)]}'
{"resolutions/20170530-binary-artifacts.rst":[{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"f3ef7cce49cf67820b52038714cfe603a0fd3277","unresolved":false,"context_lines":[{"line_number":29,"context_line":"tools that we are adopting do release binary artifacts as a standard"},{"line_number":30,"context_line":"practice. Container images and full system images are often published"},{"line_number":31,"context_line":"to community-specific indexing services such as Docker Hub or"},{"line_number":32,"context_line":"Vagrant\u0027s Atlas service. The results can then be consumed by anyone"},{"line_number":33,"context_line":"familiar with the tools for searching those repositories. Binary"},{"line_number":34,"context_line":"executables built from compiled languages such as Go are often made"},{"line_number":35,"context_line":"available from project websites, as well."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_fecfa77c","line":32,"updated":"2017-05-31 14:37:06.000000000","message":"there is also quay.io.  I\u0027d recommend generalizing this to a general container image delivery service as there are likely to be more in the future.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"41eba66cddb6093188dedc74179615983bf3c0a7","unresolved":false,"context_lines":[{"line_number":29,"context_line":"tools that we are adopting do release binary artifacts as a standard"},{"line_number":30,"context_line":"practice. Container images and full system images are often published"},{"line_number":31,"context_line":"to community-specific indexing services such as Docker Hub or"},{"line_number":32,"context_line":"Vagrant\u0027s Atlas service. The results can then be consumed by anyone"},{"line_number":33,"context_line":"familiar with the tools for searching those repositories. Binary"},{"line_number":34,"context_line":"executables built from compiled languages such as Go are often made"},{"line_number":35,"context_line":"available from project websites, as well."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_fda9e4dc","line":32,"in_reply_to":"df140735_78e72ae6","updated":"2017-05-31 19:44:02.000000000","message":"I thought the \"such as\" was the generalization and the examples were given in case someone doesn\u0027t know what a \"community-specific indexing service\" is. How would you rephrase that to make it more clear?","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"4942557bcab4c3c18fc4bf1dabd7d1172de0a87f","unresolved":false,"context_lines":[{"line_number":29,"context_line":"tools that we are adopting do release binary artifacts as a standard"},{"line_number":30,"context_line":"practice. Container images and full system images are often published"},{"line_number":31,"context_line":"to community-specific indexing services such as Docker Hub or"},{"line_number":32,"context_line":"Vagrant\u0027s Atlas service. The results can then be consumed by anyone"},{"line_number":33,"context_line":"familiar with the tools for searching those repositories. Binary"},{"line_number":34,"context_line":"executables built from compiled languages such as Go are often made"},{"line_number":35,"context_line":"available from project websites, as well."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_55e8127a","line":32,"in_reply_to":"df140735_e91c8f14","updated":"2017-06-06 13:05:28.000000000","message":"Ok, i am taking this comment block to be a no-op :)","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"0f79cd0f13176ddf0054eb20e5780c4ac54509b2","unresolved":false,"context_lines":[{"line_number":29,"context_line":"tools that we are adopting do release binary artifacts as a standard"},{"line_number":30,"context_line":"practice. Container images and full system images are often published"},{"line_number":31,"context_line":"to community-specific indexing services such as Docker Hub or"},{"line_number":32,"context_line":"Vagrant\u0027s Atlas service. The results can then be consumed by anyone"},{"line_number":33,"context_line":"familiar with the tools for searching those repositories. Binary"},{"line_number":34,"context_line":"executables built from compiled languages such as Go are often made"},{"line_number":35,"context_line":"available from project websites, as well."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_bdd5ace7","line":32,"in_reply_to":"df140735_fda9e4dc","updated":"2017-05-31 19:58:27.000000000","message":"Ah. good point. I missed that the first time.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"041e5778d13a1729901a7da2403bfa8714f4c398","unresolved":false,"context_lines":[{"line_number":29,"context_line":"tools that we are adopting do release binary artifacts as a standard"},{"line_number":30,"context_line":"practice. Container images and full system images are often published"},{"line_number":31,"context_line":"to community-specific indexing services such as Docker Hub or"},{"line_number":32,"context_line":"Vagrant\u0027s Atlas service. The results can then be consumed by anyone"},{"line_number":33,"context_line":"familiar with the tools for searching those repositories. Binary"},{"line_number":34,"context_line":"executables built from compiled languages such as Go are often made"},{"line_number":35,"context_line":"available from project websites, as well."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_78e72ae6","line":32,"in_reply_to":"df140735_fecfa77c","updated":"2017-05-31 16:07:44.000000000","message":"+1","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":10787,"name":"Michal Jastrzebski (inc0)","email":"michal.jastrzebski@intel.com","username":"inc0"},"change_message_id":"d4f95b73d37b923d90873cda01a0709271d1b126","unresolved":false,"context_lines":[{"line_number":29,"context_line":"tools that we are adopting do release binary artifacts as a standard"},{"line_number":30,"context_line":"practice. Container images and full system images are often published"},{"line_number":31,"context_line":"to community-specific indexing services such as Docker Hub or"},{"line_number":32,"context_line":"Vagrant\u0027s Atlas service. The results can then be consumed by anyone"},{"line_number":33,"context_line":"familiar with the tools for searching those repositories. Binary"},{"line_number":34,"context_line":"executables built from compiled languages such as Go are often made"},{"line_number":35,"context_line":"available from project websites, as well."