Fwd: [DISCUSSION] Move PAX projects to Apache Karaf ?

[Jean-Baptiste Onofré]

Hi guys,

Some of you already pinged me to share concerns about PAX projects
governance. I think it's my duty to share these concerns and discuss
possible actions.

Apache Karaf is one of the biggest consumers of PAX projects.

However, PAX projects use a "self own" designed governance:
- for contribution/IP
- for release
- for CVE/Security
- ...

And it could be seen as a major concern for Apache Karaf users, as PAX
projects are not necessarily "aligned" with Apache Foundation rules.

I would like to start a discussion on both Karaf and OPS4J communities
to "move" PAX projects as Karaf subproject (like karaf-pax).
Concretely, it would mean that:
1. Karaf PAX projects would use org.apache.karaf.pax namespace
2. Karaf PAX releases will have to follow the Apache release process
(binding votes, 3 days vote period, ...)
3. Any active contributor on PAX projects would be invited as Karaf committer

Thoughts ?

Regards
JB

[Achim Nierbeck]

Hi JB,

Before I come to any conclusion, I would really like to understand what kind of issue/problem you would like to solve with this, which is easier to solve under an apache umbrella.

thanks, Achim

--

Apache Member

Apache Karaf <http://karaf.apache.org/> Committer & PMC
OPS4J Pax Web <http://wiki.ops4j.org/display/paxweb/Pax+Web/> Committer & Project Lead
blog <http://notizblog.nierbeck.de/>

Co-Author of Apache Karaf Cookbook <http://bit.ly/1ps9rkS>

[Jean-Baptiste Onofré]

Hi Achim

Just wanted to share concerns I received. Basically, PAX projects are
"free fields", without strong guarantee in the release (not formal
staging/vote/review).

It doesn't mean we don't do that, it's just not strongly enforced ;)

I don't mean we *have to* do it, I'm just sharing comments that I got.

Regards
JB

> --
> --
> ------------------
> OPS4J - http://www.ops4j.org - op...@googlegroups.com
>
> ---
> You received this message because you are subscribed to the Google Groups "OPS4J" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ops4j+un...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/ops4j/CAD0r13d2v73ipZrZOD3r9oL9wtSKZj7x2dc4%2By6sWg1rRyvWow%40mail.gmail.com.

[Matt Pavlovich]

Given the recent events around supply chain attacks (ie. Solarwinds) and the renewed focus on security (ie. log4j2), we are seeing an increase in scrutiny over open source projects, their structure, and contributor identity. OPS4J’s approach is problematic from a software supply chain standpoint. The risk is very real that ops4j software will be flagged by automated security scanners for removal from government and enterprise environments—which is a big swath of the ops4j user base.

[Matt Pavlovich]

.. I hit send too soon. In addition to my points on security and supply chain-- it seemed like it might be a good time to discuss what options might look like for ops4j as project infrastructure is also being transitioned.

As a long time ops4j user (and sometimes contributor), I appreciate the work that has been put in by everyone and want to see the work continued.

I appreciate JB's suggestion to maintain the 'pax' name.

Thanks!

Matt Pavlovich

[Łukasz Dywicki]

Hi Jean, hello ops4j participants.

Given recent rush hours with log4j issues I can understand some of the
concerns. However, looking at practical aspects, these issues were
handled as good as they would be at the ASF. Time it took Grzegorz to
release updated pax-logging was pretty short.

If people are concerned about maintenance or governance of ops4j
projects they can/should share their concerns. So far we have just one
statement from Matt and literally 0 of the security related comments
prior this thread. It doesn't make a very solid justification for any
moves in this area yet, especially that all known security issues seem
to be covered.

Best,
Łukasz

On 24.02.2022 16:48, Jean-Baptiste Onofré wrote:
> Hi Achim
>
> Just wanted to share concerns I received. Basically, PAX projects are
> "free fields", without strong guarantee in the release (not formal
> staging/vote/review).
>
> It doesn't mean we don't do that, it's just not strongly enforced ;)
>
> I don't mean we *have to* do it, I'm just sharing comments that I got.
>
> Regards
> JB
>
> On Thu, Feb 24, 2022 at 4:43 PM 'Achim Nierbeck' via OPS4J
> <op...@googlegroups.com> wrote:
>>

[Matt Pavlovich]

Hi Łukasz-

I am relaying our experience from customers, since most enterprises do not communicate directly with communities. If there was community support for a transition, then any issues would be adverted-- which is my reason for bringing it up. As a comparison, even Debian (one of the most freedom focused communities) requires contributor identity verification. (ref: https://www.debian.org/devel/join/nm-step2).

