Some packages have no author and no sources

[jackfirth]

Each of the following packages has no authors and no package source, making them impossible to install and it's unclear who to contact about fixing them:

• autoff
• niceware
• niceware-doc
• niceware-lib
• niceware-test
• pointless-doc
• pointless-lib
• pointless-test
• test1

I suggest removing these packages from the catalog. The way the build system currently works, they're repeatedly bumped to the top of the "recently updated" list and drown out other, actually recently updated packages.

[gregid]

as mentioned on Slack, I believe the author of pointless and niceware is: https://gitlab.com/users/ether-ash/projects

[jackfirth]

I've opened a GitLab issue for the niceware and pointless packages. Thank you @gregid for tracking the author down!

[gregid]

@jackfirth regarding autoff - this looks like an incorrect package created by @samvv , the correct one is also there: https://pkgs.racket-lang.org/package/autoffi

I can confirm that this is the case. Sorry, I probably should have mailed somebody. 

…

-------- Original message -------- From: gregid <notifications@github.com> Date: 12/09/2017 21:54 (GMT+01:00) To: tonyg/racket-pkg-website <racket-pkg-website@noreply.github.com> Cc: Sam Vervaeck <vervaeck.sam@skynet.be>, Mention <mention@noreply.github.com> Subject: Re: [tonyg/racket-pkg-website] Some packages have no author and no &nbsp; sources (#60) @jackfirth regarding autoff - this looks like an incorrect package created by @samvv , the correct one is also there: https://pkgs.racket-lang.org/package/autoffi — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread. {"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/tonyg/racket-pkg-website","title":"tonyg/racket-pkg-website","subtitle":"GitHub repository","main_image_url":"https://cloud.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open in GitHub","url":"https://github.com/tonyg/racket-pkg-website"}},"updates":{"snippets":[{"icon":"PERSON","message":"@gregid in #60: @jackfirth regarding autoff - this looks like an incorrect package created by @samvv , the correct one is also there: https://pkgs.racket-lang.org/package/autoffi"}],"action":{"name":"View Issue","url":"#60 (comment)"}}}

[jackfirth]

@samvv No worries, thank you for the confirmation :)

[jackfirth]

I did a few manual UI tests with the package creation form at https://pkgd.racket-lang.org/pkgn/create. Here are my findings:

• Attempting to create a package with the "Authors" field empty returns a server error and does not create a package.
• Attempting to set the "Authors" field to empty on an existing package returns a server error and does not change the package.
• You can create a package with a different author than the currently logged in user; this should probably be disallowed. A typo in the email could make a package unremovable, but since the authors field defaults to the current user's email manually editing this field is unlikely.
• Creating a package with the default source of git://github.com is allowed. I think this should be an error, but I'm not positive.

[gregid]

@jackfirth what would happen if the git repository is moved as was probably the case with pointless and niceware? Wouldn't it cause these problems?

[jackfirth]

@gregid The package source wouldn't be updated in the catalog, so attempting to install the package would likely fail when a client attempted to clone the repository. AFAIK that wouldn't cause the "Authors" field in the catalog entry to disappear.

[jeapostrophe]

It is not a problem to create a package with other authors, because there can be many people working on a package.

I removed the other packages so @samvv can recreate them with an author listed.

[jackfirth]

It is not a problem to create a package with other authors, because there can be many people working on a package.

That makes sense. But what I meant was that the package creation UI lets you create a package with a list of authors where the currently logged in user is not in the list, which seems dangerous. I think the server should enforce that the user making the creation request has their email in the list of authors for the package.

[jackfirth]

I removed the other packages so @samvv can recreate them with an author listed.

@jeapostrophe Did you remove the pointless and niceware packages as well? We found out who the author is for those packages (see the GitLab issue I opened), and I'd have preferred that we gave them a chance to respond before deleting the packages. I should have updated the initial issue to reflect that, sorry.

[jeapostrophe]

Yes, I deleted them, because they had no author, so the author wouldn't have been able to change them if they wanted to.

[jackfirth]

We could have asked the author for the email address they used (or found it via their GitLab profile) and fixed the packages. Deleting them without warning seems a little user-hostile.

[sorawee]

More packages with the same problem:

• jsonic-mjz
• neu-fall18
• oss
• print-dbg
• rktreq
• vela-doc
• binary-word

[sorawee]

OK, I think what's going on here is that these packages were deleted via the "Delete package" button. pkg-index uses filesystem as the database, so it simply deletes a file that contains the package data. It looks like somewhere in the system the information of the deleted packages are not purged correctly, so when it attempts to update the information, an error occurs. In an attempt to record the error message, it recreates the package with empty source.

One thing that doesn't look right to me is the refresh-packages function from this repo, which simply union local packages with remote packages. This doesn't take the possibility of package deletion into account.

Summary: either pkg-index or something that calls pkg-index (like https://github.com/racket/libs/blob/master/pack-and-upload.rkt?) or both doesn't handle package deletion correctly. The system might potentially be in a state where the invariant (package exists iff package data file exists) doesn't hold. Without an access to the server, I can't tell how bad things are, though.