As Ryan mentioned in an email to another list a couple weeks ago:
Everyone with access to create svn accounts can also link them to Labs accounts. Feel free to make Labs accounts. Also feel free to add users to the bastion project, and to any other project you are a member of. Unless the user needs/wants Labs access, don't give them bastion or other project access by default, though.
It seems to me that the list of people who can make SVN accounts is unclear to the average newbie -- https://meta.wikimedia.org/wiki/System_administrators doesn't have me on it. Is there a better list?
How to make a Labs account: https://wikitech.wikimedia.org/view/OpenStack#Wiki_access which I am about to merge into https://labsconsole.wikimedia.org/wiki/Help:Access .
Hi,
Am Montag, 27. Februar 2012 schrieb Sumana Harihareswara:
As Ryan mentioned in an email to another list a couple weeks ago:
Everyone with access to create svn accounts can also link them to Labs accounts. Feel free to make Labs accounts. Also feel free to add users to the bastion project, and to any other project you are a member of. Unless the user needs/wants Labs access, don't give them bastion or other project access by default, though.
It seems to me that the list of people who can make SVN accounts is unclear to the average newbie -- https://meta.wikimedia.org/wiki/System_administrators doesn't have me on it. Is there a better list?
How to make a Labs account: https://wikitech.wikimedia.org/view/OpenStack#Wiki_access which I am about to merge into https://labsconsole.wikimedia.org/wiki/Help:Access .
on IRC, Ryan mentioned that switching all SVN users over to Gerrit is too much work for one single person. So maybe it would be nice to have a request queue (say, in the form of a wiki page on mediawiki.org), as opposed to everone wanting a gerrit account bugging the first person on whatever list makes it?
Alexander
Surely this could be scripted.
-Chad On Feb 27, 2012 6:07 PM, "Alexander Klauer" Graf.Zahl@gmx.net wrote:
Hi,
Am Montag, 27. Februar 2012 schrieb Sumana Harihareswara:
As Ryan mentioned in an email to another list a couple weeks ago:
Everyone with access to create svn accounts can also link them to Labs accounts. Feel free to make Labs accounts. Also feel free to add users to the bastion project, and to any other project you are a member of. Unless the user needs/wants Labs access, don't give them bastion or other project access by default, though.
It seems to me that the list of people who can make SVN accounts is unclear to the average newbie -- https://meta.wikimedia.org/wiki/System_administrators doesn't have me on it. Is there a better list?
How to make a Labs account: https://wikitech.wikimedia.org/view/OpenStack#Wiki_access which I am about to merge into https://labsconsole.wikimedia.org/wiki/Help:Access .
on IRC, Ryan mentioned that switching all SVN users over to Gerrit is too much work for one single person. So maybe it would be nice to have a request queue (say, in the form of a wiki page on mediawiki.org), as opposed to everone wanting a gerrit account bugging the first person on whatever list makes it?
Alexander
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
As long as everyone's information is known in advance, it can be scripted, yes.
On Mon, Feb 27, 2012 at 3:09 PM, Chad innocentkiller@gmail.com wrote:
Surely this could be scripted.
-Chad On Feb 27, 2012 6:07 PM, "Alexander Klauer" Graf.Zahl@gmx.net wrote:
Hi,
Am Montag, 27. Februar 2012 schrieb Sumana Harihareswara:
As Ryan mentioned in an email to another list a couple weeks ago:
Everyone with access to create svn accounts can also link them to Labs accounts. Feel free to make Labs accounts. Also feel free to add users to the bastion project, and to any other project you are a member of. Unless the user needs/wants Labs access, don't give them bastion or other project access by default, though.
It seems to me that the list of people who can make SVN accounts is unclear to the average newbie -- https://meta.wikimedia.org/wiki/System_administrators doesn't have me on it. Is there a better list?