Thank you for hearing me out.

Matt Pavlovich

[Achim Nierbeck]

Hi,

I'm sorry to be a PITA :)

What I've read so far has been feelings, one concern of perception by "big" customers.

I would really like to know, which problem we are trying to solve by moving the pax projects under the umbrella of Karaf.

Or what I personally would favor under their own tlp of the ASF.

Just to clarify, I'm trying the 5 W's here ...

Why do you think it's a good idea to move the Pax Projects under the karaf umbrella?

Why do you think customers have a wrong perception of the Pax Projects ...

and so on ...

What is the core issue we are trying to solve here?

As long as I don't get down to the core thing that needs to be solved I'm not in favor of moving the pax projects anywhere.

Again sorry if I'm PITA.

regards, Achim

Am Do., 24. Feb. 2022 um 22:44 Uhr schrieb Eric Lilja <mindc...@gmail.com>:

Personally, I would love to see this change and the other people in my
organization liked the proposal as well.

- Eric L

[Christoph Läubrich]

I think one problem might be that some of the projects would then be
bound to karaf even more as they are currently are because karaf
"drives" them.

Also it might make feel people that they should only be used with karaf
and are not standalone.

So for me it won't make any sense to name them "karaf-pax" or something
alike, they should either be "pax" or "karaf" but not both.

Am 24.02.22 um 16:42 schrieb 'Achim Nierbeck' via OPS4J:

> Hi JB,
>
> Before I come to any conclusion, I would really like to understand what
> kind of issue/problem you would like to solve with this, which is easier
> to solve under an apache umbrella.
>
> thanks, Achim
>
> Am Do., 24. Feb. 2022 um 15:04 Uhr schrieb Jean-Baptiste Onofré

> <j...@nanthrax.net <mailto:j...@nanthrax.net>>:

> Apache Karaf <http://karaf.apache.org/ <http://karaf.apache.org/>>

> Committer & PMC
> OPS4J Pax Web <http://wiki.ops4j.org/display/paxweb/Pax+Web/
> <http://wiki.ops4j.org/display/paxweb/Pax+Web/>> Committer & Project Lead

> blog <http://notizblog.nierbeck.de/ <http://notizblog.nierbeck.de/>>

> Co-Author of Apache Karaf Cookbook <http://bit.ly/1ps9rkS

> <http://bit.ly/1ps9rkS>>
>
> --
> --
> ------------------

> OPS4J - http://www.ops4j.org <http://www.ops4j.org> - op...@googlegroups.com

>
> ---
> You received this message because you are subscribed to the Google
> Groups "OPS4J" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to ops4j+un...@googlegroups.com

> <mailto:ops4j+un...@googlegroups.com>.

> To view this discussion on the web visit
> https://groups.google.com/d/msgid/ops4j/CAD0r13d2v73ipZrZOD3r9oL9wtSKZj7x2dc4%2By6sWg1rRyvWow%40mail.gmail.com

> <https://groups.google.com/d/msgid/ops4j/CAD0r13d2v73ipZrZOD3r9oL9wtSKZj7x2dc4%2By6sWg1rRyvWow%40mail.gmail.com?utm_medium=email&utm_source=footer>.

[Łukasz Dywicki]

I see problem similar to Achim. We still didn't hear anything about
solving a community trouble. We definitely do not solve a trouble of
ops4j community which probably do not overlap 100% with Karaf. We may be
solving some trouble for Karaf community, however we probably ask about
shifting even more work on already small set of people working on it.
We hear concerns, which might or might not be justified. I don't think
they are since there is no record of any malicious activities made by
people contributing to ops4j/pax.
People which are mainly contributing to these project are well known
(Grzegorz, JB, Achim), externals contributions are coming over pull
requests, just like they would come to the ASF, so why we should be
moving around sources? As far I remember ASF does not scan IDs of their
contributors so it can't guarantee identity of people behind
contributions as well. Back at the times I was signing my agreement I
was sending it by online fax service, so verification was very mild.
While the GPG keys is some kind of resort, a lot of people (including
myself) have self signed key which is as good as my ssh key I use to
push things to git.

