/srv/irclogs.ubuntu.com/2014/05/12/#ubuntu-meeting.txt

=== rsalveti_ is now known as rsalveti
=== MooDoo is now known as Guest12029
=== negronjl-afk is now known as negronjl
=== jrgifford__ is now known as jrgifford
=== broder_ is now known as broder
=== pleia2_ is now known as pleia2
=== TheDrums is now known as DalekSec
=== vladk|offline is now known as vladk
=== Guest12029 is now known as MooDoo
=== vladk is now known as vladk|offline
=== vladk|offline is now known as vladk
=== vladk is now known as vladk|offline
=== vladk|offline is now known as vladk
=== doko_ is now known as doko
=== vladk is now known as vladk|offline
=== vladk|offline is now known as vladk
mdeslaur\o16:31
tyhickshello16:32
jjohanseno/16:32
mdeslaur#startmeeting16:32
meetingologyMeeting started Mon May 12 16:32:49 2014 UTC.  The chair is mdeslaur. Information about MeetBot at http://wiki.ubuntu.com/meetingology.16:32
meetingologyAvailable commands: action commands idea info link nick16:32
mdeslaurThe meeting agenda can be found at:16:32
mdeslaur[LINK] https://wiki.ubuntu.com/SecurityTeam/Meeting16:32
mdeslaur[TOPIC] Announcements16:32
=== meetingology changed the topic of #ubuntu-meeting to: Announcements
mdeslaurThanks to the following contributors for their help on security updates last week:16:32
mdeslaurOtto Kekäläinen (otto) provided debdiffs for trusty for mariadb-5.5 (LP: #1313187)16:32
mdeslaurJames Page (jamespage) provided a debdiff for trusty for mysql-5.6 (LP: #1313566)16:32
mdeslaurReinhard Tartler (siretart) provided an updated libav package for trusty (LP: #1277173)16:32
mdeslaurYour work is very much appreciated and will keep Ubuntu users secure. Great job! :)16:32
ubottuLaunchpad bug 1313187 in mariadb-5.5 (Ubuntu Utopic) "USN-2170-1: MySQL vulnerabilities also applies to MariaDB" [Undecided,Fix released] https://launchpad.net/bugs/131318716:32
ubottuLaunchpad bug 1313566 in mysql-5.6 (Ubuntu Utopic) "mysql 5.6.17 security update tracking bug" [High,Fix released] https://launchpad.net/bugs/131356616:32
ubottuLaunchpad bug 1277173 in libav (Ubuntu) "February 2014 libav security tracking bug" [High,Fix committed] https://launchpad.net/bugs/127717316:32
mdeslaur[TOPIC] Review of any previous action items16:32
=== meetingology changed the topic of #ubuntu-meeting to: Review of any previous action items
mdeslaurnone16:32
mdeslaur[TOPIC] Weekly stand-up report16:32
=== meetingology changed the topic of #ubuntu-meeting to: Weekly stand-up report
mdeslaurI'll go first16:32
mdeslaurI'm in the happy place this week.16:33
mdeslaurI'm working on some updates, and I'll probably be doing the embargoed issue tomorrow16:33
mdeslaurI also have to review blueprints16:33
mdeslaurand I'm going to plan a meeting to go through them with the rest of you tomorrow16:33
mdeslaurquite possibly around this time16:33
mdeslaurwell, a half hour later16:33
mdeslaurthat's it from me, sbeattie, you're up16:34
sbeattieI'm working on compiler hardening stuff again; I'm currently looking through the test results for gcc-4.9 for enabling -fstack-protector-strong by default and fixing the way -Wformat and -Wformat-security were being enabled.16:35
sbeattieThings on that front are looking good and I'll probably hand off those patches to doko later today.16:35
mdeslaursbeattie: cool!16:35
sbeattieGetting -pie by default for amd64 is looking trickier and will take some more time.16:36
mdeslaursbeattie: trickier in what way?16:36
dokosbeattie, does this mean I get fixes for the testsuite? ;p16:36
sbeattieDefining specs for per-arch where gcc treats i386/amd64 as the same arch is non-obvious/16:36
mdeslaursbeattie: hrm...what about the idea of conditionally patching it based on arch?16:37
sbeattiedoko: not immediately, but yes, I intend to look at those, too; the patches I have reduce the number of failures by a few.16:37
mdeslauror is that painful for cross-compilation or something?16:37
dokois -fpie already decided?16:38
sbeattieIt makes it harder to avoid enabling -pie for -m32 case16:38