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_e91c8f14","line":32,"in_reply_to":"df140735_fecfa77c","updated":"2017-05-31 22:19:08.000000000","message":"I think \"such as\" points to it as an example","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"d9c866e755d7cc87562dfab8ae79d34ada54e849","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  artifacts, to enable them to know which artifacts are compatible"},{"line_number":49,"context_line":"  with each other and to be able to find appropriate"},{"line_number":50,"context_line":"  documentation. For this reason, the metadata for each artifact must"},{"line_number":51,"context_line":"  clearly specify the name and version of the principle component it"},{"line_number":52,"context_line":"  contains. For example, if an image contains the nova conductor from"},{"line_number":53,"context_line":"  version 16.0.0, that information should be accessible, either"},{"line_number":54,"context_line":"  through the name or through metadata associated with the image using"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_de098c95","line":51,"range":{"start_line":51,"start_character":46,"end_line":51,"end_character":55},"updated":"2017-05-31 09:53:47.000000000","message":"Did you mean \"principal\"? Maybe say \"primary\" to be consistent with the next bullet points ?","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5660,"name":"Kurt Taylor","email":"kurt.r.taylor@gmail.com","username":"krtaylor"},"change_message_id":"9f86cfd6cc2db546ab7dde122ef5bec20a19472b","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  artifacts, to enable them to know which artifacts are compatible"},{"line_number":49,"context_line":"  with each other and to be able to find appropriate"},{"line_number":50,"context_line":"  documentation. For this reason, the metadata for each artifact must"},{"line_number":51,"context_line":"  clearly specify the name and version of the principle component it"},{"line_number":52,"context_line":"  contains. For example, if an image contains the nova conductor from"},{"line_number":53,"context_line":"  version 16.0.0, that information should be accessible, either"},{"line_number":54,"context_line":"  through the name or through metadata associated with the image using"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_c4e916e3","line":51,"range":{"start_line":51,"start_character":38,"end_line":51,"end_character":39},"updated":"2017-06-06 11:29:18.000000000","message":"maybe also specify the architecture (ppc64le, aarch64, x86_64, etc)?","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"4942557bcab4c3c18fc4bf1dabd7d1172de0a87f","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  artifacts, to enable them to know which artifacts are compatible"},{"line_number":49,"context_line":"  with each other and to be able to find appropriate"},{"line_number":50,"context_line":"  documentation. For this reason, the metadata for each artifact must"},{"line_number":51,"context_line":"  clearly specify the name and version of the principle component it"},{"line_number":52,"context_line":"  contains. For example, if an image contains the nova conductor from"},{"line_number":53,"context_line":"  version 16.0.0, that information should be accessible, either"},{"line_number":54,"context_line":"  through the name or through metadata associated with the image using"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_15ddfade","line":51,"range":{"start_line":51,"start_character":38,"end_line":51,"end_character":39},"in_reply_to":"df140735_55db724d","updated":"2017-06-06 13:05:28.000000000","message":"Marcin, Gema, Kurt, Since this is \"guide/policy\" document, we don\u0027t have to spell out all details.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":11797,"name":"Gema Gomez-Solano","email":"gema.gomez-solano@linaro.org","username":"gema"},"change_message_id":"85a552ab3637eb773dce1cdec800e8f34b6901fb","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  artifacts, to enable them to know which artifacts are compatible"},{"line_number":49,"context_line":"  with each other and to be able to find appropriate"},{"line_number":50,"context_line":"  documentation. For this reason, the metadata for each artifact must"},{"line_number":51,"context_line":"  clearly specify the name and version of the principle component it"},{"line_number":52,"context_line":"  contains. For example, if an image contains the nova conductor from"},{"line_number":53,"context_line":"  version 16.0.0, that information should be accessible, either"},{"line_number":54,"context_line":"  through the name or through metadata associated with the image using"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_24b4527f","line":51,"range":{"start_line":51,"start_character":38,"end_line":51,"end_character":39},"in_reply_to":"df140735_c4e916e3","updated":"2017-06-06 11:41:30.000000000","message":"+1 to specifying architecture.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":24072,"name":"Marcin Juszkiewicz","email":"mjuszkiewicz@redhat.com","username":"hrw"},"change_message_id":"57014be8bb0b5b7b7a0174cf70c487c3dc4c9740","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  artifacts, to enable them to know which artifacts are compatible"},{"line_number":49,"context_line":"  with each other and to be able to find appropriate"},{"line_number":50,"context_line":"  documentation. For this reason, the metadata for each artifact must"},{"line_number":51,"context_line":"  clearly specify the name and version of the principle component it"},{"line_number":52,"context_line":"  contains. For example, if an image contains the nova conductor from"},{"line_number":53,"context_line":"  version 16.0.0, that information should be accessible, either"},{"line_number":54,"context_line":"  through the name or through metadata associated with the image using"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_55db724d","line":51,"range":{"start_line":51,"start_character":38,"end_line":51,"end_character":39},"in_reply_to":"df140735_c4e916e3","updated":"2017-06-06 12:54:45.000000000","message":"Not \u0027maybe\u0027 but it should be mandatory. Defaulting to x86_64 to not interrupt standard users.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"25dc72cd256ac37986b255168b1762942191f258","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  artifacts, to enable them to know which artifacts are compatible"},{"line_number":49,"context_line":"  with each other and to be able to find appropriate"},{"line_number":50,"context_line":"  documentation. For this reason, the metadata for each artifact must"},{"line_number":51,"context_line":"  clearly specify the name and version of the principle component it"},{"line_number":52,"context_line":"  contains. For example, if an image contains the nova conductor from"},{"line_number":53,"context_line":"  version 16.0.0, that information should be accessible, either"},{"line_number":54,"context_line":"  through the name or through metadata associated with the image using"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_984c439f","line":51,"range":{"start_line":51,"start_character":46,"end_line":51,"end_character":55},"in_reply_to":"df140735_de098c95","updated":"2017-05-31 14:04:16.000000000","message":"Oops, yes, thanks.