How to make a Labs account: https://wikitech.wikimedia.org/view/OpenStack#Wiki_access which I am about to merge into https://labsconsole.wikimedia.org/wiki/Help:Access .
on IRC, Ryan mentioned that switching all SVN users over to Gerrit is too much work for one single person. So maybe it would be nice to have a request queue (say, in the form of a wiki page on mediawiki.org), as opposed to everone wanting a gerrit account bugging the first person on whatever list makes it?
Alexander
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
On Tue, Feb 28, 2012 at 10:37 AM, Ryan Lane rlane32@gmail.com wrote:
As long as everyone's information is known in advance, it can be scripted, yes.
On Mon, Feb 27, 2012 at 3:09 PM, Chad innocentkiller@gmail.com wrote:
Surely this could be scripted.
-Chad
Does they all need new accounts created? perhaps this might be a chance to see who actually still want/needs them?
Am Dienstag, 28. Februar 2012 schrieb K. Peachey:
On Tue, Feb 28, 2012 at 10:37 AM, Ryan Lane rlane32@gmail.com wrote:
As long as everyone's information is known in advance, it can be scripted, yes.
On Mon, Feb 27, 2012 at 3:09 PM, Chad innocentkiller@gmail.com
wrote:
Surely this could be scripted.
-Chad
Does they all need new accounts created? perhaps this might be a chance to see who actually still want/needs them?
Perhaps all these suggestions can be combined. Prospective gerrit users must somehow convey their information (quoting wm-bot: "I need the following info from you: 1. Your preferred wiki user name. This will also be your git username, so if you'd prefer this to be your real name, then provide your real name. 2. Your preferred email address. 3. Your SVN account name, or your preferred shell account name, if you do not have SVN access."). They can do so on a wiki page through a template. A script then regularly checks the page and processes new requests. Those who do not bother with their account any more will not add themselves to the page, resulting in a decrufted gerrit user base.
Alexander
Could mimic what we did here: https://www.mediawiki.org/wiki/Git/New_repositories#Step_3:_Request_space_fo...
-greg aka varnent
On Feb 28, 2012, at 7:13 AM, Alexander Klauer wrote:
Am Dienstag, 28. Februar 2012 schrieb K. Peachey:
On Tue, Feb 28, 2012 at 10:37 AM, Ryan Lane rlane32@gmail.com wrote:
As long as everyone's information is known in advance, it can be scripted, yes.
On Mon, Feb 27, 2012 at 3:09 PM, Chad innocentkiller@gmail.com
wrote:
Surely this could be scripted.
-Chad
Does they all need new accounts created? perhaps this might be a chance to see who actually still want/needs them?
Perhaps all these suggestions can be combined. Prospective gerrit users must somehow convey their information (quoting wm-bot: "I need the following info from you: 1. Your preferred wiki user name. This will also be your git username, so if you'd prefer this to be your real name, then provide your real name. 2. Your preferred email address. 3. Your SVN account name, or your preferred shell account name, if you do not have SVN access."). They can do so on a wiki page through a template. A script then regularly checks the page and processes new requests. Those who do not bother with their account any more will not add themselves to the page, resulting in a decrufted gerrit user base.
Alexander
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
On Tue, Feb 28, 2012 at 7:20 AM, Gregory Varnum gregory.varnum@gmail.com wrote:
Could mimic what we did here: https://www.mediawiki.org/wiki/Git/New_repositories#Step_3:_Request_space_fo...
I think as long as this is only for people who currently have svn and want git/gerrit we could do this.
In the long run, I'd rather not have this be such a manual process and we could allow open registration to the services tied to LDAP (that's waiting on some work to make ConfirmAccount behave properly with LDAPAuthentication, if I'm right?)
-Chad
On Tue, Feb 28, 2012 at 4:46 AM, Chad innocentkiller@gmail.com wrote:
On Tue, Feb 28, 2012 at 7:20 AM, Gregory Varnum gregory.varnum@gmail.com wrote:
Could mimic what we did here: https://www.mediawiki.org/wiki/Git/New_repositories#Step_3:_Request_space_fo...