mdeslaurdoko: for amd64, pretty much yeah16:39
* doko sees python and cc1 performans going down :-/16:39
mdeslaurdoko: buy a faster machine!16:40
sbeattiedoko: well, once we have a patch to do that, we can see the impact, if it's bad there than we can revisit and/or disable for just those.16:40
sbeattieanyway. I still need to investigate mod_apparmor and track down some QRT issues with ppc64el this week.16:42
sbeattieAnd I guess review blueprints, too.16:42
sbeattieThat's it for me. tyhicks?16:42
tyhicksI'm wrapping up the dbus merge from debian testing16:43
mdeslaurah, right, I probably should tackle some merges too16:43
tyhicksthere's a new test-dbus.py failure (running make check) that I need to make sure isn't caused by the new apparmor mediation patches16:44
tyhicksthen it is back to kdbus (I let the merge and some apparmor testing jump in front of my planned kdbus work from last week)16:44
tyhicksI also need to review blueprints and prepare for the sprint this week, since I'm out next week16:45
tyhicksthat's it for me16:45
tyhicksjjohansen: you're up16:45
jjohansenI am working on apparmor this week. I need to spend some time looking at the upstream cross rename patches, there is a reported regression in apparmor with them.16:46
jjohansenI need to finish testing the patchset I have for upstream this week so it can land in time for the next kernel merge window.16:46
jjohansenHopefully there will be more feedback on the bugs I was poking at last week so I can continue looking at them while the are fresh in my mind16:46
jjohansenThere are some outstanding patches I that need to be reviewed on the mailing lists16:46
jjohansenbp to look at16:46
jjohansenand then it will be back to finishing up one of my outstanding patch queues so that it can be kicked out for review16:46
mdeslauryay16:47
sarnold\o/16:47
jjohansenI think that is it for me, sarnold you're up16:48
sarnoldI'm on triage this week16:48
sarnoldI have an emargoed update this week16:48
sarnoldand I've gotten the test-django script to only 7 instead of 8 failures on trusty, so.. 86% left to go there, I guess16:48
mdeslaursarnold: heh, nice. did you get it working with the other apache thingy?16:49
mdeslaurmod_wsgi16:49
sarnoldmdeslaur: that was the one success :)16:49
mdeslaurcool :)16:49
sarnoldmdeslaur: now just to figure out why the other seven still don't play along with mod_wsgi -- they might still be faults in configuration or those tests may also need more modification16:50
mdeslaursarnold: apache 2.4 moved some stuff around, and required a few more modules16:50
sarnoldit might be simple (django changed some of the routing API, but those changes were easy to adapt..)16:50
mdeslaura lot of the other qrt scripts needed adjustments16:50
mdeslaurit may be related to that16:50
sarnoldmdeslaur: yeah, the auth changes required a bit of fiddling too, but at least it lines up exactly with django's change to wsgi as well..16:51
sarnoldit's been more work than I first expected. :)16:53
sarnoldmdeslaur: back to you :)16:53
mdeslaursarnold: that's why I gave it to you instead of doing it myself :)16:53
mdeslaurslacker++16:53
mdeslaur[TOPIC] Highlighted packages16:53
=== meetingology changed the topic of #ubuntu-meeting to: Highlighted packages
mdeslaurThe Ubuntu Security team will highlight some community-supported packages that might be good candidates for updating and or triaging. If you would like to help Ubuntu and not sure where to start, this is a great way to do so.16:53
mdeslaurSee https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures for details and if you have any questions, feel free to ask in #ubuntu-security. To find out other ways of helping out, please see https://wiki.ubuntu.com/SecurityTeam/GettingInvolved.16:53
mdeslaurhttp://people.canonical.com/~ubuntu-security/cve/pkg/nss-pam-ldapd.html16:53
mdeslaurhttp://people.canonical.com/~ubuntu-security/cve/pkg/openjdk-6.html16:53
mdeslaurhttp://people.canonical.com/~ubuntu-security/cve/pkg/shibboleth-sp2.html16:53
