäläinen
2024-09-01 17:20:01 UTC
Reply
Permalink
Hi Jonathan!

The discussion was summarized in a separate "Summay" email by me on this
list, and a comment in the MR (which merges the two discussions) and it
just happened that the next day it was also covered in
https://lwn.net/Articles/986480/

I am currently writing revision 2 of the proposal. I will notify when
published.

- Otto
Jonathan Dowland
2024-09-06 13:50:01 UTC
Reply
Permalink
Post by Otto Kekäläinen
The discussion was summarized in a separate "Summay" email by me on this
list, and a comment in the MR (which merges the two discussions) and it
just happened that the next day it was also covered in
https://lwn.net/Articles/986480/
I am currently writing revision 2 of the proposal. I will notify when
published.
Thanks. I look forward to it. It would be great if this was iterative
on top of your first, in distinct commits, such that you/we/someone can
mark conversation threads on GitLab as "resolved" (if they are by your
second draft).


Best,
--
Please do not CC me for listmail.

👱🏻 Jonathan Dowland
✎ ***@debian.org
🔗 https://jmtd.net
Richard Lewis
2024-09-01 18:30:02 UTC
Reply
Permalink
Post by Jonathan Dowland
My overall impression is that this is a bold attempt, but the document could do
with some copy-editing to whittle it down, make it more focussed, and possibly
narrow the scope. E.g. perhaps Gitlab CI is too much in one go? Could that be
done further down the line in a follow-up DEP?
If you want editing advice debian-l10n-***@lists.debian.org is a great resource

I would suggest:

- make the "intro" less general. Set out a clear, short, list of
objectives/goals/what you want to improve. This will also help with
setting a clearer scope

- make the "principals" more general (or keep them but dont call them
principals -- they currently read like a set of implementation
details), and explain how they help the project achieve the
objectives. This will help you edit down the text below each
'principal'. You might also want
to decide if these are mandatory, recommended or suggested.

- (then see whether the other sections are still needed)
PICCA Frederic-Emmanuel
2024-09-01 20:10:01 UTC
Reply
Permalink
What about dog fooding ?

for now we can setup a schroot and sbuild very easily and start to build a local repository in minutes.

But when it comes to install gitlab and the CI system it is another story. So we rely on the central salsa instance.

It seems to me that a great strength of Debian is to empower the user and provide everything (almost out of the box) in order to

de-centralize the build process.

I do not know if I am clear but I have the fear that this centralisation will make us forget that de-centralisation is sort of "central" to the Debian way.

Frederic
Richard Lewis
2024-09-01 22:40:01 UTC
Reply
Permalink
Post by PICCA Frederic-Emmanuel
What about dog fooding ?
for now we can setup a schroot and sbuild very easily and start to build a local repository in minutes.
But when it comes to install gitlab and the CI system it is another story. So we rely on the central salsa instance.
fwiw, i dont think that a properly scoped DEP would change any of
that. eg, it could be written to be only about what goes into the
archive and not say anything about using schroot locally, or whether
salsa is gitlab or something else. but maybe i misunderstand
Post by PICCA Frederic-Emmanuel
I do not know if I am clear but I have the fear that this
centralisation will make us forget that de-centralisation is sort of
"central" to the Debian way.
I suspect that if the DEP was clearer in scope and aims, these concerns
would not actually arise
Loading...