I think as long as this is only for people who currently have svn and want git/gerrit we could do this.
In the long run, I'd rather not have this be such a manual process and we could allow open registration to the services tied to LDAP (that's waiting on some work to make ConfirmAccount behave properly with LDAPAuthentication, if I'm right?)
I'm not sure we need ConfirmAccount, unless it's to combat spam. I don't see any reason we can't let anyone register. It may be beneficial to require some kind of sanity-check group for access to labs, but push access to gerrit should be open to anyone who wants an account.
- Ryan
On Tue, Feb 28, 2012 at 1:11 PM, Ryan Lane rlane32@gmail.com wrote:
I'm not sure we need ConfirmAccount, unless it's to combat spam. I don't see any reason we can't let anyone register. It may be beneficial to require some kind of sanity-check group for access to labs, but push access to gerrit should be open to anyone who wants an account.
I thought that was the general idea, to avoid spam accounts. If we can do this by other means then let's go for that.
If we're paranoid, we can hide gerrit permissions behind a group that can be liberally given out with UserRights, to make sure to avoid spam.
-Chad
On 02/28/2012 01:11 PM, Ryan Lane wrote:
On Tue, Feb 28, 2012 at 4:46 AM, Chad innocentkiller@gmail.com wrote:
On Tue, Feb 28, 2012 at 7:20 AM, Gregory Varnum gregory.varnum@gmail.com wrote:
Could mimic what we did here: https://www.mediawiki.org/wiki/Git/New_repositories#Step_3:_Request_space_fo...
I think as long as this is only for people who currently have svn and want git/gerrit we could do this.
In the long run, I'd rather not have this be such a manual process and we could allow open registration to the services tied to LDAP (that's waiting on some work to make ConfirmAccount behave properly with LDAPAuthentication, if I'm right?)
I'm not sure we need ConfirmAccount, unless it's to combat spam. I don't see any reason we can't let anyone register. It may be beneficial to require some kind of sanity-check group for access to labs, but push access to gerrit should be open to anyone who wants an account.
- Ryan
I agree 100% that push access to gerrit should be open to anyone who wants an account. I also personally think that we should mass-issue Gerrit accounts to all existing SVN committers. My hunch is that the possible clutter issue is far outweighed by our interest in ensuring that everyone with any interest in Wikimedia development, past or present, experiences few barriers to continued contribution. But if clutter is a serious issue for some reason, I'd like to hear about it.
OK, so my understanding going forward is:
* Right now, everyone listed at https://meta.wikimedia.org/wiki/System_administrators as having shell access can make a Gerrit/Labsconsole account, and should say yes to everyone who asks, except for known malicious persons. There is no other publicly available list that's better, so this is the list of people newbies can ping to ask for accounts. * Instead of relying on pinging individuals, it would be nice if there were a queue/requests page, but there is none right now. * We have to decide whether to just create Gerrit accounts for all existing SVN committers. Chad has the committer USERINFO necessary to create Gerrit accounts for nearly all our SVN committers, but not all. * Chad and Ryan are interested in improving the signup process so that anyone can register for an account without having to ask a gatekeeper, but there's no timeline for this. * After the switch, if anyone submits a patch in Bugzilla, we should encourage them to get a Gerrit account and just push there in the future.
If I'm wrong on any of these, tell me.
I think there was an interest for making bugzilla patches into gerrit automatically. That should make the need for a gerrit account much smaller.
On 02/28/2012 02:47 PM, Platonides wrote:
I think there was an interest for making bugzilla patches into gerrit automatically. That should make the need for a gerrit account much smaller.
That is Rusty Burchfield. I believe he was working on this a little bit at the SF hackathon. He said in an email to me last week (he said it was ok to forward):
Currently there is some basic code up on GitHub that is capable of grabbing patches from Bugzilla and testing to see if they apply on trunk.