The big customers can become part of community if they wish, no matter
where project is hosted - at github or at ASF. So far it seems to me
that they are asking for favor without giving anything back to
communities which will be affected.

Best,
Łukasz

[Jean-Baptiste Onofré]

Thanks all for your comment.

Fair discussion. I agree with you, just wanted to have this open
discussion and share some messages I received.

Let's keep PAX as it is, at OPS4J.

Thanks
Regards
JB

> --
> --
> ------------------
> OPS4J - http://www.ops4j.org - op...@googlegroups.com

>
> ---
> You received this message because you are subscribed to the Google Groups "OPS4J" group.

> To unsubscribe from this group and stop receiving emails from it, send an email to ops4j+un...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/ops4j/5ff43da6-8d5f-43f4-e6e6-86af4fb162b9%40code-house.org.

[Grzegorz Grzybek]

Hello

I don't have clear opinion about which "home" is better (ASF or github.com/ops4j). I was thinking about this idea and here are my random thoughts:

 – [+1] for staying at GH: Not that long ago, I've migrated most of the projects (18) from https://ops4j1.jira.com/ to https://github.com/ops4j/*/issues - it required some effort, but IMO it was worth it - it's really much faster and the "turnaround" is shorter. The only (little) drawback is that we can't set more than one "fixed version" values for an issue. So going back to Jira would be (IMO) stepping back.

 – [+1] for ASF: at ASF we'd get nice CI infra to build the projects

 – [+1] for staying at GH: I'm aware that Pax Logging is quite often used outside of Karaf, so making it Karaf subproject could be confusing

 – [-1] for ASF: Felix already provides OSGi Logging, OSGi Http Service and OSGi Whiteboard implementations.

 – [-1] for ASF: 3 day vote - while totally great practice, for know we enjoy the flexibility to release Pax Logging the day the Log4j CVEs disasters happened (10th December 2021)

 – [+1] for ASF: as JBO said, ASF is a brand and it'd benefit OPS4J projects

 – [+1] for staying at GH: the "spirit" of Open Participation would be preserved. Mind that while I spent considerable amount of time refactoring Pax Logging and Pax Web, I still didn't find a time to work on proper, upgraded manual... Simply not that many people work on the projects.

Bonus thought (but probably impossible) TLP Apache project... It'd however conflict (?) too much with Felix and its reference implementations of OSGi specs.

kind regards, have a good weekend and prayers for peace

Grzegorz Grzybek

pt., 25 lut 2022 o 11:39 Jean-Baptiste Onofré <j...@nanthrax.net> napisał(a):

Thanks all for your comment.

Fair discussion. I agree with you, just wanted to have this open
discussion and share some messages I received.

Let's keep PAX as it is, at OPS4J.

Thanks
Regards
JB

On Fri, Feb 25, 2022 at 11:34 AM Łukasz Dywicki <lu...@code-house.org> wrote:
>

[Christoph Läubrich]

I can only encourage everyone that get "complains" or "concerns" of "big
bussiness" or even single users telling them to simply start
contribution or funding OS projects they depend on:

participation/review/testing (especially upcoming versions) is the best
way to mitigate "supply-chain-attacks" instead of hoping there is any
"governance" doing this for them for free...

Am 25.02.22 um 11:39 schrieb Jean-Baptiste Onofré:

[Achim Nierbeck]

Hi Matt,

Again, sorry for being PITA about it, I would really like to understand what kind of problem should be solved?

I looked at the list of people that are able to work directly on the ops4j projects, 110.
https://github.com/orgs/ops4j/people

Then I know from the past, that we had a couple of pull requests by people not in that list.

Where would we be better with moving those projects under the ASF umbrella?

I really would like to understand the real issue.

Thanks, Achim

Am Di., 29. März 2022 um 12:19 Uhr schrieb Matt Pavlovich <matt.pa...@hyte.io>:

Hello Christoph-

Again, the issue isn't a complaint. OPS4J simply does not have verification of developer identity. More contributions or donations won't solve that. Even the most staunch open source projects (ie Debian) require verification of developer id.

