[csw-maintainers] NMUs, non-maintainer uploads (was: reminder on contributing on recipes)

[Maciej (Matchek) Bliziński]

2013/4/9 Yann Rouillard <yann at pleiades.fr.eu.org>:
>
> 2013/4/9 Maciej (Matchek) Bliziński <maciej at opencsw.org>
>
>> 2013/4/8 Yann Rouillard <yann at pleiades.fr.eu.org>:
>> > I think there are two topics here:
>> >  1. how to handle NMU,
>> >  2. how to handle orphaned packages.
>> >
>> > If you have a lot of bugs assigned to you, it's probably because the
>> > maintainers are not active anymore and didn't upload new packages. In
>> > fact,
>> > the packages are rather orphaned.
>> >
>> > For 2., I would propose to create a dedicated fake maintainer. The
>> > emails
>> > address of this fake maintainer would be a mailing-list, all interested
>> > maintainers in helping to keep orphaned package up to date would be
>> > subscribed to this list.
>> >
>> > For 1., it might be better to register the official maintainer somewhere
>> > (the easiest is in the Makefile). If someone else uploads a package it
>> > could
>> > just add an "UPLOADER" field in the pkginfo file but would not change
>> > the
>> > official maintainer of the package.
>>
>> Our current field has exactly this meaning, it's whomever last
>> uploaded the package.
>
> This has not been the case from the beginning, has it ?
> That is not entirely clear from the outside I think: the maintainers pages
> still mentions "packages maintained by" and not "packages last uploaded by":
> http://www.opencsw.org/maintainers/yann/

It's an omission, we did update it on the package page, maybe we
forgot to update it on this page.

Originally we used this field as the maintainer / owner field, under
the assumption that only the owner builds and uploads the package.

> And the email contact in the pkginfo file is the last uploader's one and not
> the maintainer's one.

Right. If you look at how it works, we basically have no field for the
maintainer, only for whomever last uploaded it.

>> There's also 2 things we need to distinguish:
>>
>> - how we can change our infrastructure to be better
>> - what we can do right now
>>
>> I'm more interested in what we can do now, without changing our
>> infrastructure. For now we have just one field; adjusting this field
>> causes packages to look as if they changed ownership, although the
>> field really only means the last uploader. So what do we do with this
>> field for now?
>
> Without changing anything, I think this field should be used for the
> official maintainer. When we do a NMU we make sure this field doesn't
> change.

Either way is bad. We either make a package belong to someone who only
did a NMU, or we make it look like a package was uploaded by a ghost.
I would personally prefer the first kind of problem. I would
definitely not like something to be uploaded with my name on it. If it
is to have my name on it, I want to do it myself.

> Using a fake maintainer without changing anything in the current
> infrastructure has to drawbacks I think:
>   - from the outside, it will look like the package doesn't have a
> maintainer anymore,

If it has a maintainer, all that's necessary for the maintainer, is to
log in, run mgar platforms and csw-upload-pkg, that's it. If the
maintainer can't do even that, can we call the package maintained?

>   - the real maintainer will not receive anymore bugs and reminders about
> his package.

Right, but it's enough to re-upload to reverse it. It might look silly
in mantis with bugs bouncing between two people, but who cares?
Scripts are doing all the work.

> Of course we should contact the maintainer before doing this kind of upload.

Right, and the maintainer can come in, rebuild and reupload. It can be
after a week or few weeks, the person who does courtesy uploads while
working on a bigger project doesn't have to wait.

So I'd say there should be 2 scenarios after you contact a maintainer:

- if the maintainer responds, you upload as yourself, you explain that
you're only doing courtesy rebuilds, and the maintainer is welcome to
come in and reupload to assign the package back to them

- if the maintainer doesn't respond, you reassign the package to a
fake maintainer / mailing list, because if the maintainer is gone, the
package is orphaned in practice.

Maciej