Re: Lyon meeting notes

[Bjorn Helgaas <helgaas@kernel.org>]

On Tue, Oct 29, 2019 at 10:26:29PM +0000, Eric Wong wrote:
> > https://docs.google.com/document/d/1khLOBw5-HyaaNX7xregpHQLSfvGDUeHDY921bkI-_os/edit?usp=sharing
> 
> Thanks for taking notes.  Is there a version accessible to users
> without JavaScript?  Thanks.

Here it is:

Present:
* Konstantin Ryabitsev - technical director LF
* Google: Han-Wen Nienhuys, Dmitri Vyukov, David Gow, Brendan Higgins
* Christian Brauner - Canonical
* Shuah Khan - LF
* Greg KH
* Johan Holvold
* Kevin Hilman, KernelCI
* Veronika Kabatova - Red Hat/CKI CI
* Rafael Wysocki - intel
* Sasha Levin
* Frank Rowand
* Daniel Diaz - Linaro LKFT CI
* Daniel Vetter - intel
* Wolfram Sang
* Anasse Astier - freebox (?)


Consensus:
* Current situation is suboptimal/problematic
* CI folks
* Patchwork streamlines workflow; lot of activity now. Dormant for years, but now improving.
* Konstantin: patches: no attestation; no security. Easy to slip in vulns
* Linus checks sigs, but subsystem maintainers don’t.
* Konstantin: proposes minisign signatures.
* How realistic is this? (Steven).
* How big is the key? Ed25519 are short keys.
* Identity tracking? PGP giving up on key signing. TOFU.
* (unhearable)
* KR: signify/minisign background.
* PGP
* KR: Want it to be part of git.
* PGP signatures are attachments. Attachments are easily stripped from message.
* KR: want to archive history
* Complex patch doesn’t get in immediately, because patches need comment rounds, then spoofing gets exposed.
* Greg: base tree information will be great.
* Konstantin wants to put it into Git.
* Base tree
   * Discuss base commit
   * Hanwen: SHA1 is opaque too
   * KR: Linus complains that Changeid is equivalent to messageid, not so much opaqueness.
   * Hanwen: suggest to add a public URL to the base tree
   * Base goes into email; --base option git-format-patch.
   * Must become a requirement
   * Put into check-patch
   * Similar to signed-off
   * Not mandatory, andrew morton not using git. RFC patches also don’t need it.
* Gateways:
   * Point to tree, send from system
   * Inside corporations, HTTPS.
   * Adopt Gitgitgadget from github; creates mail patches from a GH repo.
   * Command line tool
   * Figuring out who to send this to.
   * Automation defeats attestation goal.
   * KR: should just build gitgitgadet for kernel.
* How to know whom to send patch to?
   * So much cruft in maintainers file.
* Interaction git-format-patch and config is tricky.
* Dmitrii Vyukov:
   * Can have a server to do this
   * KR: don’t want centralized infrastructure
   * Dmitrii: but gitgitgadget is the same?
* (14:35): feeds.
   * Human consumable information
   * Kernel.org can aggregate all the feeds, and can tell what CIs are still missing.
   * CI mail has logs, but the results are transient
   * Kernel.org can archive all these data.
   * Will be a lot of data, but want to start with feed.
   * Needs a common structured format to understand what all CI systems have done.
   * Attestation
   * Steven: could record the acks/reviewed-by.
* 2nd part of discussion: tooling.
   * Lore 200 Gb.
* [lost a lot of conversation here]
* Patchwork:
   * Has a web interface
   * Can run locally.
   * Inbox vs patchwork
   * Patchwork with approvals from different maintainers.
   * ...
   * KR: write local command to work with patchwork.
* KR: daniel uses gitlab, some people want to use gerrit
   * KR: wants to have a feed of data.
   * Mail from gerrit/gitlab, usually is noisy.
   * Tool can consume that feed.
   * Libc mailing list, still struggling
* Hanwen: Funding for tooling? Does Linux Foundation build the bridges, or do tool owners (gerrit, gitlab) have to do it?
   * Linux Foundation can go to companies to ask for funding
   * KR trying to get consensus so we can ask for resources & funding as a group.
   * Let people use tools, sourcehut, gitlab, gerrit
* KR: Lore.kernel.org:
   * Want to be able to search all over all data, gerrit, kernel etc. (like code search)
   * Find all the patches that touch XYZ
* Devs can miss reviews because people don’t know where reviews happen.
   * KR: have a bot that will respond on behalf if maintainer has no gerrit account.
   * KR: long time initiative: want to move to SSB.