Re: [RFC] nftables 1.0.6 -stable backports

[Phil Sutter <phil@nwl.cc>]

On Thu, Nov 02, 2023 at 12:34:14PM +0100, Pablo Neira Ayuso wrote:
> On Thu, Oct 19, 2023 at 05:23:15PM +0200, Phil Sutter wrote:
> > Kindly find attached my collect_backports.sh. I keep it in an unused
> > sub-directory (~/git/nftables/stable_tooling), but it's not necessary.
> > It creates $(dirname $0)/backports directory containing a list of
> > potential backports for each tag in the range defined by the variables
> > in the script's header.
> 
> I have integrated the pending fixes identified by your script. I have
> refreshed 1.0.6.y branch and pushed it out.

Thanks for doing this!

> If anyone find more candidates to be merged into 1.0.6, Let me know.

My script found two missing ones. Not sure if they came in late or if
you explicitly omitted them:

- 8519ab031d8022999603a69ee9f18e8cfb06645d
- f65b2d12236174d477c55e96c4027cd51185ba5e

As you know, my script relies upon Fixes: tags. I use git-notes to help
it here and there. This way I added extra Fixes: tags with correct
hashes for:

- 818cc223b052b9a3b0bc3fc28a4b7036b5898408
- 8a9f48515fb8f9aed0af04e05f4528aa0e32116f
- b4c9900c895fd55788912d62063cf107a27b68e0
- b593378b9b2470213af1892053af519801053a7e

(The list may very well be incomplete.)

Another case for git-notes is missing Fixes: tags in fixing commits.
They are important in two ways:

- Without a Fixes: tag, the script won't find the backport candidate.
- If backported manually, the script won't find potential follow-ups
  (fixes may have fixes, too).

In 1.0.6.y, I see 33 commits having no Fixes: tag. Did you solve this
locally with git-notes? Assuming history rewriting is allowed in the
stable branch, one could update the backports with Fixes: tags as
needed and write a custom collect_backports.sh which operates on the
stable branch directly.

An alternative might be to publish notes somehow. According to the man
page, it seems possible to keep them in a branch but I have no idea how
this works.

Cheers, Phil