524153 - Deactivate dormant accounts for CVS, SVN, Hg

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[Gervase Markham [:gerv]]

The dormant accounts policy has been agreed, and accounts which have been dormant for more than six months should be deactivated. The files containing the account names of the dormant accounts are attached.

Gerv

Comment 1

[Gervase Markham [:gerv]]

Attachment: Hg dormant accounts

Comment 2

[Gervase Markham [:gerv]]

Attachment: SVN dormant accounts

Comment 3

[Gervase Markham [:gerv]]

Attachment: CVS dormant accounts

Comment 4

[Gervase Markham [:gerv]]

Please let me know if you need any more information from me.

Gerv

Comment 5

[Reed Loden [:reed]]

Er, what? I know for a fact that the Hg list is completely wrong. Please hold off on completing this request.

Comment 6

[Phil Ringnalda (:philor)]

Comment on attachment 408050 [details]
Hg dormant accounts

>[e-mail],Hg

You sure about that?

Comment 7

[Reed Loden [:reed]]

Reassigning to Gerv to get this off IT's queue until issues have been resolved.

Comment 8

[Reed Loden [:reed]]

FYI, I'm taking my issues to the newsgroup, as that's a more appropriate place.

Should this bug just be closed until such issues have been resolved, or do we just want to leave it open but assigned to Gerv until then?

Comment 9

[Reed Loden [:reed]]

(In reply to comment #8)
> FYI, I'm taking my issues to the newsgroup, as that's a more appropriate place.

http://groups.google.com/group/mozilla.governance/msg/1d76bb9ffd809eb1

Comment 10

[Pascal Chevrel:pascalc]

The list of people you want to deactivate for SVN is not accurate, you have in your list people whose SVN access was removed last August at my request:
https://bugzilla.mozilla.org/show_bug.cgi?id=510511

You also have people that I know have committed in the last months as well as the whole IT team

Comment 11

[Gervase Markham [:gerv]]

Pascal: thank you for that report; that seems to be a flaw in the list of "all accounts" sent to me by IT. I will take that up with them.

Can you please give examples of people you know have committed to SVN in the last six months?

Gerv

Comment 12

[Pascal Chevrel:pascalc]

[e-mail] has committed in June for the 3.5 release.


Other examples of people that committed recently:
[e-mail]
[e-mail]
[e-mail]

Comment 13

[Marek Stępień [:marcoos, inactive]]

I did not commit to CVS for some time, but I'd like to keep my account ([e-mail]) until we stop supporting Firefox 3.0. If any (important) bugs are found in 3.0 Polish localization, I'd like to be able to fix them. Other localizers on that list may have similar wishes. :)

Comment 14

[Gervase Markham [:gerv]]

mkmelin appears to have the following accounts:

[e-mail],CVS
[e-mail],Hg
[e-mail],Hg

He appears to be checking in using the "+mozilla" version. Now I know from an email perspective the two Hg accounts are the same, but I don't know if that's true from an Hg account perspective. Can anyone with knowledge of Hg clarify?

Pascal: my new trawl for SVN has fred.castles and bienvenu. 

I have [e-mail] committing but not [e-mail]. Are those the same person? Perhaps he has two accounts and is only using one? Or his account has changed name, and he hasn't committed since?

I still have no record of [e-mail] committing to SVN between the end of April and now. Can you point me at the commit so I can see why I'm missing it?

Thanks,

Gerv

Comment 15

[Pascal Chevrel:pascalc]

For Aserkant:
http://viewvc.svn.mozilla.org/vc/?view=query&dir=&file=&file_match=exact&who=aserkant%40linux-sevenler.org&who_match=exact&comment=&comment_match=exact&querysort=date&hours=2&date=all&mindate=&maxdate=&limit_changes=100

the 2 emails for bogdancev are indeed the same person (and [e-mail] is me but I no longer use this account for commits ;) )

Comment 16

[Gervase Markham [:gerv]]

Pascal: the checkins at the URL you give are all dated 2008 and 2007, which is outside the range I'm looking at (last 6 months). 

I'm not sure what we do with people changing their names. I guess we run the script twice a month apart, and only deactivate people who show up on both runs.

Gerv

Comment 17

[Pascal Chevrel:pascalc]

ah my bad, I thought it was 2009

Comment 18

[matthew zeier [:mrz]]

Nothing for IT to do here until there's an accurate list.

