09:03 <__tim> seems like gitlab spammers are back, but now it's response-spam so can't use the label

09:05 <bentiss> __tim: oh? can you share a link?

09:05 <__tim> mmh, I just deleted the comments, but user has been reported via gitlab mechanism

09:05 <__tim> I can forward an e-mail if you like

09:05 <bentiss> not sure I want :)

09:06 <bentiss> in the abuse list, there are a few already

09:08 <bentiss> actually that was only 3 users. If this gets worse we'd need to find a way to teach damspam to handle those

09:10 <bentiss> also, in case it was not said here, whot did a change in damspam in which it clears bio from new external users, meaning that this reduces greatly the anmount of spam acounts with just a link to a website

11:55 <DavidHeidelberg[m]> The nullnull is unexpected... (full message at <https://matrix.org/_matrix/media/v3/download/matrix.org/UMmiJCtOzniClehFrsCIrNro>)

11:56 <DavidHeidelberg[m]> just received this inside the email

13:14 <pkira> mupuf What do you think about switch to use ruff & poetry in CIBugLog?

13:16 <mupuf> never heard of ruff... looks interesting but aside from speed, what do you gain?

13:16 <mupuf> pkira: I mean, the flake8 jobs (in tox or CI) aren't slow at all

13:17 <mupuf> and I am concerned that we would need the rust toolchain to install it with pip (unless there is a wheel)

13:17 <mupuf> in any case... feel free to experiment. I'm not opposed to it

13:18 <pobrn> Hi! I have read https://gitlab.freedesktop.org/freedesktop/freedesktop/-/issues/540 and I'm wondering if my understanding is correct that there is no global whitelist one can simply apply to?

13:19 <mupuf> pkira: as for poetry, this could be nice if you wanted to push cibuglog as a pypi package. Any other benefit you can foresee aside from adding a non-standard dep?

13:20 <pkira> mupuf: As for ruff It's really easy to use rules from other linters, and rules are manageable from pyproject.toml. And it's really fast, especially to use with code editor

13:21 <mupuf> oh, integration with a code editor indeed sound appealing

13:21 <mupuf> well, how about that? Give both a try, and see how it fares

13:21 <mupuf> if you are happy with it, submit an MR and we'll review it there :)

13:22 <pkira> And as for poetry, I think the main gain is manageability of packages, you can split dev dependencies and you don't have to install them in Docker image. And it's so easy to update all packages

13:22 <pkira> Other think is you get reproducible env with lock file

13:22 <pkira> Sure ;)

13:23 <mupuf> how is the lockfile different from requirements.txt though?

13:24 <pkira> Oh, true, I guess there is no difference

13:25 <mupuf> on the one hand, you want to use the latest point version of a package... but then some projects decided that semantic versioning was a joke and could never work... so they break everything and don't care about it

13:26 <mupuf> and so... this leads to BS like the dependency-bot on github that just updates your requirements.txt periodically... automatically

13:31 <pkira> It sounds bad, at least everybody should respect backward combability of major versions

13:36 <mupuf> yeah, we got bit a couple of times by a major project

13:36 <mupuf> forgot which one

14:23 <daniels> pobrn: not a global list, no - which project do you want to work with?

14:27 <pobrn> daniels: well, it's mostly inconvenient when one wants to make the odd patch to "random" projects, requesting any level of access is quite a hassle in those cases, I'd argue; that's why I asked

14:38 <eric_engestrom> mupuf: the main difference between a lockfile like poetry's and requirements.txt is that the former is transitive, ie. it tracks the dependencies of your dependencies, not just the first level (which you could do manually in your requirements.txt if you want, but having had to do that at my previous job: it's absolutely unmaintainable to do this by hand)

14:41 <mupuf> I see

14:41 <mupuf> Indeed, pip freeze is a bit of a one-time operation

14:41 <eric_engestrom> (also, +1 to "annoyed at the state of python packaging", but they're aware and have been working on it, hopefully it'll get better at some point)

14:41 <mupuf> Maintaining that is a pain

14:41 <mupuf> Separating the primary vs transitive deps sound like a good idea