You are viewing a plain text version of this content. The canonical link for it is here.
Posted to general@incubator.apache.org by Sam Ruby <ru...@intertwingly.net> on 2017/01/16 18:05:33 UTC
LDAP changes to support podlings
TL;DR: We need to decide, for each PPMC, who gets to update the PPMC
list and where notifications to be sent on changes.
---
Background: we have a variety of tools that need access to PPMC member
lists, including but not limited to: gitbox, phonebook, ponymail,
roller, sonar, subversion, and whimsy.
The plan is to consolidate all of this to LDAP. Previously, a number of
'auth groups' were migrated from the subversion puppet definition to
LDAP. The plan is to do podlings next, and ultimately change the way
PMCs are stored in LDAP.
Currently the 'best' (as in machine readable) list of ppmc member
information is in the subversion puppet definition - even for podlings
that don't make use of subversion as this currently is the most
expeditious way to get ppmc member lists to show up in the the phonebook
application.
The cleanest list of mentors can be found in podlings.xml.
More complete, but less machine readable, and not always consistently
maintained information can be found on the individual
https://incubator.apache.org/projects/ pages.
---
gitbox, phonebook, ponymail, roller, sonar, subversion
Current status: for ppmcs that have lists in the subversion puppet
definitions, those lists have been loaded into LDAP, and augmented with
mentor information from podlings.xml. A list of all current podlings
can be found here, and those that have been loaded contain links to
individual pages:
https://whimsy.apache.org/roster/ppmc/
These pages are currently read-only, and contain links to the project
page, mailing lists, and prior published reports.
---
Near future: what we need to resolve is who should be the 'owners' and
who should be the 'members' for each PPMC. These are LDAP terms, and
they can be disjoint, overlapping, or even identical.
The key point is that owners can change membership of the lists, and
members are what gitbox, ponymail, roller, sonar, and subversion will
use for access control.
No matter what is decided, owners will be limited to adding and removing
people who are already committers; adding new ids entirely will still
require using the new account request web page. Furthermore, all change
will trigger notification to, at a minimum, root@. Additionally
notifying the individual affected, the private list for the podling, and
or the private list for the incubator are possibilities.
Given that these controls will be in place, allowing all members to also
be owners should be safe. Limiting owners to only mentors would also be
a valid choice. This need not be the same choice for all PPMCs, but it
probably would make life (and tooling) easier if it were.
Once this decision is made, the whimsy roster tool will be updated to
allow owners to update lists, and those owners will be asked to do so.
At that point, the subversion access lists in puppet will be converted
over to LDAP, and the infra team will stop accepting JIRA requests to
maintain these lists.
---
Not so distant future: the tools mentioned above will all be updated to
use the common LDAP definition for podling membership. As an example,
the phonebook application will include all podlings, with data
automatically updated within hours of a change.
The whimsy roster tool currently contains links to mailing lists and
posted board reports. It could be updated to include links to other
tools ranging from subscribing and unsubscribing to mailing lists to
static sonar analysis.
New tools could be built using this data: for example, all of the data
needed to draft board resolutions related to graduation could be
gathered from LDAP and podlings.xml.
---
Further in the future: PMC definitions will be changed to match the way
PPMC definitions are done. At the present time, only PMC chairs can
update PMC member and committer lists -- even for PMCs to which they
don't belong. Other PMC members who aren't PMC chairs can't update
their own lists.
- Sam Ruby
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: LDAP changes to support podlings
Posted by Sam Ruby <ru...@intertwingly.net>.
On Wed, Jan 18, 2017 at 8:51 PM, John D. Ament <jo...@apache.org> wrote:
> On Wed, Jan 18, 2017 at 8:25 PM Sam Ruby <ru...@intertwingly.net> wrote:
>
>> On Wed, Jan 18, 2017 at 1:37 PM, Felix Meschberger <fm...@adobe.com>
>> wrote:
>> >
>> > Hi Sam
>> >
>> > Like this very much. Thanks !
