helping out with merge reviews and issue triage

[anarcat]

hi

there seems to be some people around here that could be useful to help out with bug triage, documentation and issue review. having submitted #155 and others and waiting for it for a few weeks, I do feel there is a worrisome bottleneck there, especially if we end up in a situation where there is an urgent security fix to push through (for example).

wouldn't it be a good idea to start opening up access to the repository or at least issue queue? github supports organisations that could reflect such a workflow. unfortunately, access control isn't very granular in those setups so may this repo could keep on being the canonical repository until trust is build up? the atticbackup namespace is free right now. :)

as a data point: there are currently 18 pending pull requests and 101 opened issues. a lot of those should be just merged and closed as they are fairly trivial documentation fixes or answered support requests. in the last month, 19 new issues were created, and only 2 of those closed, by the authors of the issues. 6 new pull requests were created and none were merged in.

i may have some time to contribute to the triage effort.

[ThomasWaldmann]

I'ld also help.

I contacted github team, trying to get "attic" as org name - github has some policy about existing, but unused accounts that might enable getting this.

[sotte]

I really like attic and I'd love to see further improvements! Right now the progress is kinda slow, so maybe it's the right way to go.

[cfcs]

+1.

If you scroll to the bottom there's a guide on how to transfer a project. (if @jborg would like to do so)
http://git-scm.com/book/en/v2/GitHub-Maintaining-a-Project

[thiagoc]

Let's do it.

[anarcat]

just to be clear here, i'm not talking about transfering ownership: i believe that @jborg should stay as a maintainer. i am just looking for ways to help.

i think it's great that people are joining up here, i hope it actually means that people will contribute. note that it's already possible for people to file issues, comments and pull requests here :)

[ThomasWaldmann]

I made a "merge" branch in my repo https://github.com/thomaswaldmann/attic where I merged all the stuff that looked safe (I reviewed it first, did unit and practical tests).

[fukawi2]

I too would be willing to assist with bug triage.

[ThomasWaldmann]

https://github.com/attic \o/

github support was so nice to free this for us and I quickly grabbed it for our org before someone not from us takes it again. Sent out some first invitations, @jborg was first.

@jborg: if you have some time to help transfering to the org, you could enable a lot of collaboration. :)

https://help.github.com/articles/transferring-a-repository/

[anarcat]

i put a link to this issue in the new team to clarify its purpose and it's ... well, unofficial nature until @jborg chimes in!

[anarcat]

@ThomasWaldmann which criteria did you use to add people to the team?

which criterion should be used?

[ThomasWaldmann]

I just grabbed some people who made pull requests (which I reviewed and found safe to merge).
The list is not expected to be the final list, I just wanted to avoid creating another bus factor problem there.

I hope we can (with the help of @jborg) transfer this repo with all issues and pull requests to there.

[jborg]

Hi guys, sorry for chiming in so late.

I'm glad for all the attention and interest people are showing for Attic lately, and I know you've been keeping busy (30+ Github notification mails most days)

As you probably know, and as I explained on the mailing list I currently have pretty much 0 amount of time right now. Besides the kids, we're also in the process of buying and moving to a new house.

Anyway, I see that people are concerned (and rightfully so) about the lack of progress lately and wondering if there is any way to help.

First of all, I'm not ready to hand over the project to somebody else just yet. I still want to work on Attic, I just need to wait until my life slows down a bit. It's hard to make predictions about these things. But I suspect it will take weeks or months before this project will pick up any significant speed :(

I want to be in control of what goes into the Attic code base (I.e, I want to merge PRs). Additionally, when it comes to the critical sections of the code base (pretty much anything that touches encryption, storage format and backwards compatibility) I prefer to write all code myself to ensure I understand every part of it.

On the other hand, help with answering and investigating bug reports on the mailing list and Github is always appreciated. Smaller PRs fixing bugs are also welcomed.
But please try to refrain from spending too much time creating large PRs that touch the critical sections I mentioned above without first discussing things with me. Otherwise chances are that these will not be merged. And I don't want to waste anybody's time or hurt anybody's feelings.

[ThomasWaldmann]

Hi @jborg, nice to see you here!

I can follow that you are a uncomfortable with people who you do not really know merging stuff (I would somehow feel same I guess).

In case it helps getting to know me better and trust in my changes:

Python: I do Python since about 14years now, primary maintainer of MoinMoin Wiki + nsupdate.info. Plus a lot of contributions elsewhere / other smaller projects. I am also frequently reviewing other people's code for the projects I participate in. I use to attend EuroPython.

Crypto: I am interested in crypto since quite a while and recently successfully completed Dan Boneh's (Stanford) "Crypto I" course on coursera.org (which I can recommend and which covers everything used in attic). I use to attend CCC conferences. That doesn't make me a cryptographer of course, but it gives me working knowledge to do stuff and avoid stupid mistakes. Review is of course always welcome.

Storage/Backwards compat: I carefully made the changes in a way so that they are backwards compatible. Hardcoded stuff before is now just a parameter fed to generalized code. Parameters are same for the old type bytes.

So, as your availability seems to be rather low now and in near future, maybe at least consider if REVIEWING merges and giving feedback is maybe not a better (less time consuming for you) option than waiting until you can do it all yourself.

About rather writing it on your own: I think you could also try to understand my code (which shouldn't be hard as I like to write pretty clear code, IMHO) [or other people's code], instead of writing it yourself. If there are any questions or feedback, I am happy to answer them / improve the code.
The nice thing about Python is that there are a lot of people using it AND love to write clean code.

Problem is that there can be dependencies between PRs, so as long as one such PR is not merged, it basically blocks work on stuff depending on that change.

Cheers, Thomas