Re: automating CF submissions (was xlog location arithmetic) - Mailing list pgsql-hackers

On Sun, Jan 15, 2012 at 05:44, Greg Smith <greg@2ndquadrant.com> wrote:
> On 01/14/2012 10:49 PM, Gurjeet Singh wrote:
>>
>> So lets make it easy for the patch submitter to start the process. I
>> propose that we have a page in the CF application where people can
>> upload/attach the patch, and the app posts the patch to -hackers and uses
>> the post URL to create the CF entry.
>>
>
> That would be nice, but there's at least two serious problems with it, which
> I would guess are both unsolvable without adding an unsupportable amount of
> work to the current PostgreSQL web team.  First, it is technically risky for
> a web application hosted on postgresql.org to be e-mailing this list.  There
> are some things in the infrastructure that do that already--I believe the
> pgsql-commiters list being driven from commits is the busiest such bot.  But
> all of the ones that currently exist are either moderated, have a limited
> number of approved submitters, or both.

It's not really a problem from that perspective, as long as it
requires the user to be logged in. The mail would be sent from the
users account, with that one as a sender, and thus be exposed to the
same moderation rules as the rest of the list posts.


> If it were possible for a bot to create a postgresql.org community account,
> then trigger an e-mail to pgsql-hackers just by filling out a web form, I'd
> give it maybe six months before it has to be turned off for a bit--because
> there are thousands messages queued up once the first bored spammer figures

Said bot can already use the bug report form *without*  having to sign
up for an account.

Or said bot could submit news or events, which trigger an email to at
least some lists, which hasn't bene done.

It's supposedly not easy for a bot to sign up for a community account,
since it requires you to have access to the email address it's
registered on. If that doesn't work, it's a bug and needs to be fixed
regardless.


> that out.  Securing web to e-mail gateways is a giant headache, and everyone
> working on the PostgreSQL infrastructure who might work on that is already
> overloaded with community volunteer work.  There's an element of zero-sum

We've already solved that problem for other situtations, and given how
the infrastructure is built, that's fairly easy to replicate to
another node.

I think the bigger problem is "who'll write it". AFAIK, the CF app
*itself* is even more person- and time-constrained to senior
developers (Robert Haas only) than the infrastructure, and that's a
bigger problem. There are already a bunch of things that are a lot
simpler than this that has been pending on that one for well over half
a year.

> Second, e-mail provides some level of validation that patches being
> submitted are coming from the person they claim.  We currently reject
> patches that are only shared with the community on the web, via places like
> github.  The process around this mailing list tries to make it clear sending
> patches to here is a code submission under the PostgreSQL license.  And
> e-mail nowadays keeps increasing the number of checks that confirm it's
> coming from the person it claims sent it.  I can go check into the DKIM
> credentials your Gmail message to the list contained if I'd like, to help
> confirm it really came from your account.  E-mail headers are certainly not

I think DKIM was a bad example, because AFAIK our lists mangle DKIM
and thus actually show them as *invalid* for at least the majority of
messages...

> One unicorn I would like to have here would give the CF app a database of
> recent e-mails to pgsql-hackers.  I login to the CF app, click on "Add
> recent submission", and anything matching my e-mail address appears with a
> checkbox next to it.  Click on the patch submissions, and then something
> like you described would happen.  That would save me the annoying work
> around looking up message IDs so much.

That would be neat.

And FWIW, I'd find it a lot more useful for the CF app to have the
ability to post *reviews* in it, that would end up being properly
threaded. The way it is now, half the reviewers create a *new* thread
to post their reviews on, making it a PITA to keep track of those
patches on the list at all, which somewhat takes away the whole idea
of "mail being the primary way to track it". Not saying it's critical,
but I'd put it a lot higher on the list than being able to post the
initial patch.

--
 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/