[Savannah-hackers-public] Re: IRC meeting about Savannah

[Sylvain Beucler]

Hi,

Please remember that I'm not the only one working on Savannah :)
address@hidden is created for this purpose (in Cc:).

The current active volunteers are:
- Sylvain Beucler: myself, admin
- Michael J. Flickinger: admin
- Jonatan Gonzales V.: helping with project approvals, support
  requests and some admin tasks
- Sebastian Wieseler: idem.

The tasks usually performed by the FSF system admistrators are
backups, kernel updates, and security updates (or more generaly the
first Savannah hacker to launch aptitude udpate/upgrade, no true
assignement).

I'm taking this as an opportunity to write some "status
update". Nobody's done this for long, maybe it would be a good habit
to restart it.


The current Savannah issues are setting CVS in a different way. We
discussed forsaking the per-group root concept at sv-hackers-private a
little while ago with Justin. This involves dealing with issues that
the proxy takes care of, ie. avoiding a limitation of 32 groups per
user, which apparently means a small glibc patching.

We also have to set up a way to add members of group 'www' to the all
GNU projects' web groups (the groups that tell who can update the
project's webpages via CVS) - this is currently a separate process
that updates all the per-project roots.

This change will also allow to restablish pserver as an anonymous CVS
access. The trick to use an empty SSH password tends to break with
some proprietary SSH clients since the sarge upgrade.

The true way to protect CVS from a compromise (or at least, shift the
protection responsibily from us to the developers - no solution's
perfect), is to implement CVS signed commits. I submitted a proposal
that was discussed on info-cvs last month. I also contacted RMS to
know the status of the context announced a year ago about this issue,
who in turn contacted Derek Price, who should implement the feature
within 2 months. This will probably require we patch CVS - I hoped we
could avoid that, but his implementation plans to do it.


The next task is to improve the documentation on the approval process
to try and reduce the time dedicated to project reviews. We'll
probably set up some Wiki to manage the documentation better than the
current FAQ system.


Then the plan is, with a clean CVS setup that works without
per-project roots, set up GNU Arch. Depending on the status of GNU
Arch, this may lose some priority though, as Arch 1) is currently
forked / taken over by some other project and 2) doesn't have a
maintainer.

Arch does not come with a server counterpart, which is problematic for
us (no protection against history deletion). This means we'll have to
think about maybe a different way to offer the service. Regular test
against compromise could also be provided if that's what users need. 


Another features that's worth working on in the near future is
on-commit update for web repositories and mailing lists automatic
creation. These are tasks done in Savane by accessing the central
database remotely. Since it is considered unsecure to open the
database to the local network, we'll have to implement this
communication as xml-rpc/soap calls, which will allow us to eliminate
the update delay users generaly experience.


The Savannah issues are generally discussed via
sv-hackers-public/private. I separated the list in
help/hackers/register/reports last year to split the traffic.


Michael has troubles with getting a stable connection since he just
moved, and I currently do not have a stable schedule, so setting up an
IRC session is not very convenient.


Is there something else you need to know?

-- 
Sylvain

On Thu, Sep 15, 2005 at 11:52:00AM -0400, Justin Baugh wrote:
> Sylvain,
> 
> I'd like to have a meeting with you and any other interested party about
> Savannah, so we can all talk and hash out the various issues (as well as
>  bring the new admins up to speed).
> 
> What time next week is good? Ward is only here two days a week, so we
> would need to schedule it.