Re: [TCLCORE] Report of biweekly Tcl/Tk telco on 2025-01-27 12:00 UTC

[Schelte B. <tc...@tc...>]

On 27/01/2025 15:05, Harald Oehlmann wrote:
> 3) fossil login
>
> Some fossil repositories do not allow login creation. This is seen as 
> useful. Schelte Bron may contact repository owners to activate this 
> feature when not enabled.

There was a remark during the meeting that we should be accommodating to 
newcomers who want to contribute. To this I responded that it is very 
hard for anyone to get access rights. Many repositories don't even allow 
self-registering.

But the problems go deeper than that. After registering an account, a 
new contributor will generally get the Reader ("u") capability. This 
means they can edit tickets and wiki pages. To be able to contribute 
code requires the "Developer" (v) or at least the "Check-In" (i) 
capability. An administrator needs to be involved to assign those 
capabilities. There is however no assured method to figure out how to 
contact an administrator for any given repository, or even to find out 
who they are. If self-registering is disabled, one already has to hunt 
down an administrator to even get an account.

In my opinion the following points need to be addressed to be more 
welcoming to new contributors:

*Email notifications*

    Email notifications are required to inform ticket originators about
    follow-up questions. Without them, tickets may be abandoned or make
    very slow progress because they depend on the originator taking the
    initiative to check back for updates.

    A few of the items below also need a method to communicate
    information to the user. Email notifications need to work for that.
    The way to set this up on chiselapp does not work on core.tcl-lang.
    I have contacted Roy Keene for assistance but I have not yet heard
    back from him.

*Self registration*

    New users should be allowed to self register. To prevent too many
    fake accounts, it would be best to enable email verification for
    self-registration. An additional complication is that fossil changed
    policy in 2020. When self-registering, user IDs must now be at least
    6 characters. People who registered on some core repositories with a
    shorter user ID in the past will now not be able to self-register
    with the same ID on other core repositories.

*Obtain developer rights*

    There must be a better way to get developer rights than to ask on
    the Tcl chat if anyone knows who administers a certain repository
    and then go hunt for an email address. I can think of a few
    possibilities:

      * Assign "Check-In" (i) privileges to all new users. This may make
        it too easy for malicious parties to wreak havoc on the code.
      * Assign "Announce" (A) privileges to all new users, so they can
        send a notification to all moderators to request an upgrade of
        their privileges. Currently the "Announce" privilege allows the
        user to send a notification to everyone. This opens up the
        possibility for sending spam to a possibly large number of
        people. Maybe we should work with the fossil developers to get a
        new privilege for only sending a message to the (active)
        administrators. Then any spamming would be restricted to a much
        smaller group.
      * Have some standard page on the repository that lists the
        administrators. This should preferably be generated, otherwise
        it will require maintenance.
      * Have a forum thread where such requests can be posted. Newly
        registered users will need the "Forum-Write" (3) privilege to be
        able to use that. This of course also requires administrators to
        keep an eye on the forum.
      * Define some wiki page where users can add their request to be
        upgraded to developer. An admin can then remove that request
        once it is processed. I don't think the ticket system should be
        abused for this.

    Whatever method is selected, it must be documented in an easy to
    find location.

*Download a tarball*

    On some repositories it is not possible to download a tarball or ZIP
    archive without logging in. Newcomers have trouble enough finding
    those links in the first place. They may get completely discouraged
    if they go to the right place but still don't see the links because
    they didn't log in. Being able to download sources without logging
    in can also be useful for scripts, makefiles, and github actions.

------------------------------------------------------------------------

List of repositories that currently don't allow self registering:

  * tcloo
  * tclvfs
  * expect
  * tclws
  * mpexpr
  * tclquadcode
  * sampleextension
  * tiprender
  * tdbcsqlite3
  * tdbcodbc
  * tdbcmysql
  * tdbcpostgres
  * iwidgets
  * tclapps
  * bwidget
  * mclistbox
  * tclbench
  * tdom
  * wtk
  * tclhttpd
  * tcludp

List of repositories that don't allow downloading a tarball without 
logging in:

  * tclquadcode
  * iwidgets
  * tcllib
  * tclapps
  * bwidget
  * mclistbox
  * tclbench
  * wtk
  * tclhttpd
  * tcludp


Regards,

Schelte.