package ACL cleanup for packages that are retired on all branches currently doesn't happen

decathorpe commented

2026-02-18 15:06:51 +00:00

Description of request

It appears that the process / cron job / toddler / poddler which should handle cleaning up ACLs (i.e. removing all users / groups and assigning to "orphan") for packages that are "retired on all active branches" isn't running.

Example: https://src.fedoraproject.org/rpms/deepin-kwin

### Description of request It appears that the process / cron job / toddler / poddler which should handle cleaning up ACLs (i.e. removing all users / groups and assigning to "orphan") for packages that are "retired on all active branches" isn't running. Example: https://src.fedoraproject.org/rpms/deepin-kwin

james added the

labels

2026-02-18 20:03:36 +00:00

kevin commented

2026-02-18 20:10:22 +00:00

Owner

So...

The pod was in a weird state (because of reboots I think). So, I restarted it and fired off the cronjob...

2026-02-18 19:32:01,974 - [INFO toddlers.plugins.clean_retired_packages] Getting active branches from Bodhi
2026-02-18 19:32:01,993 - [INFO toddlers.plugins.clean_retired_packages] Retrieving list of packages retired in dist_git
2026-02-18 19:48:40,750 - [INFO toddlers.plugins.clean_retired_packages] 5 fully retired packages found in rpms
2026-02-18 19:48:40,750 - [INFO toddlers.plugins.clean_retired_packages] Processing packages
2026-02-18 19:48:40,750 - [INFO toddlers.plugins.clean_retired_packages]     llhttp9.1
2026-02-18 19:48:40,798 - [INFO toddlers.plugins.clean_retired_packages]     appstream0.16
2026-02-18 19:48:40,848 - [INFO toddlers.plugins.clean_retired_packages]     python38-ntlm-auth-repo
2026-02-18 19:48:40,946 - [INFO toddlers.plugins.clean_retired_packages]     python38-requests_ntlm-repo
2026-02-18 19:48:41,025 - [INFO toddlers.plugins.clean_retired_packages]     rust-glycin2

It didn't find that package, so I think something is wrong with it or the toddler that processes these.

I do see it in retired-packages...

@lenkaseg could you take a look?

So... The pod was in a weird state (because of reboots I think). So, I restarted it and fired off the cronjob... ``` 2026-02-18 19:32:01,974 - [INFO toddlers.plugins.clean_retired_packages] Getting active branches from Bodhi 2026-02-18 19:32:01,993 - [INFO toddlers.plugins.clean_retired_packages] Retrieving list of packages retired in dist_git 2026-02-18 19:48:40,750 - [INFO toddlers.plugins.clean_retired_packages] 5 fully retired packages found in rpms 2026-02-18 19:48:40,750 - [INFO toddlers.plugins.clean_retired_packages] Processing packages 2026-02-18 19:48:40,750 - [INFO toddlers.plugins.clean_retired_packages] llhttp9.1 2026-02-18 19:48:40,798 - [INFO toddlers.plugins.clean_retired_packages] appstream0.16 2026-02-18 19:48:40,848 - [INFO toddlers.plugins.clean_retired_packages] python38-ntlm-auth-repo 2026-02-18 19:48:40,946 - [INFO toddlers.plugins.clean_retired_packages] python38-requests_ntlm-repo 2026-02-18 19:48:41,025 - [INFO toddlers.plugins.clean_retired_packages] rust-glycin2 ``` It didn't find that package, so I think something is wrong with it or the toddler that processes these. I do see it in retired-packages... @lenkaseg could you take a look?

lenkaseg commented

2026-03-03 14:39:14 +00:00

Member

The cron job seems to be running as it should, once a month at 8AM:

2026-03-01 08:00:01,625 - [INFO fedora_messaging.twisted.consumer] Consuming message from topic org.fedoraproject.prod.toddlers.trigger.clean_retired_packages (message id e1423782-6be6-450a-8eb4-13fb7a2fe5b2)
2026-03-01 08:00:01,626 - [INFO toddlers.plugins.clean_retired_packages] Getting active branches from Bodhi
2026-03-01 08:00:01,648 - [INFO toddlers.plugins.clean_retired_packages] Retrieving list of packages retired in dist_git
2026-03-01 08:18:17,303 - [INFO toddlers.plugins.clean_retired_packages] 5 fully retired packages found in rpms
2026-03-01 08:18:17,303 - [INFO toddlers.plugins.clean_retired_packages] Processing packages
2026-03-01 08:18:17,303 - [INFO toddlers.plugins.clean_retired_packages]     llhttp9.1
2026-03-01 08:18:17,351 - [INFO toddlers.plugins.clean_retired_packages]     appstream0.16
2026-03-01 08:18:17,405 - [INFO toddlers.plugins.clean_retired_packages]     python38-ntlm-auth-repo
2026-03-01 08:18:17,454 - [INFO toddlers.plugins.clean_retired_packages]     python38-requests_ntlm-repo
2026-03-01 08:18:17,505 - [INFO toddlers.plugins.clean_retired_packages]     rust-glycin2
2026-03-01 08:18:17,556 - [INFO fedora_messaging.twisted.consumer] Successfully consumed message from topic org.fedoraproject.prod.toddlers.trigger.clean_retired_packages (message id e1423782-6be6-450a-8eb4-13fb7a2fe5b2)

I see the package is assigned to orphan in both Fedora and EPEL and has no maintainers.