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"f3ef7cce49cf67820b52038714cfe603a0fd3277","unresolved":false,"context_lines":[{"line_number":60,"context_line":"  reason, all published binary artifacts must be accompanied by a"},{"line_number":61,"context_line":"  manifest describing the versions of all components used to build it,"},{"line_number":62,"context_line":"  whether they be the libraries used to build an executable or the"},{"line_number":63,"context_line":"  system packages included in an image."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* The contents of binary artifacts \"age\" and become out of date as"},{"line_number":66,"context_line":"  development work continues, either on the primary component or on"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_5e8d732f","line":63,"updated":"2017-05-31 14:37:06.000000000","message":"ack - viable - although this does require more work on kolla (or others that want to follow the same model) to get there.  This is something I have long wanted anyway, so +1 :)","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":10787,"name":"Michal Jastrzebski (inc0)","email":"michal.jastrzebski@intel.com","username":"inc0"},"change_message_id":"d4f95b73d37b923d90873cda01a0709271d1b126","unresolved":false,"context_lines":[{"line_number":60,"context_line":"  reason, all published binary artifacts must be accompanied by a"},{"line_number":61,"context_line":"  manifest describing the versions of all components used to build it,"},{"line_number":62,"context_line":"  whether they be the libraries used to build an executable or the"},{"line_number":63,"context_line":"  system packages included in an image."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* The contents of binary artifacts \"age\" and become out of date as"},{"line_number":66,"context_line":"  development work continues, either on the primary component or on"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_c9f0abcc","line":63,"in_reply_to":"df140735_5e8d732f","updated":"2017-05-31 22:19:08.000000000","message":"Manifesto that will point to all the versions *and* all the zuul jobs container had passed was in our plans for it anyway","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"4942557bcab4c3c18fc4bf1dabd7d1172de0a87f","unresolved":false,"context_lines":[{"line_number":60,"context_line":"  reason, all published binary artifacts must be accompanied by a"},{"line_number":61,"context_line":"  manifest describing the versions of all components used to build it,"},{"line_number":62,"context_line":"  whether they be the libraries used to build an executable or the"},{"line_number":63,"context_line":"  system packages included in an image."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* The contents of binary artifacts \"age\" and become out of date as"},{"line_number":66,"context_line":"  development work continues, either on the primary component or on"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_35eb5e78","line":63,"in_reply_to":"df140735_c9f0abcc","updated":"2017-06-06 13:05:28.000000000","message":"Ok, i am taking this comment block to be a no-op :)","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"f3ef7cce49cf67820b52038714cfe603a0fd3277","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  need to know whether they have a recent version, or if they are far"},{"line_number":69,"context_line":"  out of date. For this reason, all binary artifacts should include"},{"line_number":70,"context_line":"  metadata containing the date they were built, as well as the date"},{"line_number":71,"context_line":"  they were published (if it is different)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Users need to be able to reproduce environments, and developers need"},{"line_number":74,"context_line":"  to be able to reproduce builds in order to investigate issues."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_3e999f6d","line":71,"updated":"2017-05-31 14:37:06.000000000","message":"+1.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"4942557bcab4c3c18fc4bf1dabd7d1172de0a87f","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  need to know whether they have a recent version, or if they are far"},{"line_number":69,"context_line":"  out of date. For this reason, all binary artifacts should include"},{"line_number":70,"context_line":"  metadata containing the date they were built, as well as the date"},{"line_number":71,"context_line":"  they were published (if it is different)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Users need to be able to reproduce environments, and developers need"},{"line_number":74,"context_line":"  to be able to reproduce builds in order to investigate issues."}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_9597caec","line":71,"in_reply_to":"df140735_3e999f6d","updated":"2017-06-06 13:05:28.000000000","message":"ok","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"d9c866e755d7cc87562dfab8ae79d34ada54e849","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  metadata containing the date they were built, as well as the date"},{"line_number":71,"context_line":"  they were published (if it is different)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Users need to be able to reproduce environments, and developers need"},{"line_number":74,"context_line":"  to be able to reproduce builds in order to investigate issues."},{"line_number":75,"context_line":"  Contributors to projects should not be expected to support or debug"},{"line_number":76,"context_line":"  arbitrary versions packaged by someone else.  For these reasons,"},{"line_number":77,"context_line":"  binary artifacts published to third-party registries should only be"},{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_1e1dc4bc","line":79,"range":{"start_line":73,"start_character":2,"end_line":79,"end_character":61},"updated":"2017-05-31 09:53:47.000000000","message":"Beyond using clear versions, I would add that the tooling to reproduce builds must be easily accessible and well-documented. The easier it is to reproduce a build, the less people will be inclined to take the ones we provide as the only canonical truth.