>> >
>> > Started doing that for OpenWhisk and realized some strange UI behaviour:
>> > To add a PPMC member I have to click + then search for the user, click
>> on +
>> > again and then click on „Add to PPMC“ button
>> >
>> > What is the reason for the last „Add to PPMC“ button click ? This somehow
>> > breaks the otherwise nice experience. Or would it be possible to
>> batch-add
>> > multiple members ?
>>
>> Not an excuse, but some insight: this code is largely shared with the
>> code to manage PMCs, and was designed in anticipation of supporting
>> somebody who infrequently uses this interface. If you are adding a
>> single person to a PMC, it is helpful to have confirmations every step
>> of the way. And for PMCs, there is an option to add a person only as
>> a committer or as a committer and to the PMC, so that's the reason for
>> the extra step.
>>
>> The plans are to open up the PMC interface to all members of the PMC,
>> and not just PMC chairs.
>>
>> No question that the PPMC interface can be streamlined, but let's let
>> the current code 'bake' for a brief period before trying to improve
>> it.
>>
>>
> Maybe you can provide us a file to update to fill in the gaps. Once that
> file is imported we turn on the UI.
I've committed a change that allows multiple people to be added to a
PPMC with a single confirmation.
Later, when I revisit PMC updates, I'll likely backport this change there too.
>> > Thanks
>> > Felix
>>
>> - Sam Ruby
- Sam Ruby
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: LDAP changes to support podlings
Posted by "John D. Ament" <jo...@apache.org>.
On Wed, Jan 18, 2017 at 8:25 PM Sam Ruby <ru...@intertwingly.net> wrote:
> On Wed, Jan 18, 2017 at 1:37 PM, Felix Meschberger <fm...@adobe.com>
> wrote:
> >
> > Hi Sam
> >
> > Like this very much. Thanks !
> >
> > Started doing that for OpenWhisk and realized some strange UI behaviour:
> > To add a PPMC member I have to click + then search for the user, click
> on +
> > again and then click on „Add to PPMC“ button
> >
> > What is the reason for the last „Add to PPMC“ button click ? This somehow
> > breaks the otherwise nice experience. Or would it be possible to
> batch-add
> > multiple members ?
>
> Not an excuse, but some insight: this code is largely shared with the
> code to manage PMCs, and was designed in anticipation of supporting
> somebody who infrequently uses this interface. If you are adding a
> single person to a PMC, it is helpful to have confirmations every step
> of the way. And for PMCs, there is an option to add a person only as
> a committer or as a committer and to the PMC, so that's the reason for
> the extra step.
>
> The plans are to open up the PMC interface to all members of the PMC,
> and not just PMC chairs.
>
> No question that the PPMC interface can be streamlined, but let's let
> the current code 'bake' for a brief period before trying to improve
> it.
>
>
Maybe you can provide us a file to update to fill in the gaps. Once that
file is imported we turn on the UI.
> > Thanks
> > Felix
>
> - Sam Ruby
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>
Re: LDAP changes to support podlings
Posted by Sam Ruby <ru...@intertwingly.net>.
On Wed, Jan 18, 2017 at 1:37 PM, Felix Meschberger <fm...@adobe.com> wrote:
>
> Hi Sam
>
> Like this very much. Thanks !
>
> Started doing that for OpenWhisk and realized some strange UI behaviour:
> To add a PPMC member I have to click + then search for the user, click on +
> again and then click on „Add to PPMC“ button
>
> What is the reason for the last „Add to PPMC“ button click ? This somehow
> breaks the otherwise nice experience. Or would it be possible to batch-add
> multiple members ?
Not an excuse, but some insight: this code is largely shared with the
code to manage PMCs, and was designed in anticipation of supporting
somebody who infrequently uses this interface. If you are adding a
single person to a PMC, it is helpful to have confirmations every step
of the way. And for PMCs, there is an option to add a person only as
a committer or as a committer and to the PMC, so that's the reason for
the extra step.
The plans are to open up the PMC interface to all members of the PMC,
and not just PMC chairs.
