[tahoe-dev] Weekly Dev Hangout 2012-09-18

[Zooko Wilcox-OHearn]

Weekly Dev Hangout 2012-09-18

in attendance: Zooko (scribe), Brian, David-Sarah

CAVEAT LECTOR -- this hasn't been vetted for correctness and
contextualized for widespread meaningfulness. It's just my notes.


LeaseDB Stuff

• David-Sarah is happy with Brian's design of the state machine.
• There aren't any deep design issues, just some straightforward code to write.


Development Process

We discussed how to manage branches and rebasing with git.

Policy:
 • Please rebase stuff before submitting it for inclusion.
 • Please rewrite it into a set of sensible patches. Please make it
into a single patch or a small set of patches that have a logical
division in between them.
 • If the change has been outstanding for a while, we may need to
rebase that thing ourselves before we land it.

We all agree not to push any more patches into darcs. Zooko made the
darcs repo read-only on tahoe-lafs.org.

We don't want to open up the buildslaves to running arbitrary code by
arbitrary github users, but we'll be satisfied with the security if:

1. A core developer has to approve code before it gets built (not that
the developer will carefully inspect it), and
2. There's an indelible history of what got built.


Git workflow:



1. contributor submits patches in a github pull request, github
auto-generates the merge to current master

2. human check (to discourage abuse), human chooses whether to add a
comment to the revision (not to the pull request) with the magic
string "Buildbot: GO!"

3. buildbot gets from github the merged-pull-request code and runs it,
reports back whether it passes tests

4. human, seeing that the pull-request passed tests, decides whether
to merge it into master

5. ? if master has changed since step 1, how do we restart steps 1 --
auto-generate the merge to current master, and step 3 -- buildbot
tests?


Brian thought of a security flaw which would allow an attacker to
cause arbitrary code to be run on all of our buildslaves. It might
affect other open source projects which have a similar setup as ours.


Zooko would like to upgrade https://tahoe-lafs.org to Trac 1.0
soonish. It includes a git network graph and builtin handling of git
and multiple git branches, among other UI improvements.


-- 
Regards,

Zooko Wilcox-O'Hearn

Founder, CEO, and Customer Support Rep

https://LeastAuthority.com