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"25dc72cd256ac37986b255168b1762942191f258","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  metadata containing the date they were built, as well as the date"},{"line_number":71,"context_line":"  they were published (if it is different)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Users need to be able to reproduce environments, and developers need"},{"line_number":74,"context_line":"  to be able to reproduce builds in order to investigate issues."},{"line_number":75,"context_line":"  Contributors to projects should not be expected to support or debug"},{"line_number":76,"context_line":"  arbitrary versions packaged by someone else.  For these reasons,"},{"line_number":77,"context_line":"  binary artifacts published to third-party registries should only be"},{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_d82e3ba4","line":79,"range":{"start_line":73,"start_character":2,"end_line":79,"end_character":61},"in_reply_to":"df140735_1e1dc4bc","updated":"2017-05-31 14:04:16.000000000","message":"Good point. How about adding this to the end:\n\n  The inputs to recreate the build, including configuration files and build scripts,\n  must be made available so that anyone can rebuild the image.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"41eba66cddb6093188dedc74179615983bf3c0a7","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  metadata containing the date they were built, as well as the date"},{"line_number":71,"context_line":"  they were published (if it is different)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Users need to be able to reproduce environments, and developers need"},{"line_number":74,"context_line":"  to be able to reproduce builds in order to investigate issues."},{"line_number":75,"context_line":"  Contributors to projects should not be expected to support or debug"},{"line_number":76,"context_line":"  arbitrary versions packaged by someone else.  For these reasons,"},{"line_number":77,"context_line":"  binary artifacts published to third-party registries should only be"},{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_5df3300b","line":79,"range":{"start_line":73,"start_character":2,"end_line":79,"end_character":61},"in_reply_to":"df140735_383f7226","updated":"2017-05-31 19:44:02.000000000","message":"Here I\u0027m talking about the configuration files that are inputs for the build tools, not for production operation of the results.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"fcf5d1da56b2969d6e47b8225cc798e8bc8217b0","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  metadata containing the date they were built, as well as the date"},{"line_number":71,"context_line":"  they were published (if it is different)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Users need to be able to reproduce environments, and developers need"},{"line_number":74,"context_line":"  to be able to reproduce builds in order to investigate issues."},{"line_number":75,"context_line":"  Contributors to projects should not be expected to support or debug"},{"line_number":76,"context_line":"  arbitrary versions packaged by someone else.  For these reasons,"},{"line_number":77,"context_line":"  binary artifacts published to third-party registries should only be"},{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_8b08502c","line":79,"range":{"start_line":73,"start_character":2,"end_line":79,"end_character":61},"in_reply_to":"df140735_5df3300b","updated":"2017-06-01 09:10:42.000000000","message":"The proposed added blurb would work for me.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"4942557bcab4c3c18fc4bf1dabd7d1172de0a87f","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  metadata containing the date they were built, as well as the date"},{"line_number":71,"context_line":"  they were published (if it is different)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Users need to be able to reproduce environments, and developers need"},{"line_number":74,"context_line":"  to be able to reproduce builds in order to investigate issues."},{"line_number":75,"context_line":"  Contributors to projects should not be expected to support or debug"},{"line_number":76,"context_line":"  arbitrary versions packaged by someone else.  For these reasons,"},{"line_number":77,"context_line":"  binary artifacts published to third-party registries should only be"},{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_95c0eae2","line":79,"range":{"start_line":73,"start_character":2,"end_line":79,"end_character":61},"in_reply_to":"df140735_8b08502c","updated":"2017-06-06 13:05:28.000000000","message":"Looks like we need an edit from thie comment block","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"041e5778d13a1729901a7da2403bfa8714f4c398","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  metadata containing the date they were built, as well as the date"},{"line_number":71,"context_line":"  they were published (if it is different)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Users need to be able to reproduce environments, and developers need"},{"line_number":74,"context_line":"  to be able to reproduce builds in order to investigate issues."},{"line_number":75,"context_line":"  Contributors to projects should not be expected to support or debug"},{"line_number":76,"context_line":"  arbitrary versions packaged by someone else.  For these reasons,"},{"line_number":77,"context_line":"  binary artifacts published to third-party registries should only be"},{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_383f7226","line":79,"range":{"start_line":73,"start_character":2,"end_line":79,"end_character":61},"in_reply_to":"df140735_9ec0ab2c","updated":"2017-05-31 16:07:44.000000000","message":"Being specific is good. +1 to build scripts, config files, etc. Out of scope though is full mirroring of all build inputs just to make a reporduceable build (yum/apt repos, base centos/ubuntu container, etc) They are already available.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"f3ef7cce49cf67820b52038714cfe603a0fd3277","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  metadata containing the date they were built, as well as the date"},{"line_number":71,"context_line":"  they were published (if it is different)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"* Users need to be able to reproduce environments, and developers need"},{"line_number":74,"context_line":"  to be able to reproduce builds in order to investigate issues."