[PKG-Openstack-devel] Migration of packaging development workflow to OpenStack project

[James Page]

Hi Thomas

On Sat, 3 Sep 2016 at 01:15 Thomas Goirand <zigo at debian.org> wrote:
[...]
> As you may (or may not) know, Thomas has been working on enabling

> > package build and publication processes in the OpenStack project
> > infrastructure
>
> No. This isn't about publication. The intend *has never* and *never will
> be* to have OpenStack infra as the place to publish packages. The only
> reason why there is a Debian repository is because we have
> interconnected build-depenencies. But The intend really is to continue
> to publish within Debian.
>

OK -  I guess that helps unblock interconnected depends without having to
upload to Debian first; just need to be good at communicating that people
should not deploy from these repositories in the real world I guess!

> with the intent of migrating *all* packaging development
> > workflow under pkg-openstack to a git/gerrit based workflow.
>
> Yes, and for the good. (almost?) Everyone in Debian understand that just
> having a write access control for Git is not enough. Gerrit is so much
> better in many ways.
>

I agree that review and gating are good things btw.


> > This means that day-to-day packaging changes, currently done directly in
> > git on alioth, will all be done using git/gerrit, inline with other
> > OpenStack projects.
>
> Yes, and that makes a lot of sense. Projects within OpenStack will also
> be able to gate on packaging, and the packaging will be able to have
> gating based on puppet-openstack, for example. Projects like Fuel could
> also re-use the packages, and the packages could use Fuel as tests too.
> I'd love to see JuJu doing the same.
>
> > I'm concerned that, to me at least, it feels like this plan has never
> > been formally ratified by the members of pkg-openstack in Debian.
>
> Having only the possibility to grant write access to *everything* or
> *nothing* in the pkg-openstack team on Alioth is really bad in many
> ways. Say a new contributor shows up that we don't know, then I wouldn't
> trust him, and then wouldn't provide write access. Then he will not
> contribute (ie: he's feeling not welcome). Say I'm giving him write
> access, then that's a big risk (he could rm -rf /git/openstack/* on
> Alioth). Also, multiple times, we had potential contributors that were
> afraid of breaking something, and therefore didn't dare to commit to the
> git. Having a full CI (with in the short term a full Tempest test suite)
> would make them feel more confident.
>

OK - I agree that alioth is not great in this perpsective, not having any
review system like Gerrit or Launchpad for someone who does not have write
permissions on a repo to propose a change and have them reviewed/tested
automatically.


> Another thing is that current OpenStack contributors are actually
> *expecting* to use a Gerrit with a full set of checks and gating. We're
> here opening up the door for all of them, and many have packaging skills
> that we're not able to enjoy.
>
> Also, a lot of packages are maintained with Git, outside of Alioth.
> Alioth isn't mandatory at all. Even though, I would like to get any
> merged CR pushed to Alioth, just because that's possible. I'm not sure
> yet how. Though that would help, because on Alioth, there's git receive
> hooks that will trigger builds for arm64 on the Jenkins provided by
> Linaro. So that will also be very good to have.
>
> As for the CI part, what happened before is: someone was making a commit
> in the Git, checking or not the result in the Jenkins that I have setup.
> Sometimes. It could break things hard, and nobody would notice.
> Considering how complex all of OpenStack is, using a real CI with gating
> is a huge improvement. Having an always working package repository is
> also a goal which we can't have with the current setup.
>
> Now, if what is bothering you is that the packaging is hosted by
> OpenStack infra, then I would very much welcome producing the same kind
> of Gerrit / Zuul / Nodepool setup that OpenStack infra has for Debian as
> a whole. I've been thinking about this for more than a year already. And
> I discussed it during my talk in Debconf. Some other DDs are also
> interested by the idea.
>

Actually the only thing that is bothering me is I don't feel that this
change has been +1'ed explicitly by the pkg-openstack team.

As PTL of another OpenStack project, I have over 30 repositories hosted by
OpenStack infra so I'm familiar with both the OpernStack infra architecture
and how to effect change into it.


>
> The reply I had from the DSA team was that they needed a proof of
> concept first. Which is exactly what I'm doing here. Once we have all up
> and running, and even after Newton is released this way, we will have a
> very good show case for Debian. Hopefully, the DSA team will then agree
> to allocate some hardware, and we will be able to have such a setup for
> the whole Debian archive, interfaced with something like Gerrit. At
> least, that's my plan for the longterm. Hopefully, I'll have enough time
> to implement it.
>

+1 that sound good, and hopefully with it being Debian owned, you'll get
some other collaborators to help make that happen.

