[openstack-dev] [devstack] Possible issues cryptography 1.0 and os-client-config 1.6.2

Clint Byrum clint at fewbar.com
Fri Aug 14 09:26:28 UTC 2015


Excerpts from Chris Dent's message of 2015-08-14 02:08:28 -0700:
> On Fri, 14 Aug 2015, Robert Collins wrote:
> 
> > The vast majority of our developers do not fix such bugs. They react
> > by blacklisting the proximate cause of the issue - the new release -
> > locally, submit a patch to openstack/requirements *sometimes* and if
> > we're really lucky file a bug upstream.
> 
> That sounds like a social disease.
> 

If we're good with all of the developers of OpenStack being affected,
why aren't we good with the gate's being affected?

Shouldn't everyone be forced to fix those bugs to fix the gate? It
sounds good, but we tried that, and the experiment provided _years_
of data that even when the gate is broken, only a few fix it and not on
the priority that should be garnered by something affecting nearly all
developers at once.

I'd say it's less disease, and more economic reality. We have revolving
debt in real economies for a reason. Stopping to think about the exact
source of all cash flow every time you need to incur an expense has a
massive cost in loss of focus and opportunity.

The same is true for these bugs. Yes they're real, yes more orgs should
devote developers to fixing them. But we can consider the issues caused
by external forces separately from landing code because we have the
constraints capability now. I think developers will be more productive
if they are also allowed to keep the two concerns separate. Meanwhile
we can observe how far behind we actually get because of these problems
without drawing the whole of OpenStack down with us.

> > The constraints system proactively finds and highlights to anyone
> > interested the same issues [presuming the issue can be shown in the
> > gate]. It does that via a bot that updates constraints automatically
> > via a periodic job.
> 
> I appreciate the value of the automation but from my standpoint in
> addition to helping some aspects of the problem it also allows the
> social disease to carry on. Maybe diseased is just the way things are
> here, and if so, fine, we'll have to deal with it.
> 
> But I'm not going to stop popping my head up above the parapet every
> now and again to say "hey, let's stop allowing this to be okay"
> before going back to making more stuff.
> 
> > Its visible: follow
> > https://review.openstack.org/#/q/status:open+project:openstack/requirements+branch:master+topic:openstack/requirements/constraints,n,z
> 
> Awesome, thanks for pointing this out, that will be useful.
> 
> But again: Underlying my assertion is that we don't _just_ need more
> tools and automation we also need to remind ourselves of the kind of
> environment that we're operating in, as humans.
> 
> I'm not against the automation of the gate side of things. Yes,
> great, you and others are doing some stellar work to insure
> stability. Thank you _very_ much. I'm arguing about the devstack
> default.
> 
> And even then, I'm not arguing that we don't set it, rather that we
> just pause a moment and think about the side effects, if any.
> 

Your concerns are valid and appreciated. However, I think the side
effect of not setting it is wasting developer time on a large scale. The
side effect of setting it is putting that work into a queue which an
appropriately sized subset of developers can manage.



More information about the OpenStack-dev mailing list