},{"line_number":75,"context_line":"  Contributors to projects should not be expected to support or debug"},{"line_number":76,"context_line":"  arbitrary versions packaged by someone else.  For these reasons,"},{"line_number":77,"context_line":"  binary artifacts published to third-party registries should only be"},{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_9ec0ab2c","line":79,"range":{"start_line":73,"start_character":2,"end_line":79,"end_character":61},"in_reply_to":"df140735_d82e3ba4","updated":"2017-05-31 14:37:06.000000000","message":"little too specific in my mind.  For example, kolla does not ship configuration files in dockerfiles at all, and neither does TripleO in their adoption of kolla images.\n\nAll that said, I htink if this can be made more general, +1 from  me:)","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":4162,"name":"Paul Belanger","email":"pabelanger@redhat.com","username":"pabelanger"},"change_message_id":"cff99801935d3dc28beaabf6303c838bd695722b","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_a14fe690","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"updated":"2017-05-30 23:38:20.000000000","message":"Some technical concerns to think of, this could increase the amount of username / passwords openstack-infra may have to manage. So, it would be good to get some feedback from the PTL.\n\nTo me, this implies OpenStack would still own said project namespaces so our automation tools publish to them.  It would likely be best for teams to relinquish credentials too, so avoid conflicts between automation / manual publishing.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":308,"name":"Thierry Carrez","email":"thierry@openstack.org","username":"ttx"},"change_message_id":"fcf5d1da56b2969d6e47b8225cc798e8bc8217b0","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_4bb47735","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_26586830","updated":"2017-06-01 09:10:42.000000000","message":"I think it is a bit early, yes...\n\nFWIW I think one way to make sure binary artifacts are not \"owned by the community at large\" is to separate \"releasing OpenStack official deliverables\" from \"publishing binary artifacts from specific teams\". While the former needs to be blessed by humans, the latter could use a more continuous delivery approach as Kevin suggested.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"041e5778d13a1729901a7da2403bfa8714f4c398","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_98667e29","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_430fdce0","updated":"2017-05-31 16:07:44.000000000","message":"@Doug, the workflow I have in mind in particular is, something like:\n\nnova releases 1.16.0. We tag a kolla stable build associated with it.\n\nThat triggers a build/release of container 1.16.0-1. (This is pretty standard so far)\n\nSome time passes and redhat releases security update to openssl.\n\nPeriodic job kicks off, notices 1.16.0-1 is out of date, builds/tests 1.16.0-2, gate tests the new container, and if it passes the tests, Its ready for pushing to the hub.\n\nIs the process above considered part of the release teams work? If so, it has an input of fingerprints associated with the previous builds in addition to git source tags.\n\nIf it isn\u0027t part of the release team\u0027s process, how do we give it to the release team, as its not source? We want to ensure our binary builds actually work against gate tests, not just a fresh build from source that may not work.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"f3ef7cce49cf67820b52038714cfe603a0fd3277","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_be024fb3","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_430fdce0","updated":"2017-05-31 14:37:06.000000000","message":"dockerhub works a bit like pypi.  Using that as an analogy, when someone creates a new openstack project, they register the pypi project.  THen they ad openstackci to the project, and openstackci (while not owning the pypi) can push to it.  The original pypi registrant still \"owns\" the pypi registration.\n\ndockerhub has the same feature-set.  Assuming infra wanted full control over the credentials, I\u0027d support that.  It is not possible to \"transfer\" a namespace to a third party in dockerhub, so atleast one account (mine as I registered kolla) would need to be registered with the account in question.\n\nI for one, would really like to see the removal of all the various people from the dockerhub kolla account and tighten restrictions to just the original account registrant and openstackci as it would improve security/reduce accidental pushes, etc).","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":4162,"name":"Paul Belanger","email":"pabelanger@redhat.com","username":"pabelanger"},"change_message_id":"1d6256bb13939804acde058635776e09c4b84638","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_b8c915ad","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_4bb47735","updated":"2017-06-01 20:50:53.000000000","message":"As long as openstackci user can be added to docker hub projects, that is great. It means a single set of credentials we use to publish into various name spaces. Relinquishing credentials is still helpful, means less things can go wrong with automation.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"25dc72cd256ac37986b255168b1762942191f258","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_430fdce0","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_64255cab","updated":"2017-05-31 14:04:16.000000000","message":"@Kevin: The container builds need to pull inputs only from tags, but don\u0027t have to be triggered only from the tag event.\n\n@Paul: I definitely don\u0027t want to build a policy that makes the infra team\u0027s lives harder. I don\u0027t know if there are ways to add metadata to images (via naming or tagging) to indicate which team owns them while still having a single account. If so, that may take care of my concerns. It would be good to work that out so we know we have a solution that works for everyone, but I don\u0027t think we need to hard-code the answer here in the policy.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"0f79cd0f13176ddf0054eb20e5780c4ac54509b2","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_fd71e4df","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_7d3154a2","updated":"2017-05-31 19:58:27.000000000","message":"@Doug. Ok. Lets table that part of the conversation until the Release team gets involved then.