Thank you,

Matt

To view this discussion on the web visit https://groups.google.com/d/msgid/ops4j/677a4877-389d-4d3d-875b-c1009ebf7d7an%40googlegroups.com.

[Christoph Läubrich]

Well obviously log4j being an ASF project has not protected it from
beeing affected by one of the worst bugs, neither has "solarwind" who
most probably knows all developers in person so I don't get it either,
this all for me is more a false-security feeling or just a generic "it
might be better" than any actual measure... there are enough commons-xxx
projects having nothing released for long time.

Am 30.03.22 um 08:28 schrieb 'Achim Nierbeck' via OPS4J:

> Hi Matt,
>
> Again, sorry for being PITA about it, I would really like to understand
> what kind of problem should be solved?
> I looked at the list of people that are able to work directly on the
> ops4j projects, 110.

> https://github.com/orgs/ops4j/people <https://github.com/orgs/ops4j/people>

> Then I know from the past, that we had a couple of pull requests by
> people not in that list.
> Where would we be better with moving those projects under the ASF umbrella?
> I really would like to understand the real issue.
>
> Thanks, Achim
>
> Am Di., 29. März 2022 um 12:19 Uhr schrieb Matt Pavlovich

> <matt.pa...@hyte.io <mailto:matt.pa...@hyte.io>>:

> >> OPS4J - http://www.ops4j.org <http://www.ops4j.org> -

> op...@googlegroups.com
> >>
> >> ---
> >> You received this message because you are subscribed to the
> Google Groups "OPS4J" group.
> >> To unsubscribe from this group and stop receiving emails
> from it, send an email to ops4j+un...@googlegroups.com.
> >> To view this discussion on the web visit
> https://groups.google.com/d/msgid/ops4j/5ff43da6-8d5f-43f4-e6e6-86af4fb162b9%40code-house.org

> <https://groups.google.com/d/msgid/ops4j/5ff43da6-8d5f-43f4-e6e6-86af4fb162b9%40code-house.org>.
>
> >
>
> --
> --
> ------------------
> OPS4J - http://www.ops4j.org <http://www.ops4j.org> -
> op...@googlegroups.com <mailto:op...@googlegroups.com>

>
> ---
> You received this message because you are subscribed to the Google
> Groups "OPS4J" group.
> To unsubscribe from this group and stop receiving emails from it,
> send an email to ops4j+un...@googlegroups.com

> <mailto:ops4j+un...@googlegroups.com>.

> To view this discussion on the web visit

> https://groups.google.com/d/msgid/ops4j/677a4877-389d-4d3d-875b-c1009ebf7d7an%40googlegroups.com
> <https://groups.google.com/d/msgid/ops4j/677a4877-389d-4d3d-875b-c1009ebf7d7an%40googlegroups.com?utm_medium=email&utm_source=footer>.
>
>
>
> --
>
> Apache Member
> Apache Karaf <http://karaf.apache.org/ <http://karaf.apache.org/>>

> Committer & PMC
> OPS4J Pax Web <http://wiki.ops4j.org/display/paxweb/Pax+Web/
> <http://wiki.ops4j.org/display/paxweb/Pax+Web/>> Committer & Project Lead

> blog <http://notizblog.nierbeck.de/ <http://notizblog.nierbeck.de/>>

> Co-Author of Apache Karaf Cookbook <http://bit.ly/1ps9rkS

> <http://bit.ly/1ps9rkS>>
>
> --
> --
> ------------------
> OPS4J - http://www.ops4j.org <http://www.ops4j.org> - op...@googlegroups.com

>
> ---
> You received this message because you are subscribed to the Google
> Groups "OPS4J" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to ops4j+un...@googlegroups.com

> <mailto:ops4j+un...@googlegroups.com>.

> To view this discussion on the web visit

> https://groups.google.com/d/msgid/ops4j/CAD0r13fOhe0cuxNxs5CrMTHgiFTAJuM2zi%2BfcWxfP%3DpuV_tejw%40mail.gmail.com
> <https://groups.google.com/d/msgid/ops4j/CAD0r13fOhe0cuxNxs5CrMTHgiFTAJuM2zi%2BfcWxfP%3DpuV_tejw%40mail.gmail.com?utm_medium=email&utm_source=footer>.