If you saw the post I made to wikitech a while back, that functionality is basically the same. However, it is available as a gem with fewer dependencies on this branch. https://github.com/GICodeWarrior/patch-tester/tree/gemify
Once Git and Gerrit are operational, the code could be modified to apply the patches to trunk, and push them up into Gerrit for review and testing.
If you are interested in hacking on or taking over any of this stuff,
feel free.
He's referring to "[Wikitech-l] Patch backlog automation" from November, I believe:
Basically I fetch pages with curb(libcurl) and pull out what I need with nokogiri(libxml2) and some css selectors. Then I take each patch and attempt an exhaustive search (after trying the easy cases) to see if it will apply.
Mark says:
Ideally, I would like to have this integrated into a Bugzilla (which would mean Perl, probably) or Gerrit (which would mean Java or, maybe, JRuby).
Given that we currently have about 130 patches awaiting review on MediaWiki core, and about 60 for extensions that WMF deploys (some going back years), I think it's going to make a big difference to surface those and put them into the same dashboard that reviewers use to see all the pending pull requests. So if Rusty or another contributor has time to work on this, I think it would have a dramatic effect on our patch backlog.
On Wed, Feb 29, 2012 at 4:24 AM, Sumana Harihareswara sumanah@wikimedia.org wrote:
... snip... https://meta.wikimedia.org/wiki/System_administrators as having shell access can make a Gerrit/Labsconsole account, and should say yes to everyone who asks, except for known malicious persons.
Doubt there would be that many (although I haven't seen the Queue since it went private) that would apply for malicious reasons, Although I do know of one account in SVN although they are globally blocked (or were), they have since been doing [apparently] wonderful work on one of the languages(?) movements/groups/committee and have AFAIK never missed used their commit access. So I don't think they would be a problem nor should a few blocks really count if they contribute in other methods that havn't caused issues.
On 28 February 2012 20:24, Sumana Harihareswara sumanah@wikimedia.org wrote:
OK, so my understanding going forward is:
- Right now, everyone listed at
https://meta.wikimedia.org/wiki/System_administrators as having shell access can make a Gerrit/Labsconsole account, and should say yes to everyone who asks, except for known malicious persons. There is no other publicly available list that's better, so this is the list of people newbies can ping to ask for accounts.
If I'm wrong on any of these, tell me.
I don't think that list is up to date. I also think that not everyone who has access knows how to do that or want to do that. -Niklas
I don't think that list is up to date. I also think that not everyone who has access knows how to do that or want to do that.
The puppet repo (in manifests/site.pp) is the most accurate way of finding this:
706 $sudo_privs = [ 'ALL = NOPASSWD: /usr/local/sbin/add-ldap-user', 707 'ALL = NOPASSWD: /usr/local/sbin/delete-ldap-user', 708 'ALL = NOPASSWD: /usr/local/sbin/modify-ldap-user', 709 'ALL = NOPASSWD: /usr/local/bin/svn-group', 710 'ALL = NOPASSWD: /usr/local/sbin/add-labs-user' ] 711 sudo_user { [ "demon", "robla", "sumanah", "reedy" ]: privileges => $sudo_privs }
So, other than ops (who rarely makes SVN accounts, and likely shouldn't be making Gerrit accounts for the git switchover), it's Chad, Sumana, Rob (La), and Sam Reed. Tim also often handed out SVN accounts, but isn't in this list since he has full root access.
- Ryan
I originally wrote:
- Right now, everyone listed at
https://meta.wikimedia.org/wiki/System_administrators as having shell access can make a Gerrit/Labsconsole account, and should say yes to everyone who asks, except for known malicious persons. There is no other publicly available list that's better, so this is the list of people newbies can ping to ask for accounts.
I've updated https://labsconsole.wikimedia.org/wiki/Help:Access#Access_FAQ with the new list of names, but everything else in my summary is still accurate.
- Instead of relying on pinging individuals, it would be nice if there
were a queue/requests page, but there is none right now.
Still true. I will make one next week.