mdeslaurhttp://people.canonical.com/~ubuntu-security/cve/pkg/libcgi-application-perl.html16:53
mdeslaurhttp://people.canonical.com/~ubuntu-security/cve/pkg/encfs.html16:53
mdeslaur[TOPIC] Miscellaneous and Questions16:54
=== meetingology changed the topic of #ubuntu-meeting to: Miscellaneous and Questions
mdeslaurDoes anyone have any other questions or items to discuss?16:54
mdeslaurzzzz16:55
mdeslaurThanks everyone!16:55
mdeslaur#endmeeting16:55
=== meetingology changed the topic of #ubuntu-meeting to: Ubuntu Meeting Grounds | Calendar/Scheduled meetings: http://fridge.ubuntu.com/calendar | Logs: https://wiki.ubuntu.com/MeetingLogs | Meetingology documentation: https://wiki.ubuntu.com/meetingology
meetingologyMeeting ended Mon May 12 16:55:34 2014 UTC.16:55
meetingologyMinutes:        http://ubottu.com/meetingology/logs/ubuntu-meeting/2014/ubuntu-meeting.2014-05-12-16.32.moin.txt16:55
sbeattiemdeslaur: thanks!16:55
sarnoldthanks mdeslaur!16:55
jjohansenthanks mdeslaur16:55
=== vladk is now known as vladk|offline
mdeslaur\o20:01
pittihello20:09
mdeslaurhi pitti, infinity20:09
pittisorry for being late, I really can't make it any earlier20:09
pittidid we start already? so stgraber and slangasek sent apologies20:10
infinityS'ok.  I had a bit of a siesta, and ended up dreaming about the meeting instead of attending it.20:10
mdeslaurpitti: np, we haven't started or anything.20:10
mdeslaurheh20:10
pittikees: you didn't reply to mdeslaur's meeting time proposal yet?20:11
pittiso if Tue 17:00 doesn't work for kees, we can try the alternating20:11
pitti#startmeeting20:12
meetingologyMeeting started Mon May 12 20:12:26 2014 UTC.  The chair is pitti. Information about MeetBot at http://wiki.ubuntu.com/meetingology.20:12
meetingologyAvailable commands: action commands idea info link nick20:12
pitti(not that we have much of an agenda..)20:12
pitti#topic action review20:12
=== meetingology changed the topic of #ubuntu-meeting to: action review
pittican you help me out here? last report is from Apr 14, without loose ends20:12
pittiexcept "slangasek to work with SRU team to get a list of how the provisional MREs have/haven't been used ", but that now went to mail20:12
pittiwas there anything from two weeks ago?20:13
infinityI think that's about the only outstanding thing we have.20:13
mdeslaurI don't believe we had anything further20:13
infinityThat and the meeting time.20:13
pittithere's also sabdfl's "matters approaching", but that rather sounds like taking some good time of thinking and replying by mail; objections?20:14
mdeslaurnope20:14
infinityYeah, I don't think we'll get anywhere discussing that via IRC just yet.20:15
pitti#topic MRE review20:15
=== meetingology changed the topic of #ubuntu-meeting to: MRE review
infinitySome folks will be having heated debates about that in Malta soon.20:15
infinity(The sabdfl thing, not MREs)20:15
pittiso, TBH I don't feel like interactively discussing every single one, but we shoudl talk a bit about "in vs. out" criteria20:15
pittifor all except LibO it's not quite clear whether the "new errors reported" were actual regressions or people just happened to send the first report on the update20:16
infinityRight, and I think we need to know that.20:16
pittibut that's hard to automate, I guess we can just ask for a list and do some spot-checks20:16
infinityIf it's a regresison, it's interesting, though we also expect, I think, that MRE's might introduce new bugs (new code has new bugs), and that needs to also be weighed against responsiveness of the people responsible for the MRE in responding to those.20:17
infinityWe don't *want* them to introduce new bugs, but we may have to be realists too.20:18
mdeslauris there anything in the list that sticks out?20:18
pittiat least it seems that the entries on https://wiki.ubuntu.com/StableReleaseUpdates/MicroReleaseExceptions/ProvisionalStatus have all actually been used in practice20:18
