<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, 7 Nov 2019 at 07:59, <<a href="mailto:Mikko.Rapeli@bmw.de">Mikko.Rapeli@bmw.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
On Wed, Nov 06, 2019 at 05:53:27PM +0000, Richard Purdie wrote:<br>
> On Wed, 2019-11-06 at 16:06 +0000, <a href="mailto:Mikko.Rapeli@bmw.de" target="_blank">Mikko.Rapeli@bmw.de</a> wrote:<br>
> > Hi,<br>
> > <br>
> > On Wed, Nov 06, 2019 at 02:59:16PM +0000, Ryan Harkin wrote:<br>
> > > Hi Ross/Richard,<br>
> > > <br>
> > > I'd like this applied to Sumo also. Should I create a new patch and<br>
> > > send it<br>
> > > to the list, or is there a process for requesting this is cherry-<br>
> > > picked<br>
> > > across?<br>
> > <br>
> > I just posted the port of this and all other CVE scan related changes<br>
> > to sumo<br>
> > <a href="http://lists.openembedded.org/pipermail/openembedded-core/2019-November/288817.html" rel="noreferrer" target="_blank">http://lists.openembedded.org/pipermail/openembedded-core/2019-November/288817.html</a><br>
> > <br></blockquote><div><br></div><div>Thanks Mikko! That's a great help, I guess my question was good timing for our mutual interest in Sumo.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
> > But the question is valid :)<br>
> <br>
> Support for sumo officially ended. I can see a case that the broken CVE<br>
> tools there are a good reason we could consider merging the patch<br>
> series but we do need to be able to test it to merge it to the main<br>
> branch. If we can't test, we're merging blind and the quality the<br>
> project tries to deliver could be compromised.<br>
> <br>
> I have made some tweaks to the autobuilder which bring us closer to<br>
> being able to test sumo using the workers still around from that<br>
> release.<br>
> <br>
> The things that make me nervous are questions like:<br>
> <br>
> Which releases do we "open" for such patches? How far back do we go?<br>
> Which kinds of patches are acceptable?<br>
> <br>
> Note that sumo (and earlier) doesn't have much of the QA automation<br>
> which we've now built our processes around so we don't get test<br>
> reports.<br>
> <br>
> You mention wanting to change gcc. That means we really do need a full<br>
> retest of it to merge that (which is why it never happened originally<br>
> from what I remember).<br>
> <br>
> Also, the LTS proposal stated we needed someone to handle this work. We<br>
> have no such person, even if we do somehow find them, they can't be<br>
> expected to cover all the old releases and effectively turn all of them<br>
> into LTS releases. How can we get the funding to try and get some help<br>
> with handling this workload?<br>
> <br>
> I am probably going to try and make a case for sorting the CVE tooling<br>
> on sumo as I agree its bad and we should do something. Where do we draw<br>
> the line though.<br>
> <br>
> Basically, this looks like it could create a lot of extra work without<br>
> helping the core project under-resourcing we currently struggle with.<br>
> You can therefore see why I might be nervous :/.<br>
<br>
All this is understood.<br></blockquote><div><br></div><div>Agreed. It's an expensive and tricky task.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
I need to maintain sumo in a project for a while longer so I can publish that work.<br>
The CVE checker patches are just a start.<br></blockquote><div><br></div><div>Yes, the same is true for me. I need to maintain a Sumo distro until mid-2020, at least. It uses the poky merge branch [1]. My support may extend further when the time comes.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Providing funding for Yocto Project LTS work is possible but a lot harder for me to do.<br>
Testing and publishing patches is much easier.<br></blockquote><div><br></div><div>Not sure if it helps, but I have a Jenkins job that tests sumo on a trigger (there is one for Warrior also):</div><div><br></div><div><a href="https://ci.linaro.org/job/warp7-openembedded-sumo/">https://ci.linaro.org/job/warp7-openembedded-sumo/</a></div><div><br></div><div>eg. it was triggered when Armin's patch was merged yesterday.</div><div><br></div><div><div>This builds Sumo, based on Linaro's OE-RPB distro for NXP WaRP7 (imx7s-warp). It then runs the build in our LAVA lab (although the boards have gone down recently, they're normally up). Once the boards are up again, I'll add ptest to the job, to give it a more thorough workout. I'll also add the sumo-next branch to the list of build configurations.</div></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Could you clarify Yocto Project side answers to these questions:<br>
<br>
If I continue to publish patches for sumo, can I continue doing so on oe-core mailing list?<br>
<br>
If I continue to collect patches for sumo, can I do so using Yocto Project infrastructure, e.g.<br>
a sumo-contrib-lts or similar branch in poky git tree?<br>
<br>
If I continue to test patches, what would be the patch acceptance criteria and required testing?<br>
I would assume same as stable release rules, but maybe these need to be even stricter, e.g.<br>
only support building on Debian stable, following the LTS proposal. I'm testing in my own project<br>
trees and CI with target HW, and doing world builds on pure poky with qemu target. I could some<br>
kind of ptest execution to plain poky as well.<br>
<br>
Would any testing of patches be possible in Yocto Project infrastructure?<br>
<br>
All of these things I can do also completely outside of Yocto Project, e.g. publish a sumo<br>
git tree on github, and rely only on my own testing. But I'd like to see<br>
some co-operation here from other users who are stuck with sumo.<br>
<br>
-Mikko</blockquote><div><br></div><div>[1] <a href="http://git.yoctoproject.org/git/poky">http://git.yoctoproject.org/git/poky</a> </div></div></div>