- We have to decide whether to just create Gerrit accounts for all
existing SVN committers. Chad has the committer USERINFO necessary to create Gerrit accounts for nearly all our SVN committers, but not all.
I've decided that we shall just create Gerrit accounts for all the SVN committers who already have email addresses listed in their Subversion USERINFO. Ryan can script that for me and will do that next week. Then we'll mention that on wikitech-l and via other communications channels, and they can go to https://labsconsole.wikimedia.org/wiki/Special:PasswordReset to get a password and login. Even if it's only half of the committers, that's still 200 accounts we don't have to create.
- Chad and Ryan are interested in improving the signup process so that
anyone can register for an account without having to ask a gatekeeper, but there's no timeline for this.
This is still true.
- After the switch, if anyone submits a patch in Bugzilla, we should
encourage them to get a Gerrit account and just push there in the future.
This is still our plan. Also: There's no autolinking from Gerrit to Bugzilla yet, but we'll work on it (bug 35144). For now, when referring to a Git diff, please paste changeset "Change ID"s, or the changeset number in the Gerrit changeset URL, into the BZ comment. Both are globally unique.
This page seems to be absolutely pointless and also incorrect, since the production is managed by operation team which contains a lot of people who aren't on this list. Actually I don't even know why do we need to have such a list somewhere on meta, they should be located on same page together with rest of employees, as many of current operation engineers are now. Also since we are moving the development to wikimedia labs, having shell on production wouldn't mean so much. All the changes to sw and configuration are going to be done in labs and later merged to production.
On Mon, Feb 27, 2012 at 10:28 PM, Sumana Harihareswara < sumanah@wikimedia.org> wrote:
It seems to me that the list of people who can make SVN accounts is unclear to the average newbie -- https://meta.wikimedia.org/wiki/System_administrators doesn't have me on it. Is there a better list?
On Wed, Feb 29, 2012 at 8:51 AM, Petr Bena benapetr@gmail.com wrote:
This page seems to be absolutely pointless and also incorrect, since the production is managed by operation team which contains a lot of people who aren't on this list. Actually I don't even know why do we need to have such a list somewhere on meta, they should be located on same page together with rest of employees, as many of current operation engineers are now. Also since we are moving the development to wikimedia labs, having shell on production wouldn't mean so much. All the changes to sw and configuration are going to be done in labs and later merged to production.
Labs doesn't fix "I'm getting a strange error on the cluster" that requires digging into log files. Or "Oh crap, this is broken, can you please deploy Foo fix really quick?"
So yes, having such a list *does* matter. If it's missing names, add them, don't nuke the page.
-Chad
Right, but the page says: don't contact people on this page, go to irc. So question is if having such a list really help the users who seek help.
On Wed, Feb 29, 2012 at 3:22 PM, Chad innocentkiller@gmail.com wrote:
On Wed, Feb 29, 2012 at 8:51 AM, Petr Bena benapetr@gmail.com wrote:
This page seems to be absolutely pointless and also incorrect, since the production is managed by operation team which contains a lot of people
who
aren't on this list. Actually I don't even know why do we need to have
such
a list somewhere on meta, they should be located on same page together
with
rest of employees, as many of current operation engineers are now. Also since we are moving the development to wikimedia labs, having shell on production wouldn't mean so much. All the changes to sw and configuration are going to be done in labs and later merged to production.
Labs doesn't fix "I'm getting a strange error on the cluster" that requires digging into log files. Or "Oh crap, this is broken, can you please deploy Foo fix really quick?"
So yes, having such a list *does* matter. If it's missing names, add them, don't nuke the page.
-Chad
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
On Wed, Feb 29, 2012 at 9:24 AM, Petr Bena benapetr@gmail.com wrote:
Right, but the page says: don't contact people on this page, go to irc. So question is if having such a list really help the users who seek help.
Yes, but at least you have an idea of who to look for (hence the IRC nicks). This is a solution in search of a problem.
