On 03/03/2010 02:58 PM, Ryan Hill wrote:
>> Dne 3.3.2010 12:32, Joshua Saddler napsal(a):
>>> On Wed, 03 Mar 2010 13:35:10 +0200
>>> Samuli Suominen <ssuominen@gentoo.org> wrote:
>>>
>>>> # Samuli Suominen <ssuominen@gentoo.org> (03 Mar 2010)
>>>> # Masked for QA, security
>>>> #
>>>> # Internal copies of vuln. zlib, jpeg, speex and likely
>>>> # others
>>>> #
>>>> # http://bugs.gentoo.org/show_bug.cgi?id=255453
>>>> #
>>>> # Masked for removal in 60 days.
>>>> games-fps/openarena
>>>>
>>>
>>> Why? Why did you ignore the patches posted to the bug? Even Diego, the original reporter, commented that the patches fix the problems.[1]
>>>
>>> [1] http://bugs.gentoo.org/show_bug.cgi?id=255453#c4
>>
>
> One of the reasons I left the treecleaner project was that it became apparent
> that people were more interested in dumping packages with simple problems
> than fixing them (which believe it or not, was what treecleaner was formed to
> do). Now they call it QA.
>
> I'm all for dropping broken crap, but things people use with working patches
> attached? QA is also about getting that stuff applied.

And now you have good 60 days to apply and test the package, and
co-ordinate it with upstream.

Don't forget to add yourself to metadata.xml, as it's a non-trivial task.

;-)

I've remove the mask for games-fps/openarena.

The mask was done without consulting the games team.


On Wed, Mar 3, 2010 at 8:09 AM, Samuli Suominen <ssuominen@gentoo.org> wrote:
> On 03/03/2010 02:58 PM, Ryan Hill wrote:
>>> Dne 3.3.2010 12:32, Joshua Saddler napsal(a):
>>>> On Wed, 03 Mar 2010 13:35:10 +0200
>>>> Samuli Suominen <ssuominen@gentoo.org> wrote:
>>>>
>>>>> # Samuli Suominen <ssuominen@gentoo.org> (03 Mar 2010)
>>>>> # Masked for QA, security
>>>>> #
>>>>> # Internal copies of vuln. zlib, jpeg, speex and likely
>>>>> # others
>>>>> #
>>>>> # http://bugs.gentoo.org/show_bug.cgi?id=255453
>>>>> #
>>>>> # Masked for removal in 60 days.
>>>>> games-fps/openarena
>>>>>
>>>>
>>>> Why? Why did you ignore the patches posted to the bug? Even Diego, the original reporter, commented that the patches fix the problems.[1]
>>>>
>>>> [1] http://bugs.gentoo.org/show_bug.cgi?id=255453#c4
>>>
>>
>> One of the reasons I left the treecleaner project was that it became apparent
>> that people were more interested in dumping packages with simple problems
>> than fixing them (which believe it or not, was what treecleaner was formed to
>> do). *Now they call it QA.
>>
>> I'm all for dropping broken crap, but things people use with working patches
>> attached? *QA is also about getting that stuff applied.
>
> And now you have good 60 days to apply and test the package, and
> co-ordinate it with upstream.
>
> Don't forget to add yourself to metadata.xml, as it's a non-trivial task.
>
> ;-)
>
>

Michael Sterrett <mr_bones_@gentoo.org> said:
> I've remove the mask for games-fps/openarena.
>
> The mask was done without consulting the games team.

This is no reason to remove the mask. The games team had more than
enough time to fix the package. I'll be adding the mask back as the
package is vulnerable via multiple bundled libs and therefore shouldn't
be in the tree. You can apply the patches if you want to keep it and
remove the mask at that time.

Thanks,

--
Mark Loeser
email - halcy0n AT gentoo DOT org
email - mark AT halcy0n DOT com
web - http://www.halcy0n.com

On Wednesday 03 March 2010 18:29:13 Mark Loeser wrote:
> Michael Sterrett <mr_bones_@gentoo.org> said:
> > I've remove the mask for games-fps/openarena.
> >
> > The mask was done without consulting the games team.
>
> This is no reason to remove the mask. The games team had more than
> enough time to fix the package. I'll be adding the mask back as the
> package is vulnerable via multiple bundled libs and therefore shouldn't
> be in the tree. You can apply the patches if you want to keep it and
> remove the mask at that time.
>
> Thanks,
This thread is yet another proof that we need to introduce a "Upcoming
masking" for unmaintained packages.

