Code review strategies

[Jeff Bailey]

Le jeudi 26 mai 2005 à 20:34 +0100, Colin Watson a écrit :

> We've never had much in the way of code review in Ubuntu. In freeze
> periods, sometimes mdz or jdub or I will review patches before approving
> packages for upload, which is very human-intensive; new packages get a
> security and supportability review before being added to main; and of
> course we occasionally look over each other's code when working on a
> variety of patches. However, it's difficult to get a feel for the
> quality and consistency of people's work, or to keep up well enough to
> suggest improvements on a routine basis, or to pick up skills and
> knowledge from other people by watching their commits go past, which is
> something I've found very valuable at previous workplaces.
> 
> (Ultimately, we may be able to improve this by harvesting commits from
> HCT archives, filtering them, and mailing them somewhere. That's still
> some way off, though; even when we have it it'll take a while before all
> changes will be available this way; and it depends on people publishing
> their archives to a central location.)


Adam and I are working on the FormalTestPlans spec - this sounds like
something that might fit nicely under the futures section there.  At my
previous place of employement (financial industry), one of the big
pushes was to move towards double custody on code changes to help keep
security up.  I can't imagine doing that right across the board, but I
could see it making sense to move in that direction for at least
packages depended on by ubuntu-minimal.

If it did extend out into the rest of the distro, it would probably help
reduce risk and also provide a way for new people to get involved as
code reviewers.

Tks,
Jeff Bailey

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.ubuntu.com/archives/ubuntu-devel/attachments/20050530/a487971f/attachment.htm