-Chad
OK, in that case we should update the list with more "functions", beside svn etc, to "LDAP admin", or whatever what is needed to create accounts for labs and such, and insert all missing people, like Sumana, Ryan, Sara...
On Wed, Feb 29, 2012 at 3:26 PM, Chad innocentkiller@gmail.com wrote:
On Wed, Feb 29, 2012 at 9:24 AM, Petr Bena benapetr@gmail.com wrote:
Right, but the page says: don't contact people on this page, go to irc.
So
question is if having such a list really help the users who seek help.
Yes, but at least you have an idea of who to look for (hence the IRC nicks). This is a solution in search of a problem.
-Chad
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
On 29 February 2012 14:27, Petr Bena benapetr@gmail.com wrote:
OK, in that case we should update the list with more "functions", beside svn etc, to "LDAP admin", or whatever what is needed to create accounts for labs and such, and insert all missing people, like Sumana, Ryan, Sara...
https://meta.wikimedia.org/w/index.php?title=System_administrators&actio...
The main purpose of that page is as an on-wiki reference to wiki user accounts which might be encountered making sysadmin actions, as explained in the first section of that page. "Don't revert sysadmin actions" is effectively a global policy, and the page serves an important function in describing that policy. As with all wiki pages on meta, it is intended mainly for WMF wiki-users, not developers (otherwise it would belong on mw.org).
--HM
Le 29/02/12 15:26, Chad a écrit :
Yes, but at least you have an idea of who to look for (hence the IRC nicks). This is a solution in search of a problem.
Can't we make Chanserv to +v shell users and +o root users ? That will make it obvious to anyone looking for us :-D
Most root are already channels admin IIRC. +v does no harm.
On Thu, Mar 1, 2012 at 5:14 AM, Antoine Musso hashar+wmf@free.fr wrote:
Can't we make Chanserv to +v shell users and +o root users ? That will make it obvious to anyone looking for us :-D
Most root are already channels admin IIRC. +v does no harm.
+v is fine. At the risk of sounding pedantic, I'll point out the freenode policy frowns on leaving people +o when it's not needed (although I find the policy kind of silly).
-Chad
That policy doesn't make sense, especially given to number of services outages when it's not possible to op yourself, also it's quite annoying when you have to op / mode / deop yourself instead of just doing op work. However I don't see a reason to make people with root look different than others since most of regular users have no idea what is root actually needed for. If you have access to merge changes on puppet, you have root powers anyway.
On Thu, Mar 1, 2012 at 4:06 PM, Chad innocentkiller@gmail.com wrote:
On Thu, Mar 1, 2012 at 5:14 AM, Antoine Musso hashar+wmf@free.fr wrote:
Can't we make Chanserv to +v shell users and +o root users ? That will
make
it obvious to anyone looking for us :-D
Most root are already channels admin IIRC. +v does no harm.
+v is fine. At the risk of sounding pedantic, I'll point out the freenode policy frowns on leaving people +o when it's not needed (although I find the policy kind of silly).
-Chad
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
On Thu, Mar 1, 2012 at 5:06 PM, Chad innocentkiller@gmail.com wrote:
+v is fine. At the risk of sounding pedantic, I'll point out the freenode policy frowns on leaving people +o when it's not needed (although I find the policy kind of silly).
Guideline, _not_ policy. See http://freenode.net/channel_guidelines.shtml .
I have to say that in my experience, having people with +v and/or +o (I prefer +o, because in the case of active ops, they can remove trolls etc. faster since they don't need to do a /cs op first) is more helpful than harmful. Admittedly, there's the possibility that new users might, for example, PM opped or voiced people with their (general) questions instead of asking the questions in public, but I think we do a good job at encouraging open, public, logged discussion.
Still, +1 for having opped people on #mediawiki. That being said, we probably should take this into a separate thread instead of hijacking this...
Thanks and regards, -- Jack Phoenix MediaWiki developer
wikitech-l@lists.wikimedia.org