Instead of first masking a package and then announce it, we can simply announce
that we are gonna mask the package in 10days if there is no activity on the
respective bug
--
Markos Chandras (hwoarang)
Gentoo Linux Developer
Web: http://hwoarang.silverarrow.org

On Wed, Mar 3, 2010 at 8:59 AM, Markos Chandras <hwoarang@gentoo.org> wrote:
> On Wednesday 03 March 2010 18:29:13 Mark Loeser wrote:
>> Michael Sterrett <mr_bones_@gentoo.org> said:
>> > I've remove the mask for games-fps/openarena.
>> >
>> > The mask was done without consulting the games team.
>>
>> This is no reason to remove the mask. *The games team had more than
>> enough time to fix the package. *I'll be adding the mask back as the
>> package is vulnerable via multiple bundled libs and therefore shouldn't
>> be in the tree. *You can apply the patches if you want to keep it and
>> remove the mask at that time.
>>
>> Thanks,
> This thread is yet another proof that we need to introduce a "Upcoming
> masking" for unmaintained packages.

<sarcasm>

Shall I file those forms in triplicate and fax them to the main office sir?

</sarcasm>

Since amazingly I actually started the Treecleaners project; the
intent was actually to fix problems with packages. Part of the
problem is that there are hundreds of packages in the tree and the
fixes vary in complexity so it is difficult to create hard-and-fast
rules on when to keep a package versus when to toss it. One of the
things I like about masking is that it quickly gets people who
actually care about the package up to bat to fix it instead of leaving
it broken for months. I realize maintainers do not exactly enjoy this
kind of poking, however when things have been left for long enough I
believe our options become a bit more limited (in this case, masking
for removal due to unfixed sec bugs.)

>
> Instead of first masking a package and then announce it, we can simply announce
> that we are gonna mask the package in 10days if there is no activity on the
> respective bug
> --
> Markos Chandras (hwoarang)
> Gentoo Linux Developer
> Web: http://hwoarang.silverarrow.org
>

On Wed, 03 Mar 2010 13:35:10 +0200
Samuli Suominen <ssuominen@gentoo.org> wrote:

> # Samuli Suominen <ssuominen@gentoo.org> (03 Mar 2010)
> # Masked for QA, security
> #
> # Internal copies of vuln. zlib, jpeg, speex and likely
> # others
> #
> # http://bugs.gentoo.org/show_bug.cgi?id=255453
> #
> # Masked for removal in 60 days.
> games-fps/openarena
>

0.8.5 was released on february 23, 2010 and the patch at bug
255453 seems to work fine.
Please don't remove one of the greatest open source games.

Regards,

--
Víctor Ostorga
Gentoo Linux developer (lxde, treecleaners)
http://www.gentoo.org

On Friday 05 March 2010 15:17:06 Ben de Groot wrote:
> On 4 March 2010 19:17, Victor Ostorga <vostorga@gentoo.org> wrote:
> > 0.8.5 was released on february 23, 2010 and the patch at bug
> > 255453 seems to work fine.
> > Please don't remove one of the greatest open source games.
>
> So step up and maintain it!
>
> Cheers,
games herd already maintains that package . At least this is what I see on
metadata.xml
--
Markos Chandras (hwoarang)
Gentoo Linux Developer
Web: http://hwoarang.silverarrow.org

On Friday 05 March 2010 17:06:21 Ben de Groot wrote:
> On 5 March 2010 15:22, Markos Chandras <hwoarang@gentoo.org> wrote:
> > On Friday 05 March 2010 15:17:06 Ben de Groot wrote:
> >> So step up and maintain it!
> >
> > games herd already maintains that package . At least this is what I see
> > on metadata.xml
>
> Nominally, yes. But if a package has open QA and security bugs and
> patches that have not been reviewed or even commented upon by the
> maintainer(s) for over 6 months, then you can't consider that package
> actually maintained. So for this package to remain in the tree, someone
> needs to step up and actually maintain it.
>
> Cheers,
I assume that only members of QA can actually step up and fix the problem.
Otherwise the games heard will complain that random devs are touching their
packages. I just assume that but I am not willing to step into their
"territory" and this is why I asked permission to touch the bug ( see my last
comment on the bug )
--
Markos Chandras (hwoarang)
Gentoo Linux Developer
Web: http://hwoarang.silverarrow.org