No question that the PPMC interface can be streamlined, but let's let
the current code 'bake' for a brief period before trying to improve
it.
> Thanks
> Felix
- Sam Ruby
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: LDAP changes to support podlings
Posted by Greg Stein <gs...@gmail.com>.
I agree with Felix that too many confirmations exist in the workflow right
now, but it worked great. And I was able to correct some missing people on
the mynewt PPMC. Yay!
On Wed, Jan 18, 2017 at 1:37 PM, Felix Meschberger <fm...@adobe.com>
wrote:
> Hi Sam
>
> Like this very much. Thanks !
>
> Started doing that for OpenWhisk and realized some strange UI behaviour:
> To add a PPMC member I have to click + then search for the user, click on +
> again and then click on „Add to PPMC“ button
>
> What is the reason for the last „Add to PPMC“ button click ? This somehow
> breaks the otherwise nice experience. Or would it be possible to batch-add
> multiple members ?
>
> Thanks
> Felix
>
> > Am 18.01.2017 um 17:07 schrieb Sam Ruby <ru...@intertwingly.net>:
> >
> > On Mon, Jan 16, 2017 at 1:05 PM, Sam Ruby <ru...@intertwingly.net>
> wrote:
> >> Current status: for ppmcs that have lists in the subversion puppet
> >> definitions, those lists have been loaded into LDAP, and augmented with
> >> mentor information from podlings.xml. A list of all current podlings
> can be
> >> found here, and those that have been loaded contain links to individual
> >> pages:
> >>
> >> https://whimsy.apache.org/roster/ppmc/
> >>
> >> These pages are currently read-only, and contain links to the project
> page,
> >> mailing lists, and prior published reports.
> >
> > These pages are now live. If you are a mentor of a podling, please go
> > in and add ppmc members. Or add one ppmc member and ask them to add
> > the rest. :-) Or simply verify that the list is accurate if it was
> > seeded from the authentication lists in the puppet configuration.
> >
> > Note: for the moment, private@incubator will be copied on all changes.
> > Once things have been verified as working, this will be removed.
> >
> > - Sam Ruby
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > For additional commands, e-mail: general-help@incubator.apache.org
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
Re: LDAP changes to support podlings
Posted by Felix Meschberger <fm...@adobe.com>.
Hi Sam
Like this very much. Thanks !
Started doing that for OpenWhisk and realized some strange UI behaviour: To add a PPMC member I have to click + then search for the user, click on + again and then click on „Add to PPMC“ button
What is the reason for the last „Add to PPMC“ button click ? This somehow breaks the otherwise nice experience. Or would it be possible to batch-add multiple members ?
Thanks
Felix
> Am 18.01.2017 um 17:07 schrieb Sam Ruby <ru...@intertwingly.net>:
>
> On Mon, Jan 16, 2017 at 1:05 PM, Sam Ruby <ru...@intertwingly.net> wrote:
>> Current status: for ppmcs that have lists in the subversion puppet
>> definitions, those lists have been loaded into LDAP, and augmented with
>> mentor information from podlings.xml. A list of all current podlings can be
>> found here, and those that have been loaded contain links to individual
>> pages:
>>
>> https://whimsy.apache.org/roster/ppmc/
>>
>> These pages are currently read-only, and contain links to the project page,
>> mailing lists, and prior published reports.
>
> These pages are now live. If you are a mentor of a podling, please go
> in and add ppmc members. Or add one ppmc member and ask them to add
> the rest. :-) Or simply verify that the list is accurate if it was
> seeded from the authentication lists in the puppet configuration.
>
> Note: for the moment, private@incubator will be copied on all changes.
> Once things have been verified as working, this will be removed.
>
> - Sam Ruby
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: LDAP changes to support podlings
Posted by Sam Ruby <ru...@intertwingly.net>.