>
> > I've been fairly vocal on the openstack-dev ML that I don't think this
> > is the right direction to go in (see [0]), as I feel it moves packaging
> > and distribution work outside of either Debian or Ubuntu, resulting in
> > more hops to get work done and uploaded to either distribution. I still
> > stand by this sentiment, and feel that this change is not been driven by
> > the team as a whole.
>
> The only person who's not happy about the move is yourself, and that
> *after* you first approved the idea. Everyone else is every enthusiastic
> about the move.
>

Well I think I'm the only person being vocal about it (read last paragraph
for context).

So far, you haven't given any reason but "it feels like it's done
> outside of Debian/Ubuntu", which doesn't feel right to me. The feeling I
> have is that this move doesn't fit in Canonical's agenda. Of course I
> have no way to know, and this is just a double-guess gratuitous
> sentence.


It is.  These views are my own as someone who has worked across Ubuntu and
Debian (and OpenStack) for the last 6 years - don't read any commercial
agenda into this.  I'm just super keen that we keep the right communities
engaged in packaging of OpenStack (and its large dependency set) across
both distributions, leveraging the facilities that both distributions have
with regards to review/CI etc...

For OpenStack in Ubuntu, we use the development distribution in a different
way to how you do in Debian; its very much the focus of development for
packaging, with CI between proposed and release pockets, in much the same
fashion as for Debian unstable->testing, albeit we also hook autopkgtests
into that process, gaining function regression testing when dependencies of
a OpenStack package change as well.  As a result we CI the entire distro,
not just individual changes to a single package.

TBH whether pkg-openstack moves its dev process under git/gerrit or not
does not impact Ubuntu hugely anyway; the project was setup to be loosely
couple with Debian, so delta could be maintained where it was felt it was
important still;  I'm just concerned that we create a third source of
packaging truth, this may confuse contributors and users more, even if it
enables them to contribute more easily.  There is no guarantee that a
change accepted into the OpenStack packaging repositories will make it
directly into either Debian or Ubuntu, as both distro's may have to flex
around other distro-centric concerns.


> But I've been thinking about it over and over again, and I
> don't see any other reason why you wouldn't want to do it. If I'm wrong
> here, feel free to say it, and do not take it the wrong way: it's
> perfectly understandable that companies have a (commercial) agenda.
>
> But if I am right, then I would like to kindly ask you to reconsider.
> Ubuntu will always be the winner distro in OpenStack in many, many ways.
> I've tried to push for Debian, and even within my own company. It's a
> disaster: from sales to PM, they all reject the idea, on the grown that
> they believe customers would run away because of the lack of commercial
> support. Whatever we do to actually create the packages for both Debian
> and Ubuntu, this will never change. There is absolutely nothing that
> Ubuntu would loose in moving to Gerrit. The only way you would loose
> would be if Ubuntu was not supported there. And because you don't seem
> to care, and I have no time (yet) to take care of it, that's
> unfortunately what's currently happening. Though it's far from too late.
>
> Also, the Debian repositories hosted in OpenStack infra will only be for
> development purposes. They are in no way to be considered for
> production. I will make a big emphasis on it in the docs that they can
> be used for testing, but that's the only purpose. Like you, I believe
> packages belong to the respective distributions.
>

Glad to hear that!

> Thoughts?  Is this something that all team members feel is a change for
> > the better and is something they can stand behind?  I appreciate that
> > adding things like code review and CI are all helpful to development,
> > but I don't think that doing that all outside of Debian is the right
> > approach.
>

I've made my views clear; however I'm also just one person with the team,
and if the pkg-openstack team as a whole feel that this is the right move
to make, I'm not going to be the fly in the ointment; we are a team within
Debian , not a dictatorship after all!

I'm just concerned that there is a ot of implicit consent being assumed
right now, and that does not feel right.

AFAICT this is the first time the move has been discussed directly on
pkg-openstack; I appreciate that we've has some conversations at the
OpenStack summits and on the openstack-dev ML, but it feels like the
proposed processes should have been formally proposed on *this* ML as well
so that as a team we can explicitly decide on the way we want to take
development forward.

I hope that clarifies my position and the intent of my initial email.

Cheers

James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/openstack-devel/attachments/20160905/273715d6/attachment-0001.html>