Re: Updated Sourceware infrastructure plans

[Mark Wielaard <mark@klomp.org>]

Hi Cristian,

On Thu, 2024-05-16 at 11:58 -0400, Cristian Rodríguez wrote:
> On Wed, Apr 17, 2024 at 7:28 PM Mark Wielaard <mark@klomp.org> wrote:
> 
> 
> > More feedback is always welcome. See the various contact options at
> > https://sourceware.org/mission.html#organization
> 
> Sorry to revive this oldish thread but I didn't find any other thread
> where my suggestions will be on-topic
> 
> Today I looked at patchwork briefly and found out I need to register
> an account, bugzilla also needs an account, pretty much everything you
> add will in one way or another register an account.
> Do your plans include some sort of single sign on ? ideally one that
> does not need to register new accounts. or at the very least if "login
> with <your favourite code hosting site> is not acceptable..a
> sourceware-specific keycloak instance that replaces all ad-hoc login
> methods?

Good question. There is also the wiki, where you have to create an
account yourself and then be granted access to the EditorGroup. And of
course when we introduce a "pull request" service, being it through
gerrit or some other method, we will want it to be easily accessible.

Things used to be easy some years back. You only needed an account for
pushing commits to a specific project repository. But you could just
submit patches through email that others could commit for you. Accounts
for bugzilla or the wiki could be created by hand and gave you
immediate permission to submit issues or improvements.

Sadly spammers ruined everything. For email patch submissions we seem
to handle it mostly OK (thanks spamassassin). But for bugzilla and the
wikis we had to hand approve everything. Otherwise spammers would mass
create accounts and just produce so much spam comments the system just
wasn't usable anymore.

So for patchwork and the experimental gerrit server we are setting up
now you can self-register and use the service directly. Spammers don't
seem to have found a way abuse those systems yet. But patchwork has
already accumulated 5000+ accounts...

And they aren't linked. patchwork uses the django user framework, the
current gerrit setup uses keycloak (but Sergio would like to switch to
Authentik). Bugzilla uses its own user framework, as does MoinMoin.

It would be great to have one account system to rule them all. But we
will probably always have to have some procedure to register/enable
accounts to keep spammers out. Hopefully if an account is approved for
one system then we can trust the user to contribute through any of the
others.

Cheers,

Mark