From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:bcc0::]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id 85GbL3wdg2BX4wAAgWs5BA (envelope-from ) for ; Fri, 23 Apr 2021 21:18:20 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id 6IsRKnwdg2BiFQAAbx9fmQ (envelope-from ) for ; Fri, 23 Apr 2021 19:18:20 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 532C414969 for ; Fri, 23 Apr 2021 21:18:20 +0200 (CEST) Received: from localhost ([::1]:34840 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1la1Jj-0001zK-Fs for larch@yhetil.org; Fri, 23 Apr 2021 15:18:19 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:38604) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1la1Ja-0001z8-3B for guix-devel@gnu.org; Fri, 23 Apr 2021 15:18:10 -0400 Received: from wout2-smtp.messagingengine.com ([64.147.123.25]:57489) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1la1JX-0007vv-O0 for guix-devel@gnu.org; Fri, 23 Apr 2021 15:18:09 -0400 Received: from compute2.internal (compute2.nyi.internal [10.202.2.42]) by mailout.west.internal (Postfix) with ESMTP id 82080A50; Fri, 23 Apr 2021 15:18:05 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute2.internal (MEProxy); Fri, 23 Apr 2021 15:18:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=mesmtp; bh=UhQKjZW2Ax/D3VCwPuUIYyYV eX4cvxk8P091RTBFzeI=; b=J4m+GE+avegz4uT1R+V7hN1GeKS9Nh2eIlDDNbze Jy6h4ACFJdpOAF8eR2aSpj2rqxME+v7OqWxhgkHAPr/hi30JPjXIjdaxINwXERea xJ7PGyDaCdjGXmj9Bnd8ksJ9trNwOV0T6MNopYrxfw05n5Wt5Rz9rVEL54dwdbwb JSE= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=UhQKjZ W2Ax/D3VCwPuUIYyYVeX4cvxk8P091RTBFzeI=; b=vCv4nL1dDPg4QdYly4dL4m peNHqHPrMONFq6CWd0zbdw9ymWagtJkOAszYKQMvsbCvcSL6pbdFSz65Gn2Xxa4M UQ5oSlRaAWMXxjpRnHvWSjbQad+tZY7fPinj2rnf71YaQrVQpnwwNsJnh089ahnK yHM3FOuk0nMYbfrZl680+FAaznK6wD9stll4enT26+6U0vQ3hXojIRhV2hZiR4Tx x2Lw9WgqpyTnHc+lVGfGjUqg0UleV+lGqChZbA7QNVa0iNjhO1ttbzWFQLL27SaL XvTduNSpse99WqEQcXM6+m7OYGXckevuQFZBO240rtPZ2nrE2i4QnQqw7Pt2Maxw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrvdduvddgudefhecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd enucfjughrpeffhffvuffkfhggtggujgesghdtreertddtjeenucfhrhhomhepnfgvohcu hfgrmhhulhgrrhhiuceolhgvohesfhgrmhhulhgrrhhirdhnrghmvgeqnecuggftrfgrth htvghrnhephfekvdduieehfedttdduledvgfehleevleejheettddvffevgeejgeetueff keetnecuffhomhgrihhnpehgnhhurdhorhhgnecukfhppedutddtrdduuddrudeiledrud dukeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehl vghosehfrghmuhhlrghrihdrnhgrmhgv X-ME-Proxy: Received: from localhost (pool-100-11-169-118.phlapa.fios.verizon.net [100.11.169.118]) by mail.messagingengine.com (Postfix) with ESMTPA id 02163240057; Fri, 23 Apr 2021 15:18:03 -0400 (EDT) Date: Fri, 23 Apr 2021 15:18:02 -0400 From: Leo Famulari To: =?iso-8859-1?B?TOlv?= Le Bouter Subject: Re: A "cosmetic changes" commit that removes security fixes Message-ID: References: <87tunz11mf.fsf@netris.org> <87r1j30xmo.fsf@netris.org> <87czumypz3.fsf@netris.org> <87o8e4zy5k.fsf@gmail.com> <5cbbfa9b258fb28beb9288685ccc85b4d015cd8a.camel@zaclys.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="8HyJOYJWpBImmhIl" Content-Disposition: inline In-Reply-To: <5cbbfa9b258fb28beb9288685ccc85b4d015cd8a.camel@zaclys.net> Received-SPF: pass client-ip=64.147.123.25; envelope-from=leo@famulari.name; helo=wout2-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Maxim Cournoyer , Raghav Gururajan , Sou Bunnbu , Leo Prikler , Guix Devel Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1619205500; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=UhQKjZW2Ax/D3VCwPuUIYyYVeX4cvxk8P091RTBFzeI=; b=GKqm5tyrr81qmWwEViYDfU1chLZ9KmGURsOp7ItBOwEJHMJGSZEReXKYxPOwdHQhitZtCb /+d6WlXiYSiU4iB+hlmMbKBJcgKRSV2dy7V3z4eg3djzBUQOEzhbJZdmU0+xtpU/ZGOrLm /Mup7mKbNGtXCsVANUPtK8a+m7H/J+MFETKnXaDDMuf/LJLijoiRp8u7anHvIVhviHS3XD te4TjLI7sLOQuiTwOKqt10vTsvhF5ycc1omrT3Mp9LL2TqB1SKZ8ucIgH70yu1i+PjxNvC D2qkIvrH05pPPLsYYZVq3oYlgP6sWhe5FSMoIxs+JWn6JAuTWlvPe4LJUG/PSA== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1619205500; a=rsa-sha256; cv=none; b=VRBHOq34m6cJ8+86/cue1eZuyelKLiGDjKe+0qGyH99Rm0tFuLm6hHQR7ejZjFdPDnIPAx