Comment 19

[Gervase Markham [:gerv]]

We now have a list which I think is a great deal more accurate. The issues listed above have been addressed (including the fact that we preserve a set of nominated IT-owned accounts for SVN), and anyone who has got an LDAP account within the last month is excluded. If someone got a new level of access recently and still hasn't checked in anywhere, we can't detect that, so there's still a small possibility of false positives, but this is as good as it's going to get with the tools we have.

Please can IT deactivate all accounts listed in the dormant-* files in this directory?
http://hg.mozilla.org/users/gerv_mozilla.org/active-accounts/file/af616cfd5502/365

We'll start with those inactive for 12 months or more. If that goes OK, we may reduce N to six months.

As soon as it's done, please comment here so I can publicise it, so if there is still the odd problem with the list, people affected know how to get their accounts reactivated quickly.

Gerv

Comment 20

[matthew zeier [:mrz]]

Gerv - is this blocked on 524080 or not?

Comment 21

[Gervase Markham [:gerv]]

mrz: in what sort of timescale do you think you can implement a fix for bug 524080? If the answer is days, then yes, it would be good to get that first. If it will take weeks or months, then I say we should just go ahead with this, and use publicity to make people aware of what might have happened.

Gerv

Comment 22

[[e-mail]]

I just used my CVS account today. Could you please take me off the dormant CVS list? Thanks. :)

Comment 23

[matthew zeier [:mrz]]

I've talked to Gerv about setting some time frame to get the back end LDAP and IT tools infrastructure configured to support this.  

Aravind articulated a number of these in bug 524080 and I'm making this dependent on that.

Working towards 01/15/2010 to wrap this up.

Comment 24

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Since we're already about 3 months past the generation of Gerv's most recent list of accounts to be disabled, I hope that new lists will be generated before disabling ;)

In the event that doesn't happen, I have been actively using my Hg account recently as well, so could you please take me off the dormant Hg list? Thanks. :)

Comment 25

[Aravind Gottipati [:aravind]]

Okay, made some progress here.  LDAP now has a timestamp for the last svn|hg activity on an account.  I now have a script in place that parses ldap activity every 15 minutes and updates the svn|hg accounts with this information.

The missing part is a script that looks through ldap and disabled accounts with last activity > 12 months.  I should have this part done sometime today as well.

Note that I haven't done anything with cvs accounts here.  That part is still manual and will have to be that way for some time.  If we want to automate that we have to spend some time and write a different set of script to work on the cvs server (it doesn't use ldap).

@Gerv: Can you go through and update the dormant-(svn|hg) files in your repo.  Also just an fyi for you, we are now also bringing up a git server (that authenticates off ldap) for folks in webdev.  We probably need a similar policy there.

Comment 26

[Samuel Sidler (:ss)]

(In reply to comment #25)
> We probably need a similar policy there.

Probably need one for bzr.mozilla.org as well.

Comment 27

[Aravind Gottipati [:aravind]]

@Gerv: I have the scripts ready to start locking out old accounts.  Is the list in your mercurial repo good?  If it is, I will go ahead and mark those accounts inactive.

Comment 28

[Gervase Markham [:gerv]]

OK, the list in the Mercurial repo is now good. Aravind: go for it! :-)

http://hg.mozilla.org/users/gerv_mozilla.org/active-accounts/
http://hg.mozilla.org/users/gerv_mozilla.org/active-accounts/file/a4008243abb1/365

(Let's worry about git and bzr another day.)

Gerv

Comment 29

[Aravind Gottipati [:aravind]]

I disabled svn and hg accounts in LDAP.  I also disabled cvs accounts in the shadow file and added a DISABLED string to ssh key.

Comment 30

[Brendan Eich [:brendan]]

I am still using cvs.m.o -- really!

/be

Comment 31

[Gervase Markham [:gerv]]

Brendan: bug 558206 filed.

Gerv

Comment 32

[Aravind Gottipati [:aravind]]

Its been enough time since we closed the bug and I have now changed the scripts to disable accounts after being inactive for 6 months.

Comment 33

[Ben Bucksch (:BenB)]

> after being inactive for 6 months.

This is way too sharp. I contribute constantly, but irregularly, since 12 years, and this makes contributing a pain. Not everybody works for Mozilla full-time.