Re: [Ksummit-discuss] [CORE TOPIC] services needed from kernel.org infrastructure

From: Fengguang Wu <fengguang.wu@intel.com>
To: Theodore Ts'o <tytso@mit.edu>
Cc: ksummit-discuss@lists.linuxfoundation.org
Subject: Re: [Ksummit-discuss] [CORE TOPIC] services needed from kernel.org infrastructure
Date: Sun, 12 Jul 2015 20:55:52 +0800	[thread overview]
Message-ID: <20150712125552.GA12558@wfg-t540p.sh.intel.com> (raw)
In-Reply-To: <20150708140155.GA20551@thunk.org>

On Wed, Jul 08, 2015 at 10:01:55AM -0400, Theodore Ts'o wrote:
> On Wed, Jul 08, 2015 at 10:35:11AM +0100, Mark Brown wrote:
> > 
> > I think the only barrier here is someone writing some tooling that is
> > sufficiently useful and generic enough to work for people.  I know I
> > wrote my scripts mainly because none of the scripts I could find tie in
> > with my workflow (mainly around figuring out which branches in my local
> > tree correspond to branches on the server and syncing them up).  If
> > there'd been something I could just pick up I'd have happily done so.
> 
> Yeah, your concerns mirror mine:
> 
> 1) It will require a lot of configuration --- just because a commit
> shows up on a branch does not mean it is guaranteed that it will hit
> mainline.  In fact, a maintainer might push a commit onto a throwaway
> branch on kernel.org just so that the zero-day testing systems can
> give the commit a spin.  So that means it's not just enough to throw a
> bunch of git hook scripts on master.kernel.org, because maintainers
> will need to have to configure, if not customize, them.

Agreed. 0day also accumulated a complex set rules for deciding which
errors/trees should be auto reported, which should be manually checked,
and which can be silently ignored.

> This leads to my second concern which is:
> 
> 2) Having shell scripts run on master.kernel.org can be a significant
> security concern; this is *especially* true if customization or
> configuration is required.

0day has the same security concern. We end up running a dedicated git
mirror server for pulling 500 git trees and feeding them to the test
farm behind firewalls.

So the chances are that 0day infrastructure has the ready made setups
to run such service. We already have the commit-by-commit walker to
run checkpatch.pl (though I rarely send its report out due to it'd be
noisy and there is no clear criterion to answer "who would be glad to
receive such reports?").

If we are going to do it, the notification scripts may be hosted in

git://git.kernel.org/pub/scm/linux/kernel/git/wfg/lkp-tests.git

since there will be a copy of it in each build server.

> > > This would be caught immediately if it's properly maintained "project".
> > 
> > Or alternatively would allow people to quickly attack a large number of
> > developers :)
> 
> Indeed.
> 
> 						- Ted
> _______________________________________________
> Ksummit-discuss mailing list
> Ksummit-discuss@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/ksummit-discuss