EN0MRds4fLwM24XL2V5MI+KQ6HYJ/d+l4jCHNwQT+XijpBmOvmWgjWoN8BEbNV0v1wMesC 6ojLXR2byctbmaksMAZJGYDt0vzLmr8wRXqWbML8apZajA4zUMc6AdIsw2kVdRJv8IW18k Ss1D65NGWKDXlHHWHQ14G2FFkHMEBAHHsmIUqkDNlOGXMMtWxTyiuPXWmIUBdXrthjK2Ts ZuF67LlDg1qMObe1qOWJdHtb7QkYrD/AfmOXzPh8lw2SsFKmcqcbd/LK5YVJ0A== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=famulari.name header.s=mesmtp header.b=J4m+GE+a; dkim=fail ("headers rsa verify failed") header.d=messagingengine.com header.s=fm2 header.b=vCv4nL1d; dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Spam-Score: -2.04 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=famulari.name header.s=mesmtp header.b=J4m+GE+a; dkim=fail ("headers rsa verify failed") header.d=messagingengine.com header.s=fm2 header.b=vCv4nL1d; dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Migadu-Queue-Id: 532C414969 X-Spam-Score: -2.04 X-Migadu-Scanner: scn0.migadu.com X-TUID: cnb2yyZsoIKX --8HyJOYJWpBImmhIl Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Apr 23, 2021 at 08:50:37PM +0200, L=C3=A9o Le Bouter wrote: > I think there is no problem in accepting criticism but there is a > certain way Mark presents criticism and I don't feel like I can respond > to it when it is written in such way. Over several emails Mark was > looking to point to people who were somehow responsible for whatever > "damage" for changes that happened on a branch nobody uses and always > contains ongoing work (core-updates), so maintaining it security-wise > is not as much of a question. The result is that we have a long thread > of people responding etc. causing a fuss over something that just needs > to be fixed rather than find whoever is somehow "responsible". I feel > like we're collectively responsible. We try our best at all times, > during this GNOME upgrade I also tried to take into account Raghav's > feelings so they do not give up and have a rewarding review experience, > I knew these commits werent great, I have written about it here: < > https://issues.guix.gnu.org/42958#67>. I have to agree with everybody in this thead. The commits in question were problematic (especially on core-updates, which is not a "WIP" branch and thus cannot be rewritten to fix past problems). I'm not confident that the security fixes would have been reinstated on core-updates if Mark had not asked about them. L=C3=A9o and Raghav, you need to keep learning our workflow around security updates. It's not okay to remove security patches and later update a package to a fixed version in a different commit. `git rebase` is the tool to learn for cases like this one. However, Mark, you have way more experience, and you need to handle these things differently. If you don't trust certain Guix contributors, take it up with the maintainers =E2=80=94 in private. The style of communic= ation you used here is ineffective and will dissuade people from contributing to Guix. Do you want L=C3=A9o and Raghav to learn and improve? Or do you wa= nt them to leave? Remember that we all begin as beginners. --8HyJOYJWpBImmhIl Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAmCDHWoACgkQJkb6MLrK fwisIg//Xy1nw06tKSxU+tSuv1gM/rAcIVlqSsPl73f9xeUZOosM06aNyNqfWa9J p3EY/EM0fdqUY9/y0w8YWvPiMviEkjADvLmEQfj/2NH2nTiMw26VJJE6HvO+oClS CMSMP2j4+YokZFLVq+Ocd478Z8EJNrQcRe2bhMgCZX9nm5UfngCD5pnrNq9MrLcd X2QfQ43n6NmTnUE/fEHJs/e/Jt8xkZ8Y2iIWrCaq0eZMO4+fqGM7xWpu5rNtM9jI cdcZwlw5241kIwIiJly57sBTfa3Dfkv8IC2EJE0l5Z/pOfAM3JK5T6tNiDUotaSW xG4DPI6Va0+3y1VIKUzyFI883HVbzYOYC211h1KtIYQnQE5NnqvwizribZoknqvq VzaOz+3tdM0KeVc82E+wG+XsMnS69Xd+Y04rh6vaeydGUwThYnse3ve3bE3Nzi+C 36CZvoY5nhEiFmeXv0ZQud2Y3BPNiI+foaKtPkUoBrlevOdFGQqg3w9KxUwITFfq NsdxLw9mEd077l/98keVEcWF4oe5J4W1n6+Ta6gVMSohsbJs3xsXfuo4hoaVjpLQ npD7W1luieShYO66M4pbuaRNXimxj9EpoN9x0X/hPy3XAXft9Nd8Mi4scMRC5yKc Wpfw2zyVLfz2ag3mn4OMTWcpZTwuT2wn72NS6UUo/PLoVseXq98= =IymM -----END PGP SIGNATURE----- --8HyJOYJWpBImmhIl--