Public SourceMage Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

On Nov 01, David Kowis [dkowis AT shlrm.org] wrote:
> I've thought a bit about our current grimoire release process. I feel
> that we're mired down in too much process for the amount of people that
> do the actual work.  This can be evidenced by how long it's taken for
> the bugs found by prometheus to be integrated. Perhaps contributing to
> that is the somewhat convoluted bugzilla flags process. But I'm not
> bothering with that for now.

This was an identified likely problem back when we went to named stable
releases, unfortunately here it is.  :-(  Lowering the requirements for
stable updates and requiring a fast release cycle might fix it but I'm
skeptical.

> Also, we need to loosen up who can make/sign the grimoire tarballs.
> Right now, I believe it's limited to two people. If they're not around,
> it won't happen. I'm proposing that any Lead Developer can be allowed to
> do the releases. If we're that uneasy about giving our Lead's the power
> to do so alone, have it require two signatures from two different Leads.
> As long as we open it up some so that we can move forward even if a few
> leads are out of the picture. Same thing goes for integrations.

This strikes me as "changing project policy to resolve a single component
issue" and it seriously dillutes the Grimoire Lead's authority over his
component.  I would rather we ask/require the Grimoire Lead to formally
identify a set of people allowed to sanction/sign releases, be they Leads
or otherwise.  There should be enough of these identified to make sure it
can happen on time.  Right now we frankly have exactly one person who is
*allowed* to do this (Arwed).  Seth has a key in there from when he was QA
lead but Arwed's never actually said he has the authority to do releases
(that I've seen).

The PL should also have implicit authority to step in and do the releases
(or have someone else do them on his authority) if the process identified
by the Grimoire Lead falls apart due to lack of people/etc.
 
> Finally, a bit off topic, our grimoire verification keys are within the
> very grimoire we're attempting to verify. We've got a small chicken-egg
> problem there. Perhaps we could seperate the gpg keys into their own
> grimoire? That is the simplest solution I've come up with, but I'm not
> sure if it's the most elegant.

We basically have three options:

1) get the new keys in there and wait to use them til everyone has them
   (which always means a new key has to wait one cycle to get used)
2) make them their own grimoire (which means users have to add another
   grimoire)
3) move the key distribution to another channel, giving us 3 total (sorcery
   update, scribe update, key update)

#1 fits best with what we have now but has a lag problem.  #2 is easiest on
the devs but maybe not the users.  #3 is what a lot of other distros do.
Pick your poison.

Attachment: pgpTKByNDg52D.pgp
Description: PGP signature