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"c338284604ab2a1eb155c5c54655296911382e7b","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_83e04698","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_8046fc4e","updated":"2017-05-31 21:48:20.000000000","message":"@dims\n\nIts a large amount of work to pin rpms/debs to particular versions. One of the great features of docker is the ability to ship bit for bit what was built/tested. Involving git/people in something that can be completely automated seems like a huge amount of extra work. What benefit would there be in it? I\u0027m worried it will be quite fragile with the pinning too.\n\nI\u0027m talking about:\n\nrpms repos ---V\ngit source ---\u003e docker build -\u003e  Changed? (yes) -\u003e tests -\u003e  ship only changed containers.\n\na fairly simple workflow. No loops or anything back to git with parallel builds/tests to determine the pins, no humans needed for most random package updates, and with the exact container being the thing tested.\n\nWhats built/tested is whats shipped.\n\nI think, with the workflow your suggesting, we\u0027d have to do a periodic build test without pins, then figure out if anything changed, do a full test suite to ensure its good, completely throw those containers away, post just the pins as a change to git, human review it, then repeat the whole process, just with pins, producing the same container set again, re-test it all over again, and then release it. more then 2x the amount of work to end up with the same result?\n\nI think the manifest is only really needed by the logic determining if its worth shipping a new container or not, and by folks that are interested in what is in the built container. Not what exact things are needed to rebuild an already built container with.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"78714c761ebbc1b54fbcab85b5a28f2ba1d677e7","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_e0aff8e0","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_8046fc4e","updated":"2017-05-31 20:45:55.000000000","message":"Please see discussion at:\nhttp://eavesdrop.openstack.org/irclogs/%23openstack-dev/%23openstack-dev.2017-05-30.log.html#t2017-05-30T18:01:33","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"8d96e1cb923a0fb9c8b978c5771b0929b34f6c1b","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_26586830","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_83e04698","updated":"2017-05-31 22:08:05.000000000","message":"@dims, I think maybe the issue here is, kolla needs to do things the docker way. And the release team does things differently then that.\n\nThe proposal as I read it here is about letting teams release binaries as they need without being blessed as a normal \"release\". This feels to me outside of what the release team is about.\n\nMaybe, in time, once kolla has straightened out the workflow to the point the release team wants to pick it up/adapt to it, and openstack wants to more officially support the artefacts, that would be a good time to switch over to release team management of the artefacts?\n\nMaybe we\u0027re just too early in the process to be talking about release team integration of the workflow?","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"33a7732450f6b56289a645b165a0d271e5a1542b","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_8046fc4e","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_98667e29","updated":"2017-05-31 20:44:26.000000000","message":"This is exactly what i was talking about with inc0, the periodic job would update a manifest file (list of things and versions) and file a review (just like the requirements bot). the team would bless the change and the file gets updated in the git repo. The team would then request a release and we would set up jobs that would mint a container with exactly the things present in the manifest.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"41eba66cddb6093188dedc74179615983bf3c0a7","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_7d3154a2","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_98667e29","updated":"2017-05-31 19:44:02.000000000","message":"Whether the release team gets involved in building these sorts of artifacts is a bit orthogonal. I\u0027m wearing my TC hat here, trying to describe some guidelines that I think we need to have in place before we start publishing. I\u0027ll let Thierry speak for whether and when the release team gets involved in any of this, since he\u0027s the PTL this cycle.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"ed70dc45203a53de1ac02e466dfc1bb6c5afa5bf","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_64255cab","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_a14fe690","updated":"2017-05-30 23:46:43.000000000","message":"+1.\n\nBut, with the added twist that containers could be built/tested in infra jobs faster then stable tags get pushed. So needs to work under the constraint that stable tags getting pushed arn\u0027t the only way to trigger the push.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"4942557bcab4c3c18fc4bf1dabd7d1172de0a87f","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_95658a20","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_b8c915ad","updated":"2017-06-06 13:05:28.000000000","message":"Paul, Ok, i am taking this comment block to be a no-op :) (no need to edit the review)","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"041e5778d13a1729901a7da2403bfa8714f4c398","unresolved":false,"context_lines":[{"line_number":78,"context_line":"  built from well-defined points in the history of an OpenStack"},{"line_number":79,"context_line":"  project, identified with signed tags on the git repository."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* We do not want the artifacts to be seen as owned by the community at"},{"line_number":82,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":83,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":84,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":85,"context_line":"  should be used instead."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_984f9e91","line":85,"range":{"start_line":81,"start_character":0,"end_line":85,"end_character":25},"in_reply_to":"df140735_be024fb3","updated":"2017-05-31 16:07:44.000000000","message":"I\u0027m ok giving up credentials too. But the workflow we need does need to be supported by some process beforehand.