On Mon, Jan 16, 2017 at 1:05 PM, Sam Ruby <ru...@intertwingly.net> wrote:
> Current status: for ppmcs that have lists in the subversion puppet
> definitions, those lists have been loaded into LDAP, and augmented with
> mentor information from podlings.xml. A list of all current podlings can be
> found here, and those that have been loaded contain links to individual
> pages:
>
> https://whimsy.apache.org/roster/ppmc/
>
> These pages are currently read-only, and contain links to the project page,
> mailing lists, and prior published reports.
These pages are now live. If you are a mentor of a podling, please go
in and add ppmc members. Or add one ppmc member and ask them to add
the rest. :-) Or simply verify that the list is accurate if it was
seeded from the authentication lists in the puppet configuration.
Note: for the moment, private@incubator will be copied on all changes.
Once things have been verified as working, this will be removed.
- Sam Ruby
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: LDAP changes to support podlings
Posted by Sam Ruby <ru...@intertwingly.net>.
On Tue, Jan 17, 2017 at 1:57 PM, John D. Ament <jo...@apache.org> wrote:
> On Tue, Jan 17, 2017 at 1:11 PM Sam Ruby <ru...@intertwingly.net> wrote:
>
>> On Mon, Jan 16, 2017 at 1:31 PM, Stian Soiland-Reyes <st...@apache.org>
>> wrote:
>> > Not sure what was the decision to be made here, but +1 to all
>> suggestions.
>> > All of PPMC as podling owners makes sense to me as long as
>> private@podling
>> > is notified.
>>
>> The following four podlings don't have private@podling lists:
>> ["log4cxx2", "odftoolkit", "ratis"].
>>
> private@logging and odf-private.
>
>> ratis being a clear example of 'not yet'.
>>
>> So a revised approach: emails go to private@podling list, if there is
>> one. If not, it goes to the designated private list (e.g.
>> private@logging). If there are no such private list designated, it
>> goes to private@incubator.
>>
>
> It sounds like we need to have an attribute for the private list.
Currently I have this implemented via code:
https://github.com/apache/whimsy/blob/master/lib/whimsy/asf/podlings.rb#L155
https://github.com/apache/whimsy/blob/master/lib/whimsy/asf/podlings.rb#L173
Note that this code supports both dev and private lists. Also note
that while the code could be reduced if there were an attribute that
could be queried for this purpose, I don't think it can ever be
entirely eliminated as there will always be windows where (for
example) the ratis list hasn't been created yet.
- Sam Ruby
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: LDAP changes to support podlings
Posted by "John D. Ament" <jo...@apache.org>.
On Tue, Jan 17, 2017 at 1:11 PM Sam Ruby <ru...@intertwingly.net> wrote:
> On Mon, Jan 16, 2017 at 1:31 PM, Stian Soiland-Reyes <st...@apache.org>
> wrote:
> > Not sure what was the decision to be made here, but +1 to all
> suggestions.
> > All of PPMC as podling owners makes sense to me as long as
> private@podling
> > is notified.
>
> The following four podlings don't have private@podling lists:
> ["log4cxx2", "odftoolkit", "ratis"].
>
>
private@logging and odf-private.
> ratis being a clear example of 'not yet'.
>
> So a revised approach: emails go to private@podling list, if there is
> one. If not, it goes to the designated private list (e.g.
> private@logging). If there are no such private list designated, it
> goes to private@incubator.
>
It sounds like we need to have an attribute for the private list.
>
> If people would like, I could always copy private@incubator on all
> changes for additional oversight. That might be a bit much, however.
>
> - Sam Ruby
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>
Re: LDAP changes to support podlings
Posted by Sam Ruby <ru...@intertwingly.net>.
On Mon, Jan 16, 2017 at 1:31 PM, Stian Soiland-Reyes <st...@apache.org> wrote:
> Not sure what was the decision to be made here, but +1 to all suggestions.
> All of PPMC as podling owners makes sense to me as long as private@podling
> is notified.
The following four podlings don't have private@podling lists:
["log4cxx2", "odftoolkit", "ratis"].
ratis being a clear example of 'not yet'.
So a revised approach: emails go to private@podling list, if there is
one. If not, it goes to the designated private list (e.g.
private@logging). If there are no such private list designated, it
goes to private@incubator.
