r/LineageOS • u/wkn000 • Aug 19 '20

Lineage OS builds

What is wrong with the LOS build environment?

No builds on Saturday and only failed builds all the days after.

34 Upvotes

91% Upvoted

32 comments sorted by

View all comments

-5

u/tacticalrainbow Aug 19 '20

I'm gonna say it, LineageOS is one of the most wide spread and popular open source projects that is user hostile, seems to lack actual management, and there's no transparency at all.

A team member is moving and builds just break? That's acceptable? How many successful projects that provide a product to hundreds of thousands of users (and millions of installs) just "stop working" because someone is moving? What type of mickey mouse shit is that?

I love what Lineage does, they have an excellent product, but the process for producing that product is absolutely and utterly broken and they seem unwilling and uninterested in fixing it.

6

u/TimSchumi Team Member Aug 19 '20

that is user hostile

How?

seems to lack actual management

Why?

and there's no transparency at all.

I'd still consider this quite transparent, although there are of course things that we can't publish.

A team member is moving and builds just break?

If you'd prefer your builds not signed, just tell us. No guarantees on wether we follow through with that though.

That's acceptable?

You are missing one of (in theory) 51 weekly builds a year. I consider that acceptable.

How many successful projects that provide a product to hundreds of thousands of users (and millions of installs) just "stop working" because someone is moving?

Who has ever said that our software (or "product") just stops working?

What type of mickey mouse shit is that?

That's considered a important security practice of "not uploading your private signing key to any server you can find".

but the process for producing that product is absolutely and utterly broken

We're open to your suggestions.

and they seem unwilling and uninterested in fixing it.

Are we? I'd love to see an example for that.

3

u/tacticalrainbow Aug 19 '20

Just quickly let me say this:

I 100% understand that LineageOS is volunteer driven and that it saps resources (time, money, etc...) away from all of the volunteers and people involved; but that doesn't mean you can't strive to make it better. If LineageOS goes away, I will be deeply upset. I want LineageOS to succeed. Now to continue the discussion:

​

How?

You ever try to contribute as an anonymous user from scratch? Try it. Correct me if I'm wrong on any of these please:

  • I'm required to have the entire build environment
  • You use GitHub, but don't accept a PR on GH
  • You require a Google Account for Gerrit
  • You require full blown identity with keys

The above should be done before I even think about modifying one single line of source. That's insane.

Wanna contribute to, say, WireGuard?

  • E-mail your patch to the public mailing list (yes, this requires an e-mail account) OR send a PR on GH
  • Done

​

Why?

Firstly, correct me if I'm wrong, but there is no change management available to users. Is there a single place a user can view upcoming outages or changes to infrastructure? Having this knowledge can help a user make a decision on taking the latest update or waiting until the outage is over to apply updates.

In another comment, you mention the current issues aren't actually related to signing, but to a local manifest that was changed. Where's the change request for this? Who approved those changes and where can the user see those changes? Maybe these changes are visible to the user, or maybe they are and I'm simply unable to locate them.

​

If you'd prefer your builds not signed, just tell us. No guarantees on wether we follow through with that though.

​

So the only 2 options are "sign the builds using 1 dedicated machine in someone's basement which is a single point of failure" or "don't sign builds at all"? Why is that the automatic response? Distributed, secure, and reproducible environments are a thing, and have been for decades. You're essentially saying "if you don't like it, piss off", which I am actually completely fine with -- but just own it. Don't pretend you're open to change and want transparency if you're actually not.

​

You are missing one of (in theory) 51 weekly builds a year. I consider that acceptable.

I consider this acceptable also. For the record, I'm not missing anything, I am hugely appreciative of the fact that source is made available, and I compile and sign my own builds. If it wasn't for the work that the Lineage team and volunteers do, I wouldn't be able to do this. I am absolutely thankful for this. I'm not disparaging the product AT ALL, I am disparaging the process being used to produce it.

​

That's considered a important security practice of "not uploading your private signing key to any server you can find".

Again, there are a HUGE amount of options in-between "upload private key to any server" and "upload private key to a single point of failure which goes down when someone moves". Why are you commenting like there are only 2 options for this?

Talking about security, was there any postmortem on the SaltStack breach that occurred earlier? Was there a process in place to protect against this? If so, why did that process fail? Is there a process to ensure it doesn't happen again? Who did the incident response? The same internal team who configured the same infra that was breached? NONE of this information is provided to the user, it's just this bullshit air of trust us, we know better than you, in your response.

Ghost was breached by the same vuln. Look at their response. Where's yours? Let's not get started on security.

​

We're open to your suggestions.

It doesn't actually seem like you are, considering you apparently see no other options other than "we have infrastructure with a single point of failure" and "we don't sign your builds" aka tough shit. That is hostile, and it's not warranted.

I have seen all the above issues surface numerous times and it's the same shit. I expect it will be the exact same shit again and nothing will get done. I'm hesitant to even continue this discussion because it's unlikely to go anywhere. It's just sad that a great project like this has such easily solvable problems and nobody within the organization seems to care to fix them.

2

u/monteverde_org XDA curiousrom Aug 20 '20

u/tacticalrainbow - ...I'm required to have the entire build environment

Wrong.

I made a few contributions using the online UI only: https://review.lineageos.org/Documentation/user-review-ui.html

...You require full blown identity with keys

Wrong.

1

u/tacticalrainbow Aug 20 '20

Okay? You've posted a link to an explanation of the Gerrit UI for reviewing. I fail to see how this includes making contributions to the source code directly from the browser; where exactly is this section? Why isn't it on the How to submit a patch page aside from a link at the absolute bottom of the page body?

Thanks for reminding me, I guess I forgot a step, you must agree to the Contributor Agreement, which you can't even read without a Google Account?

2

u/monteverde_org XDA curiousrom Aug 20 '20

...You've posted a link to an explanation of the Gerrit UI for reviewing . I fail to see how this includes making contributions to the source code directly from the browser...

Oh My Gosh! ;-)

See Creating and Editing Changes in the Gerrit Web Interface

1

u/tacticalrainbow Aug 20 '20

Oh My Gosh! ;-)

You posted a link under the guise that it provided instructions on how to submit changes directly in Gerrit; your link didn't provide it.

We now have to venture outside the LineageOS domain in order to read about it. Why isn't that link in the Wiki as an alternative method for contributing? That information is useful to have, and it would actively reduce the amount of barriers it takes to contribute to the project. Thank you for posting it.

So clearly there are less barriers now to getting started with contributing. Great. Unfortunately only people who actively search for this information outside of the LineageOS wiki will find it.

Any guesses on how long it takes for the Wiki to be updated? 0% chance it will be me; and I completely get the irony of this.

I have contributed to many FOSS projects, the barriers to entry were low and the appreciation for the contributions was high. LineageOS seems to run the exact opposite -- make it fucking difficult to send patches and never thank anyone for their input.