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"f3ef7cce49cf67820b52038714cfe603a0fd3277","unresolved":false,"context_lines":[{"line_number":88,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"},{"line_number":89,"context_line":"  go if they do want help. For this reason, each artifact must be"},{"line_number":90,"context_line":"  published with metadata, such as a bug tracker URL, describing where"},{"line_number":91,"context_line":"  and how to seek help."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"* Consumers of these artifacts need to understand the limits of the"},{"line_number":94,"context_line":"  support they are likely to be able to receive. All of our official"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_5e09f392","line":91,"updated":"2017-05-31 14:37:06.000000000","message":"+1.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"7ecc1c0ecba4cd88469e41be04b9a6e8decd999f","unresolved":false,"context_lines":[{"line_number":94,"context_line":"  support they are likely to be able to receive. All of our official"},{"line_number":95,"context_line":"  projects are released under the `Apache License"},{"line_number":96,"context_line":"  \u003chttp://www.apache.org/licenses/LICENSE-2.0.html\u003e`__, which includes"},{"line_number":97,"context_line":"  a *Disclaimer of Warranty* stating that the software is provided"},{"line_number":98,"context_line":"  without warranty and a *Limitation of Liability* saying that"},{"line_number":99,"context_line":"  contributors are not liable for damages. It also, however, includes"},{"line_number":100,"context_line":"  a clause allowing \"redistributors\" to offer additional levels of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_de92ac4b","line":97,"updated":"2017-05-31 09:48:06.000000000","message":"would be nice to put a requirement for applications shipped with such published binaries to throw that disclaimer to stdout /log file as well, when started from such binaries. And emphasize those shall not be used in production.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"25dc72cd256ac37986b255168b1762942191f258","unresolved":false,"context_lines":[{"line_number":94,"context_line":"  support they are likely to be able to receive. All of our official"},{"line_number":95,"context_line":"  projects are released under the `Apache License"},{"line_number":96,"context_line":"  \u003chttp://www.apache.org/licenses/LICENSE-2.0.html\u003e`__, which includes"},{"line_number":97,"context_line":"  a *Disclaimer of Warranty* stating that the software is provided"},{"line_number":98,"context_line":"  without warranty and a *Limitation of Liability* saying that"},{"line_number":99,"context_line":"  contributors are not liable for damages. It also, however, includes"},{"line_number":100,"context_line":"  a clause allowing \"redistributors\" to offer additional levels of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_e31cb014","line":97,"in_reply_to":"df140735_de92ac4b","updated":"2017-05-31 14:04:16.000000000","message":"That feels a bit user-hostile. I think as long as the license for the artifact is clearly indicated, we\u0027re covered.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"814307cbf081a439601bc28fd9f128f922bc9dd4","unresolved":false,"context_lines":[{"line_number":94,"context_line":"  support they are likely to be able to receive. All of our official"},{"line_number":95,"context_line":"  projects are released under the `Apache License"},{"line_number":96,"context_line":"  \u003chttp://www.apache.org/licenses/LICENSE-2.0.html\u003e`__, which includes"},{"line_number":97,"context_line":"  a *Disclaimer of Warranty* stating that the software is provided"},{"line_number":98,"context_line":"  without warranty and a *Limitation of Liability* saying that"},{"line_number":99,"context_line":"  contributors are not liable for damages. It also, however, includes"},{"line_number":100,"context_line":"  a clause allowing \"redistributors\" to offer additional levels of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_ee4810cd","line":97,"in_reply_to":"df140735_e31cb014","updated":"2017-05-31 17:00:50.000000000","message":"[I am not a lawyer, this is not legal advice, but...] There often won\u0027t be a \"the license\" for an artifact, particularly in the case of software aggregation like VM and container images. The collectively-distributed aggregation comes with many different licenses conveyed to and then reconveyed by the distributor. So while this particular bullet does probably apply to traditional executable/package artifacts, it\u0027s not really safe to say that the specific disclaimer from the Apache license also applies to all the other software we\u0027re bundling in, say, built images.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"41eba66cddb6093188dedc74179615983bf3c0a7","unresolved":false,"context_lines":[{"line_number":94,"context_line":"  support they are likely to be able to receive. All of our official"},{"line_number":95,"context_line":"  projects are released under the `Apache License"},{"line_number":96,"context_line":"  \u003chttp://www.apache.org/licenses/LICENSE-2.0.html\u003e`__, which includes"},{"line_number":97,"context_line":"  a *Disclaimer of Warranty* stating that the software is provided"},{"line_number":98,"context_line":"  without warranty and a *Limitation of Liability* saying that"},{"line_number":99,"context_line":"  contributors are not liable for damages. It also, however, includes"},{"line_number":100,"context_line":"  a clause allowing \"redistributors\" to offer additional levels of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_fde1e4fd","line":97,"in_reply_to":"df140735_ee4810cd","updated":"2017-05-31 19:44:02.000000000","message":"Yes, that\u0027s a good point. I included this bit because one of the arguments used to justify our ability to build these things was that our software was Apache-licensed, so no one should be expecting any support if they use the artifacts. I wanted to point out why that line of argument was not valid (IMHO), and ensure that we don\u0027t suddenly end up with a \"Production Container Image Support\" team causing users to think the community has decided we\u0027re going to collectively support their production deployments. I\u0027m certainly open to alternative wording that accomplishes that.