pittibut that is perhaps only packages which actually *have* been updated; it's by far not the complete one from https://wiki.ubuntu.com/StableReleaseUpdates/MicroReleaseExceptions20:19
pittie. g. firefox is missing, and we update that all the time20:19
pittiah sorry, no, these are *just* the provisional ones20:19
infinityThe only thing that immediately jumps out at me is mesa, and it the stickiest one from the POV of "we need this for HWE" and "we know it's going to occasionally introduce new bugs".20:20
pittie. g. bug 1316988 doesn't look like a regression20:20
ubottubug 1316988 in openvswitch (Ubuntu) "openvswitch-datapath-dkms 1.4.6-0ubuntu1.12.04.2: openvswitch kernel module failed to build" [Undecided,Confirmed] https://launchpad.net/bugs/131698820:20
pittiinfinity: yeah, that's pretty much the only one which makes me nervous, too20:20
pittithe OpenStack bits generally seem to keep their "we don't break stuff" promise20:21
infinityWell, the openstack bits also get installed on machines without errors submissions, so we're relying on manual LP bug submissions there.20:21
pittie. g. ceph, heat, neutron etc. look exemplary20:21
pittiah right20:21
mdeslauroh, right20:21
infinityWhich is, eg, why vlc looks so bad.  Lots of people use it, and all those people are on desktops with automagic error submission.20:22
infinityBut I suspect almost none of the vlc errors are regressions in VLC.  I'd have to go hunting to confirm that, mind you.20:22
* pitti looks at bug 118990920:22
ubottubug 1189909 in neutron "dhcp-agent does always provide IP address for instances with re-cycled IP addresses." [Undecided,In progress] https://launchpad.net/bugs/118990920:22
pittiI can't be sure, but at least there's no comment that suggests a regression20:23
infinityFWIW, openvswitch is also an HWE issue.  They're backporting new versions to be compatible with HWE kernels.20:23
mdeslaurmultimedia stuff crashes all over, it would probably be hard to figure out what are actually regressions20:23
infinityAt the time, we argued that making the old version build would be preferable, but there were claims this ranged from difficult to impossible.20:23
pittiinfinity: yeah, "new errors reported: 183" is almost surely because we dno't offer the LTS->LTS upgrade before releaseing the .120:24
infinity#1316988 isn't a package regression, though, it's just a user who removed their headers.20:25
pittiinfinity: right20:25
infinitySo, none of this jumps out at me as either people who don't need their MRE (they're all being used) or people who are abusing them.20:26
pittiso, so far we don't really have proof that anything actually regressed (except for LibO, I didn't go through all these bugs yet)20:26
pittiand I'd rather do that ^ off-meeting20:26
infinityOther than LibreOffice, which is scary as crap.20:26
pittiyes, but this is also one of these packages which get bug reports all the time :)20:26
infinityBut for mesa, I'd like to perhaps hunt down the desktop team and get some formal commitment from them for regression tracking.20:26
infinitySince I don't think we can ask them to stop updating mesa, but we don't want to blow up OpenGL desktops like GNOME and Unity.20:27
pittibug 113497420:27
ubottubug 1134974 in mesa (Ubuntu) "compiz and other display misbehavior on HD4000 after xatracker/mesa components upgraded to 9.0.2-0ubuntu0.1" [Undecided,New] https://launchpad.net/bugs/113497420:27
pittithat almost surely is a regression20:27
mdeslaurhrm20:27
pitti mesa | 9.0-0ubuntu1     | quantal          | source20:28
pitti mesa | 9.0.3-0ubuntu0.4 | quantal-updates  | source20:28
pittiand downgrading to 9.0-0ubuntu1 fixed this20:28
pittiso, one piece of (bad) proof20:28
* pitti chuckles at bug 107017820:29
ubottubug 1070178 in mesa (Ubuntu) "plz hlp compiz note working " [Undecided,New] https://launchpad.net/bugs/107017820:29
infinity...20:29
pittibut #1134974 is worrying -- it didn't get any triage etc.20:30
infinityRight.  And it stops mattering in 4 days, but I don't want this to be a pattern.  Those bugs need to be looked at.20:30
