SC member allow for a platform for the Nix community to state their thoughts about reinstating @domenkozar commit bit, and sin conjuring is exactly what they are doing.
Almost every person speaking out has said similarly inflammatory statements.
nixpkgs-committers#162
13 likes · 483 views
Just another day of the "anti-fasch" mentally-ill trying to remove previous pillars of the Nix community. Naming this the "Great woke replacement".
nixpkgs-committers#162
25 likes · 656 views
@lassulus @hexa Could one of you please unpin this? (Sorry for the personal ping, I'd mention the admins group as was done above, but I am apparently not allowed to do so.)
The information here is outdated, and this is now documented in NixOS/nixpkgs-committers (which is linked in nixpkgs' CONTRIBUTING.md).
5 likes
@zimbatm They’re pretty squishy — that is to say, human-tested. I tried to write up what the expectations are in the reader on that repo. See samestep for example of what an *outstanding* candidate looks like. nixpkgs-committers#144
13 views
@zimbatm Are there people who ought to have a Nixpkgs commit but that don’t today? I’d love nominations in NixOS/nixpkgs-committers
1 like · 7 views
[quote="miangraham, post:6, topic:80221"]
In other words, “be a committer who isn’t completely idle” seems to be the intent of that one.
[/quote]
Given the semi-automatic retirement system in nixpkgs-committers, is the reason behind "merged 1 PR in the past 4 years" instead of using all current committers just so that semi-recently retired committers can vote? It may be worth clarifying that in the docs.
1 like
Inactivity cutoff for retirement from nixpkgs commit bit moving to 6mo
TL;DR: We (@mdaniels5757, @philiptaron, @mattsturgeon) plan to merge nixpkgs-committers#159 one week from now, on or after Thursday, October 30. After that, the retirement automation will flag committers who haven't merged a PR in six months instead of one year.
What's changing
RFC 55 set up retirement of inactive committers, and nixpkgs-committers automates it. Every cutoff that is currently one year becomes six months:
- Activity: you count as active if you've merged a Nixpkgs PR in the last 6 months (previously 1 year).
- New committers: anyone who got commit access in the last 6 months is skipped (previously 1 year).
- Closed retirement PRs: if your retirement PR gets closed, the next one waits another 6 months (previously 1 year).
Everything else stays as it is:
- Retirement still goes through an automated PR that pings you, and by default it's merged and implemented one month later.
- One merge in the window is still enough to count as active.
- Retired committers can still re-nominate themselves with a PR.
I can't promise what others will do, but I will be generous about re-granting access. I want your talent to multiply!
Why
The discussion is in nixpkgs-committers#109. In short:
- Write access to Nixpkgs is a security liability. GHSA-67f2-674w-6g63 turned out to have no direct impact, but responding to it showed how much auditing work compromised committer credentials can create. Every account with commit access is something we may have to audit. That cost is worth paying for people who are using the access, and less so for people who aren't.
- RFC 55 expected this. The one-year threshold was deliberately conservative, and the RFC noted that "the threshold may need adjustment in the future." The project has grown a lot in the 6½ years since.
- It matches the release cycle. Six months is one NixOS release.
- It matches the GitHub audit log. The audit log keeps six months of history. The security team supports this change and asked for it to be implemented.
To be clear, going inactive says nothing about anyone's character. People get busy, change jobs, take breaks, or move on to other things. Lord knows I got less active over the past year due to circumstances.
Retirement only means the access is no longer in use. It is not a judgement. We want you and your full self.
What to expect after the merge
Committers whose last merge was between 6 and 12 months ago will start getting retirement PRs in the nixpkgs-committers repo. If you get one of these PRs and want to keep your access, you can reply on the PR. If your access is removed and you later want it back, open a re-nomination PR.
Not part of this change
#109 also floated other ideas that this PR does not include:
- removing the one-month waiting period,
- tightening which merges count (for example, excluding self-merges or merges the merge bot could have done),
- requiring more than one merge per period.
This is the easy mode: 6 months.