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"4942557bcab4c3c18fc4bf1dabd7d1172de0a87f","unresolved":false,"context_lines":[{"line_number":94,"context_line":"  support they are likely to be able to receive. All of our official"},{"line_number":95,"context_line":"  projects are released under the `Apache License"},{"line_number":96,"context_line":"  \u003chttp://www.apache.org/licenses/LICENSE-2.0.html\u003e`__, which includes"},{"line_number":97,"context_line":"  a *Disclaimer of Warranty* stating that the software is provided"},{"line_number":98,"context_line":"  without warranty and a *Limitation of Liability* saying that"},{"line_number":99,"context_line":"  contributors are not liable for damages. It also, however, includes"},{"line_number":100,"context_line":"  a clause allowing \"redistributors\" to offer additional levels of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_954eaa94","line":97,"in_reply_to":"df140735_fde1e4fd","updated":"2017-06-06 13:05:28.000000000","message":"Doug, No one has chimed in with alternative. So let\u0027s go with what we have","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"f3ef7cce49cf67820b52038714cfe603a0fd3277","unresolved":false,"context_lines":[{"line_number":100,"context_line":"  a clause allowing \"redistributors\" to offer additional levels of"},{"line_number":101,"context_line":"  support. Teams must not indicate that they are offering support for"},{"line_number":102,"context_line":"  any binary artifacts in a way that implies the warranty or liability"},{"line_number":103,"context_line":"  for that support extends to the rest of the community."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"References"},{"line_number":106,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df140735_1e037b75","line":103,"updated":"2017-05-31 14:37:06.000000000","message":"+1.","commit_id":"44f2fcdcd93f3cfc26b493aee93a90a1ee158a07"},{"author":{"_account_id":5660,"name":"Kurt Taylor","email":"kurt.r.taylor@gmail.com","username":"krtaylor"},"change_message_id":"f8d32e4aff8e3a56190e3e494087dcce14294f66","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  artifacts, to enable them to know which artifacts are compatible"},{"line_number":49,"context_line":"  with each other and to be able to find appropriate"},{"line_number":50,"context_line":"  documentation. For this reason, the metadata for each artifact must"},{"line_number":51,"context_line":"  clearly specify the name and version of the principle component it"},{"line_number":52,"context_line":"  contains. For example, if an image contains the nova conductor from"},{"line_number":53,"context_line":"  version 16.0.0, that information should be accessible, either"},{"line_number":54,"context_line":"  through the name or through metadata associated with the image using"}],"source_content_type":"text/x-rst","patch_set":3,"id":"df140735_75d88c7e","line":51,"updated":"2017-06-07 12:14:42.000000000","message":"If this resolution is defining the minimum information to be included in the artifact metadata, I believe that it needs to also include the architecture. If not defined here now, it won\u0027t be included.","commit_id":"6232a3ab1643654e434eb1583b6a2931595521f7"},{"author":{"_account_id":11797,"name":"Gema Gomez-Solano","email":"gema.gomez-solano@linaro.org","username":"gema"},"change_message_id":"271f1df08817f56a3f913e369d7b548c9717427c","unresolved":false,"context_lines":[{"line_number":44,"context_line":"so, while mitigating the risks associated with someone inevitably"},{"line_number":45,"context_line":"using the results in production."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"* Users need to know what they are getting when they download"},{"line_number":48,"context_line":"  artifacts, to enable them to know which artifacts are compatible"},{"line_number":49,"context_line":"  with each other and to be able to find appropriate"},{"line_number":50,"context_line":"  documentation. For this reason, the metadata for each artifact must"},{"line_number":51,"context_line":"  clearly specify the name and version of the principle component it"},{"line_number":52,"context_line":"  contains. For example, if an image contains the nova conductor from"},{"line_number":53,"context_line":"  version 16.0.0, that information should be accessible, either"},{"line_number":54,"context_line":"  through the name or through metadata associated with the image using"},{"line_number":55,"context_line":"  whatever mechanism is common to the index or repository service"},{"line_number":56,"context_line":"  where the image is published."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"* Consumers of these artifacts need to be able to track bugs and"},{"line_number":59,"context_line":"  security issues in components included in the artifacts. For this"}],"source_content_type":"text/x-rst","patch_set":3,"id":"df140735_d8b0ade0","line":56,"range":{"start_line":47,"start_character":2,"end_line":56,"end_character":31},"updated":"2017-06-07 12:33:13.000000000","message":"Suggested rewording, including architecture awareness:\n\"\nUsers need to know what they are getting when they download artifacts, to enable them to know which artifacts are compatible with each other, with their infrastructure and to be able to find appropriate documentation. For this reason, the metadata for each artifact must clearly specify the name and version of the principal component it contains as well as the architecture for which it is built. For example, if an image contains the nova conductor from version 16.0.0, that information should be accessible, either through the name or through metadata associated with the image using whatever mechanism is common to the index or repository service where the image is published.\n\"","commit_id":"6232a3ab1643654e434eb1583b6a2931595521f7"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"20d3c173479c4bd4a89a206f487ad9fb4ac413c9","unresolved":false,"context_lines":[{"line_number":85,"context_line":"  large, if only a few people can actually address issues. For this"},{"line_number":86,"context_line":"  reason, the metadata for binary artifacts must not say or imply that"},{"line_number":87,"context_line":"  they are produced by \"the OpenStack community.\" Specific team names"},{"line_number":88,"context_line":"  should be used instead."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"* Because only a subset of the community is producing and maintaining"},{"line_number":91,"context_line":"  the artifacts, we need to ensure it is clear to consumers where to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"df140735_7e7ce41f","line":88,"updated":"2017-06-07 15:35:25.000000000","message":"This seemed surprizing at first, but it totally makes sense to be clear which team has produced the binary, rather than it being \"OpenStack\" that produced it.","commit_id":"6bc8e67df51fa4b79362516b6b96c6621a6f9ae4"}]}