pittiand TBH for LTSes we have the backported stacks now, and for non-LTSes, who bothers -- do we really have OEM customers on 9-month releases? that sounds scary20:30
pittiso my gut feeling is that we need to inspect the LibO bugs further, revert the mesa one for the time being, and turn the others into "approved" ones20:32
pittimdeslaur, infinity: WDYT?20:32
infinitypitti: The backport stacks have the same issue.  How do you think they come to exist? :P20:32
infinitylibgl1-mesa-dri-lts-quantal:20:32
infinity  Installed: (none)20:32
infinity  Candidate: 9.0.3-0ubuntu0.4~precise120:32
pittiinfinity: yes, but they don't affect existing systems20:32
infinityNo, it's possible 9.0.3 fixed that bug (it was reported against 9.0.2), but no one's looked at it to see.20:32
infinitys/No/Now/20:33
pittiif you install from a X.Y.2 image and have a broken system right away, that's much less of a pain than breaking a running productino system20:33
infinitypitti: They absolutely can affect existing systems.20:33
mdeslaurpitti: by revert, you mean revoke it's status?20:33
infinitypitti: If you installed with an lts-q stack with mesa 9.0 and upgraded to a newer backport of the stack, boom.20:33
pittiinfinity: yes, and I want this to stop (as that's the MRE, isn't it?)20:33
pittithe backported stacks have parallel packages20:34
infinitypitti: Erm.  I think we're talking past each other?20:34
pittias to what backported kernels and X.orgs do, they probably break loads of machines; but dist-upgrade won't automatically get those on existing systems20:34
infinitypitti: If we revoke the MRE for mesa, we're revoking it for backport stacks too.20:34
infinitypitti: Precise users would have absolutely gotten this breakage automatically.20:35
pittiinfinity: how so? linux/xorg/etc. don't have an MRE either, and get backported20:35
pittiinfinity: yes, *this* breakage from the bug above (when they upgrade precise to quantal-updates)20:35
pittithat's what I'd like to stop :)20:35
infinitypitti: mesa-lts-q started out in the "good" version and was later updated to match Q's new version.20:35
pittiinfinity: ah, because the newer upstream release was backported again?20:36
pittiyes, that'd be the MRE again20:36
infinityAnyhow, we do new mesa microreleases for HWE reasons too.  Waiting 6 months for a new backport stack doesn't help.20:36
infinityI don't think rejecting it outright is the answer, I think the answer is a better bug triage/followup commitment.20:36
infinityThere's been no activity on that bug from the desktop team, nor any piling on "me toos" since 9.0.3 was released.20:36
pittiwell, in order to avoid regressions, you'd have to test on all hw of teh world20:37
infinityMy guess is that 9.0.3 fixed it, but we have no way to know, cause no one's bothered to look.20:37
pittitriaging bugs after releaseing to -updates is important, but then the damage is done already20:37
pitti*nod*20:37
infinityBut, if you want to go the more conservative route here, you're an ex-desktopper, you probably have a better handle on what'll work.20:37
pittiwell, it never really worked20:38
infinityHeh.20:38
pittiit's an eternal conflict between OEM always wanting teh latest and greatest and existing installs20:38
pitti(and not having an OEM archive to go on top of that)20:38
infinityI think about 99% of the things we do in the name of HWE are crazy, but we have to make some concessions for people who insist on buying new computers.20:38
mdeslaurwere those mesa srus done for oem's benefit, or where they to correct issues people were having?20:39
infinityI doubt it was for OEM.20:39
infinityOther than the part where OEM likes the latest crack.20:39
infinityBut bringing in mlankhorst to the discussion would be helpful.20:39
pittiof course we also have -backports now which is enabled by default, so maybe that'd be a better route for these cases20:39
infinitypitti: Enabled, but you don't install from it.20:40
infinitypitti: Which, from an HWE perspective, is useless, and from a bugfixing perspective, is almost also so.20:40
