IPMI Maintainer Call 3/27/2018

IPMI Maintainer Call 3/27/2018

[Emily Shaffer]

[-- Attachment #1: Type: text/plain, Size: 2723 bytes --]

Meeting 3/27/2018

Agenda:


   -

   Discuss centralization of some IPMI functionalities into shared utility
   library - how much of entire IPMI stack can we deduplicate? See
   https://gerrit.openbmc-project.xyz/#/c/9501/1 - simply copying code
   between the two projects is unacceptable.  (This may be partially solved by
   next point…)
   -

      Decided not to cover this point, it is covered by the next point.
      -

   Present & review IPMI refactor design proposal
   -

      How to present upstream? Brad suggests having the design doc reviewed
      as a .md in Gerrit.
      -

      Vernon will address maintainer comments on Friday when he’s back from
      vacation, we will convert to.md and put up on openbmc/docs for review
      -

   Interim rules during Tom’s absence - don't get eaten by dropbears!
   -

      If someone is out, we have 2 more maintainers; the other 2
      maintainers should agree on anything.  So basically business as usual.
      -

      Tom will ask Deepak <dkodihalli> to review IBM patchsets before they
      make it up to ipmid
      -

      What if two people are out? ...We’ll cross that bridge later. If it’s
      for a day or two, not an issue; if it’s for a week, we might
need to elect
      Supreme Leader
      -

   https://github.com/openbmc/openbmc/issues/2943 - Discuss this issue
   -

      For default user account, there’s no support to set or change the
      password today.
      -

      Intel is working on some management in this area
      -

      IBM interested in putting throwaway code
      -

      Previously, Intel added OEM password for root and did not distribute
      it.  (We don’t want IPMI users able to get in as root) Many moons ago….
      -

      FB seems to very much want to be able to login as root
      -

      Separate from Unix user, SSH login, REST login, etc
      -

      Google has serious security concerns
      -

      IBM needs this for release coming up soon for partial functionality
      -

      Possible for IBM to only apply as downstream patch?  (+1 from Vernon
      & Emily)
      -

   What about change to add username (-U) to use ipmitool over network?
   -

      Vernon: would prefer username was required (security concern). RAKP
      includes username as part of keygen
      -

   When to meet w/ time change?
   -

      9:30 Pacific (no change for Pacific), 1hr earlier for India
      -

   Brief OCP recap
   -

   Vernon is on vacation now until Fri
   -

   Tom will be on vacation Fri until 4/21
   -

   No change to maintainer approval rules in that time

[-- Attachment #2: Type: text/html, Size: 16156 bytes --]

Re: IPMI Maintainer Call 3/27/2018

[Brad Bishop]

> On Mar 28, 2018, at 1:22 AM, Emily Shaffer <emilyshaffer@google.com> wrote:
> 		• Possible for IBM to only apply as downstream patch?  (+1 from Vernon & Emily)
> 	• What about change to add username (-U) to use ipmitool over network?
> 		• Vernon: would prefer username was required (security concern). RAKP includes username as part of keygen

I would just advise careful consideration here.  If you don’t provide people
a path to upstreaming what they want to do, it will lead to forks and
fragmentation.  It doesn’t have to be easy, just possible.

This isn’t a threat - please don’t take it as one.  I’m not close enough
to the problem at hand to have a stance on once side or the other.  I’m just
pointing out that this is an aspect you should consider when weighing the
pros and cons of allowing something to be upstreamed.

I realize my past behavior may not match what I’m saying but in the
last year this is a lesson I’ve definitely learned and taken to heart.

Maybe to start an in depth outline of what the sticking points are could
be shared and we can all weigh in?