@decathorpe Could you give me a hint what to look for on the src page? The members? I see 4 members currently there, should those be removed by the toddler? I'm not too familiar with this toddler.

The cron job seems to be running as it should, once a month at 8AM: ``` 2026-03-01 08:00:01,625 - [INFO fedora_messaging.twisted.consumer] Consuming message from topic org.fedoraproject.prod.toddlers.trigger.clean_retired_packages (message id e1423782-6be6-450a-8eb4-13fb7a2fe5b2) 2026-03-01 08:00:01,626 - [INFO toddlers.plugins.clean_retired_packages] Getting active branches from Bodhi 2026-03-01 08:00:01,648 - [INFO toddlers.plugins.clean_retired_packages] Retrieving list of packages retired in dist_git 2026-03-01 08:18:17,303 - [INFO toddlers.plugins.clean_retired_packages] 5 fully retired packages found in rpms 2026-03-01 08:18:17,303 - [INFO toddlers.plugins.clean_retired_packages] Processing packages 2026-03-01 08:18:17,303 - [INFO toddlers.plugins.clean_retired_packages] llhttp9.1 2026-03-01 08:18:17,351 - [INFO toddlers.plugins.clean_retired_packages] appstream0.16 2026-03-01 08:18:17,405 - [INFO toddlers.plugins.clean_retired_packages] python38-ntlm-auth-repo 2026-03-01 08:18:17,454 - [INFO toddlers.plugins.clean_retired_packages] python38-requests_ntlm-repo 2026-03-01 08:18:17,505 - [INFO toddlers.plugins.clean_retired_packages] rust-glycin2 2026-03-01 08:18:17,556 - [INFO fedora_messaging.twisted.consumer] Successfully consumed message from topic org.fedoraproject.prod.toddlers.trigger.clean_retired_packages (message id e1423782-6be6-450a-8eb4-13fb7a2fe5b2) ``` I see the package is assigned to `orphan` in both Fedora and EPEL and has no maintainers. @decathorpe Could you give me a hint what to look for on the src page? The members? I see 4 members currently there, should those be removed by the toddler? I'm not too familiar with this toddler.

decathorpe commented

2026-03-03 14:49:09 +00:00

Author

As far as I know, the three non-orphan maintainers should get removed. Or maybe I'm mis-remembering something here?

decathorpe commented

2026-03-03 14:56:35 +00:00

Author

I found another example where it might more clear: https://src.fedoraproject.org/rpms/rust-env_logger0.4

This package is retired in all current Fedora branches, and this has been the case since the Fedora 41 EOL, so at least more than a month ago. But the cleanup hasn't touched it yet at all.

I found another example where it might more clear: <https://src.fedoraproject.org/rpms/rust-env_logger0.4> This package is retired in all current Fedora branches, and this has been the case since the Fedora 41 EOL, so at least more than a month ago. But the cleanup hasn't touched it yet at all.

lenkaseg commented

2026-03-03 15:09:47 +00:00

Member

Comparing deepin-kwin package with processed rust-glycin2, I see:

For rust-glycin2:

{'access_groups': {'admin': [],
  'collaborator': [],
  'commit': [],
  'ticket': []},
 'access_users': {'admin': [],
  'collaborator': [],
  'commit': [],
  'owner': ['orphan'],
  'ticket': []},

For deepin-kwin:

{'access_groups': {'admin': [],
  'collaborator': [],
  'commit': ['deepinde-sig'],
  'ticket': []},
 'access_users': {'admin': ['cheeselee', 'felixonmars'],
  'collaborator': [],
  'commit': [],
  'owner': ['orphan'],
  'ticket': []},

So I suppose those fields commit and admin should be empty and they are not.

I'll go step by step to check where the problem is.

Comparing `deepin-kwin` package with processed `rust-glycin2`, I see: For rust-glycin2: ``` {'access_groups': {'admin': [], 'collaborator': [], 'commit': [], 'ticket': []}, 'access_users': {'admin': [], 'collaborator': [], 'commit': [], 'owner': ['orphan'], 'ticket': []}, ``` For deepin-kwin: ``` {'access_groups': {'admin': [], 'collaborator': [], 'commit': ['deepinde-sig'], 'ticket': []}, 'access_users': {'admin': ['cheeselee', 'felixonmars'], 'collaborator': [], 'commit': [], 'owner': ['orphan'], 'ticket': []}, ``` So I suppose those fields `commit` and `admin` should be empty and they are not. I'll go step by step to check where the problem is.

lenkaseg commented

2026-03-05 15:14:52 +00:00

Member

I think the problem of deepin-kwin package is, that it's retired only on rawhide. So the toddler did not identify it as fully retired back then (last branch there is for the package is f41). Now f41 is not even active, so the toddler will not pick it up even if it would be retired on all it's branches now. The same applies for rust-env_logger0.4 and it's likely there is more such packages.
The script of the toddler clean_retired_packages checks if the package is retired on all active branches.
The toddler never identifies deepin-kwin and rust-env_logger0.4 as fully retired.

