From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Marusich Subject: Re: Patchwork + automated checking and testing of patches Date: Sat, 08 Dec 2018 13:27:35 -0800 Message-ID: <87woojn1yw.fsf@gmail.com> References: <87h8h29z2j.fsf@cbaines.net> <87tvjvzgwu.fsf@gmail.com> <87tvjvo2jr.fsf@cbaines.net> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:57027) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gVk8a-0004au-GT for guix-devel@gnu.org; Sat, 08 Dec 2018 16:27:49 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gVk8V-0008Sn-IU for guix-devel@gnu.org; Sat, 08 Dec 2018 16:27:48 -0500 Received: from mail-pf1-x441.google.com ([2607:f8b0:4864:20::441]:41365) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gVk8V-0008Se-CT for guix-devel@gnu.org; Sat, 08 Dec 2018 16:27:43 -0500 Received: by mail-pf1-x441.google.com with SMTP id b7so3544531pfi.8 for ; Sat, 08 Dec 2018 13:27:43 -0800 (PST) In-Reply-To: <87tvjvo2jr.fsf@cbaines.net> (Christopher Baines's message of "Mon, 03 Dec 2018 00:51:36 +0000") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Christopher Baines Cc: Guix-devel --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Hi Chris, Christopher Baines writes: > Chris Marusich writes: > >> [...] Why do you think using Jenkins wouldn't be maintainable? [...] > > Sure, I've used Jenkins in different contexts, and indeed currently use > Jenkins, so I've got some experience here. > > I'm obviously ignoring all the good parts here, but one source of data > is Debian. It used to have a package for Jenkins, and you can see some > of the work/issues here [1] and the thread about it's removal here [2]. > > One issue in particular to call out is some potential bootstrapping > issues [3] that seem to have been encountered. > > It seems sensible to me to use Guix when doing things related to the > Guix project, like automated testing of patches (dogfooding, if you know > the term). Some of the things I've mentioned here lead me to doubt that > Jenkins will at some point be available through Guix. > > So that's something about the maintainability of a Guix package, but > there's an operational component to this as well. The attack surface it > offers is maybe larger than sometimes necessary, if you only need a > read-only web interface for example. > > 1: > https://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=3Dboth;dist=3Dunsta= ble;ordering=3Dnormal;repeatmerged=3D0;src=3Djenkins > 2: https://lists.debian.org/debian-java/2016/01/msg00019.html > 3: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D714596 Wow! I had no idea Debian had encountered such difficulties with Jenkins. And your point about attack surface is also valid - if we can get by with a read-only web interface, it's much less to worry about. After reading the links you've provided and hearing your argument, I'm inclined to agree that avoiding Jenkins is the right call at this time. Thank you for explaining things! =2D-=20 Chris --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEy/WXVcvn5+/vGD+x3UCaFdgiRp0FAlwMN0cACgkQ3UCaFdgi Rp2rfRAAoFpICFZjYQmEpr7bRQurX4xiUQehTdjgolzYx7nPJGcQpud9wc/+JwVe Ob/ySfBYLOogYnmhUFB4MkkWtYlaZbLz96OX/wCA/R53B9R+Q8j+jOqKC04ir50D A+z8ctC0KMJS4rGblSU9T48Dl0H5mP8jKKbpr5fRcGH7Yf1C7EnHhEswTYBVIxpz B0KV0CN5cP7xcDXqvx0vuP9xCZL9HrIaXUeIP1czkO1mhDEnkcD/1cm8BFOAkhas w+puxX8cnZzRcIgdTzfwVU8t5HJeYD74ZB3Er9PcoHG6sifkXk6h4KuqcvgUZN3o DX/SpmFlhI41t9up+Tqg49CIPuQiHxZ5Hlc93eVhfzXUawKbF1XnwjM1mFz6EZR3 k3/z5PXjhhciQsJlQwTE8U/5eyZwlev3Pv9FPcMJQGTMretLpvn6vjrRw8yJ+vh2 Ud0HmN06nbkX6iEqI1roAB0U1nW4ViFRG3/42j8gzyr+bBo83gWqNVEK3DMGcT15 I8wQwPJhCSYCFYrwYpYTOvAL0xSpQ2/tJVpKkhBz+jLBBshSUPSTePZUP+ijK9P+ bpVpgh2GsAnXZB4aBwkzLCxp8nJj16x/R4HF1OnbhPHXOw/NNci8dML7SB6oMel/ EcrY1UelrFFA/9ZFwExrcXxdBM1c7zst7Uo2vQKrLdZWhE7jqV0= =ZA2p -----END PGP SIGNATURE----- --=-=-=--