pittiinfinity: right, but we own our installer, so there's little which keeps the installer from picking mesa from -backports20:40
pittibut that again of course only works for the first update20:41
pittievery subsequent one will again break existing machines20:41
pittiso, back to square #120:41
pittibut still, from a community/TB POV this is a fail20:41
infinityRight, I think we need to have a chat with Maarten, see why they think they need this MRE, if there's any way it can be done more safely, and if not, drop the whole thing.20:42
infinityI'll note a new micro-release of mesa landed in trusty-proposed 9h ago. :P20:42
pittiyay20:42
mdeslaurheh20:43
pittiack, so we need a follow  up with the desktop team here20:43
pittiI'll do that, as a bit of an apology for missing the last few meetings20:43
infinityShiny.20:43
pittiACTION: pitti to follow up with Maarten wrt. mesa MRE20:43
infinityFeel free to miss more in the future, if it leads to you taking all the actions.20:43
pittican we review the LibO bugs offline and respond to the mail?20:43
infinityYeah, I think LibO is too heavy to dive into on IRC.20:44
pittiand any objections for the other provisional MREs to become blessed ones?20:44
mdeslaurnot from me20:44
infinityAnd also doesn't have the "HWE" excuse going for it, so if it turns out to just completely suck, I doubt anyone would argue dropping the MRE.20:44
infinityI'm fine with the rest of the list.20:44
pittiack20:44
infinityMaybe a quick scan through VLC crashes would be fun, but I bet it's mostly in underlying libraries and random corrupt media files, etc.20:45
pitti#agreed promote provisional MREs except LibO and mesa to permanent ones20:45
infinityVideo playback software sucks.20:45
pitti(meh, neither all-caps nor #-ed ones work; go meetingology)20:45
pittiah, right20:45
pittiI smell a volunteer20:45
pitti(I'll do the LibO ones in exchange)20:45
infinityYeah, I'll have a hunt through a sampling of VLC crashes to confirm (or not) my suspicions there.20:46
pittiACTION: infinity to review the vlc MRE bugs20:46
pittiACTION: pitti to review the LibO MRE bugs20:46
infinityDid meetingology give up on life?20:47
mdeslaurmeetingology: wake up20:47
meetingologymdeslaur: Error: "wake" is not a valid command.20:47
pitti#halp20:47
infinityOh, that should be "#action <blah>"20:47
pittiI get nothign back in privmsg20:47
infinity#action pitti to follow up with Maarten wrt. mesa MRE20:47
meetingologyACTION: pitti to follow up with Maarten wrt. mesa MRE20:47
infinityEtc.20:47
pittiyes, but #agreed didn't work either20:48
pittianyway, I don't really use that; the real IRC log is fine20:48
infinityHeh.20:48
pitti#topic community bugs20:48
=== meetingology changed the topic of #ubuntu-meeting to: community bugs
pittizarro20:48
infinityOur community is bug-free?20:48
pittinothing new on the ML either20:48
pittiI privmsg'ed kees about meeting time20:49
pitti#topic AOB20:49
=== meetingology changed the topic of #ubuntu-meeting to: AOB
pittinothing from me; infinity, mdeslaur?20:49
pitti1020:49
mdeslaurnope20:49
pitti520:49
infinityI'm good.20:49
pitti0 :)20:50
pittigreat20:50
infinityNot like we have quorum anyway. :P20:50
pittiso, c'est l'heure de dormier20:50
pittithanks and good night! will do the reporting stuff tomorrow morning20:50
mdeslaurthanks pitti, infinity!20:50
pittierr, "dormir"20:50
pittifrançais est trop difficile20:51
pitti#endmeeting20:51
=== meetingology changed the topic of #ubuntu-meeting to: Ubuntu Meeting Grounds | Calendar/Scheduled meetings: http://fridge.ubuntu.com/calendar | Logs: https://wiki.ubuntu.com/MeetingLogs | Meetingology documentation: https://wiki.ubuntu.com/meetingology
meetingologyMeeting ended Mon May 12 20:51:45 2014 UTC.20:51
meetingologyMinutes:        http://ubottu.com/meetingology/logs/ubuntu-meeting/2014/ubuntu-meeting.2014-05-12-20.12.moin.txt20:51
=== jono is now known as Guest3239

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!