Feedback
PR #159 is open for comments for the next week. Please give your feedback there.
20 likes
Mentions
SC member allow for a platform for the Nix community to state their thoughts about reinstating @domenkozar commit bit, and sin conjuring is exactly what they are doing. Almost every person speaking out has said similarly inflammatory statements. nixpkgs-committers#162
Just another day of the "anti-fasch" mentally-ill trying to remove previous pillars of the Nix community. Naming this the "Great woke replacement". nixpkgs-committers#162
@lassulus @hexa Could one of you please unpin this? (Sorry for the personal ping, I'd mention the admins group as was done above, but I am apparently not allowed to do so.) The information here is outdated, and this is now documented in NixOS/nixpkgs-committers (which is linked in nixpkgs' CONTRIBUTING.md).
@zimbatm They’re pretty squishy — that is to say, human-tested. I tried to write up what the expectations are in the reader on that repo. See samestep for example of what an *outstanding* candidate looks like. nixpkgs-committers#144
@zimbatm Are there people who ought to have a Nixpkgs commit but that don’t today? I’d love nominations in NixOS/nixpkgs-committers
[quote="miangraham, post:6, topic:80221"] In other words, “be a committer who isn’t completely idle” seems to be the intent of that one. [/quote] Given the semi-automatic retirement system in nixpkgs-committers, is the reason behind "merged 1 PR in the past 4 years" instead of using all current committers just so that semi-recently retired committers can vote? It may be worth clarifying that in the docs.
Inactivity cutoff for retirement from nixpkgs commit bit moving to 6mo TL;DR: We (@mdaniels5757, @philiptaron, @mattsturgeon) plan to merge nixpkgs-committers#159 one week from now, on or after Thursday, October 30. After that, the retirement automation will flag committers who haven't merged a PR in six months instead of one year. What's changing RFC 55 set up retirement of inactive committers, and nixpkgs-committers automates it. Every cutoff that is currently one year becomes six months: - Activity: you count as active if you've merged a Nixpkgs PR in the last 6 months (previously 1 year). - New committers: anyone who got commit access in the last 6 months is skipped (previously 1 year). - Closed retirement PRs: if your retirement PR gets closed, the next one waits another 6 months (previously 1 year). Everything else stays as it is: - Retirement still goes through an automated PR that pings you, and by default it's merged and implemented one month later. - One merge in the window is still enough to count as active. - Retired committers can still re-nominate themselves with a PR. I can't promise what others will do, but I will be generous about re-granting access. I want your talent to multiply! Why The discussion is in nixpkgs-committers#109. In short: - Write access to Nixpkgs is a security liability. GHSA-67f2-674w-6g63 turned out to have no direct impact, but responding to it showed how much auditing work compromised committer credentials can create. Every account with commit access is something we may have to audit. That cost is worth paying for people who are using the access, and less so for people who aren't. - RFC 55 expected this. The one-year threshold was deliberately conservative, and the RFC noted that "the threshold may need adjustment in the future." The project has grown a lot in the 6½ years since. - It matches the release cycle. Six months is one NixOS release. - It matches the GitHub audit log. The audit log keeps six months of history. The security team supports this change and asked for it to be implemented. To be clear, going inactive says nothing about anyone's character. People get busy, change jobs, take breaks, or move on to other things. Lord knows I got less active over the past year due to circumstances. Retirement only means the access is no longer in use. It is not a judgement. We want you and your full self. What to expect after the merge Committers whose last merge was between 6 and 12 months ago will start getting retirement PRs in the nixpkgs-committers repo. If you get one of these PRs and want to keep your access, you can reply on the PR. If your access is removed and you later want it back, open a re-nomination PR. Not part of this change #109 also floated other ideas that this PR does not include: - removing the one-month waiting period, - tightening which merges count (for example, excluding self-merges or merges the merge bot could have done), - requiring more than one merge per period. This is the easy mode: 6 months. Feedback PR #159 is open for comments for the next week. Please give your feedback there.