If people would like, I could always copy private@incubator on all
changes for additional oversight. That might be a bit much, however.
- Sam Ruby
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: LDAP changes to support podlings
Posted by Stian Soiland-Reyes <st...@apache.org>.
Not sure what was the decision to be made here, but +1 to all suggestions.
All of PPMC as podling owners makes sense to me as long as private@podling
is notified.
Great work!
On 16 Jan 2017 6:05 pm, "Sam Ruby" <ru...@intertwingly.net> wrote:
> TL;DR: We need to decide, for each PPMC, who gets to update the PPMC list
> and where notifications to be sent on changes.
>
> ---
>
> Background: we have a variety of tools that need access to PPMC member
> lists, including but not limited to: gitbox, phonebook, ponymail, roller,
> sonar, subversion, and whimsy.
>
> The plan is to consolidate all of this to LDAP. Previously, a number of
> 'auth groups' were migrated from the subversion puppet definition to LDAP.
> The plan is to do podlings next, and ultimately change the way PMCs are
> stored in LDAP.
>
> Currently the 'best' (as in machine readable) list of ppmc member
> information is in the subversion puppet definition - even for podlings that
> don't make use of subversion as this currently is the most expeditious way
> to get ppmc member lists to show up in the the phonebook application.
>
> The cleanest list of mentors can be found in podlings.xml.
>
> More complete, but less machine readable, and not always consistently
> maintained information can be found on the individual
> https://incubator.apache.org/projects/ pages.
>
> ---
> gitbox, phonebook, ponymail, roller, sonar, subversion
> Current status: for ppmcs that have lists in the subversion puppet
> definitions, those lists have been loaded into LDAP, and augmented with
> mentor information from podlings.xml. A list of all current podlings can
> be found here, and those that have been loaded contain links to individual
> pages:
>
> https://whimsy.apache.org/roster/ppmc/
>
> These pages are currently read-only, and contain links to the project
> page, mailing lists, and prior published reports.
>
> ---
>
> Near future: what we need to resolve is who should be the 'owners' and who
> should be the 'members' for each PPMC. These are LDAP terms, and they can
> be disjoint, overlapping, or even identical.
>
> The key point is that owners can change membership of the lists, and
> members are what gitbox, ponymail, roller, sonar, and subversion will use
> for access control.
>
> No matter what is decided, owners will be limited to adding and removing
> people who are already committers; adding new ids entirely will still
> require using the new account request web page. Furthermore, all change
> will trigger notification to, at a minimum, root@. Additionally
> notifying the individual affected, the private list for the podling, and or
> the private list for the incubator are possibilities.
>
> Given that these controls will be in place, allowing all members to also
> be owners should be safe. Limiting owners to only mentors would also be a
> valid choice. This need not be the same choice for all PPMCs, but it
> probably would make life (and tooling) easier if it were.
>
> Once this decision is made, the whimsy roster tool will be updated to
> allow owners to update lists, and those owners will be asked to do so. At
> that point, the subversion access lists in puppet will be converted over to
> LDAP, and the infra team will stop accepting JIRA requests to maintain
> these lists.
>
> ---
>
> Not so distant future: the tools mentioned above will all be updated to
> use the common LDAP definition for podling membership. As an example, the
> phonebook application will include all podlings, with data automatically
> updated within hours of a change.
>
> The whimsy roster tool currently contains links to mailing lists and
> posted board reports. It could be updated to include links to other tools
> ranging from subscribing and unsubscribing to mailing lists to static sonar
> analysis.
>
> New tools could be built using this data: for example, all of the data
> needed to draft board resolutions related to graduation could be gathered
> from LDAP and podlings.xml.
>
> ---
>
> Further in the future: PMC definitions will be changed to match the way
> PPMC definitions are done. At the present time, only PMC chairs can update
> PMC member and committer lists -- even for PMCs to which they don't
> belong. Other PMC members who aren't PMC chairs can't update their own
> lists.
>
> - Sam Ruby
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>