What is the definition of fully retired package?

I think the problem of `deepin-kwin` package is, that it's retired only on `rawhide`. So the toddler did not identify it as fully retired back then (last branch there is for the package is f41). Now f41 is not even active, so the toddler will not pick it up even if it would be retired on all it's branches now. The same applies for `rust-env_logger0.4` and it's likely there is more such packages. The script of the toddler clean_retired_packages checks if the package is retired on all active branches. The toddler never identifies `deepin-kwin` and `rust-env_logger0.4` as fully retired. What is the definition of fully retired package?

decathorpe commented

2026-03-05 15:29:28 +00:00

Author

That sounds like a logic flaw in the checks to me then? :(

For example, deepin-kwin was retired in rawhide before the f42 branch point, so it doesn't even have f42, f43, or f44 branches, so it is, for all intents and purposes, retired on all active branches.

It is blocked from the f45, f44, f43, f42 tags in koji (and was never in EPEL, so the package isn't in any of the epel* tags), so maybe that would be an easier way to check? i.e. get list of koji tags corresponding to active releases, and check if package is blocked in all of them.

That sounds like a logic flaw in the checks to me then? :( For example, deepin-kwin was retired in rawhide before the f42 branch point, so it doesn't even *have* f42, f43, or f44 branches, so it *is*, for all intents and purposes, retired on all active branches. It *is* blocked from the f45, f44, f43, f42 tags in koji (and was never in EPEL, so the package isn't in any of the epel* tags), so maybe that would be an easier way to check? i.e. get list of koji tags corresponding to active releases, and check if package is blocked in all of them.

👍 1

lenkaseg commented

2026-03-05 15:31:37 +00:00

Member

I think in the end it's comparing two lists:
['rawhide'], which is the only active branch on which deepin-kwin is retired with
['f30',
'f31',
'f32',
'f33',
'f34',
'f35',
'f36',
'f37',
'f38',
'f39',
'f40',
'f41',
'main',
'rawhide']
which are all deepin-kwins branches. Since these two lists don't match, the package is never identified as fully retired and is not processed.

Now I'd need to know what's the best approach here.
Is being retired on rawhide and at the same time being orphaned qualifies the package for the ACL cleanup?

I think in the end it's comparing two lists: ['rawhide'], which is the only active branch on which `deepin-kwin` is retired with ['f30', 'f31', 'f32', 'f33', 'f34', 'f35', 'f36', 'f37', 'f38', 'f39', 'f40', 'f41', 'main', 'rawhide'] which are all `deepin-kwin`s branches. Since these two lists don't match, the package is never identified as fully retired and is not processed. Now I'd need to know what's the best approach here. Is being retired on rawhide and at the same time being orphaned qualifies the package for the ACL cleanup?

lenkaseg commented

2026-03-05 23:41:58 +00:00

Member

@decathorpe wrote in #13155 (comment):

It is blocked from the f45, f44, f43, f42 tags in koji (and was never in EPEL, so the package isn't in any of the epel* tags), so maybe that would be an easier way to check? i.e. get list of koji tags corresponding to active releases, and check if package is blocked in all of them.

Sounds good, will do!

@decathorpe wrote in https://forge.fedoraproject.org/infra/tickets/issues/13155#issuecomment-574137: > > It _is_ blocked from the f45, f44, f43, f42 tags in koji (and was never in EPEL, so the package isn't in any of the epel* tags), so maybe that would be an easier way to check? i.e. get list of koji tags corresponding to active releases, and check if package is blocked in all of them. Sounds good, will do!

❤️ 1

abompard was assigned by lenkaseg

2026-03-06 13:59:09 +00:00

abompard was unassigned by lenkaseg

2026-03-06 13:59:30 +00:00

abompard was assigned by lenkaseg

2026-03-06 13:59:37 +00:00

abompard was unassigned by lenkaseg

2026-03-06 13:59:48 +00:00

abompard was assigned by lenkaseg

2026-03-06 14:01:04 +00:00

abompard was unassigned by lenkaseg

2026-03-06 14:01:19 +00:00

lenkaseg commented

2026-03-06 14:04:12 +00:00

Member

Lol, interesting behavior of the forge here.
When I want to assign this issue to me - by clicking "Assign to me" in the assign section, it gets assigned to abompard (I suppose because he is the first on the list of allowed assignees and I'm not in that list).

I suppose I'd have to be added to the forge infra members group to be able to assign tickets to me here.

Lol, interesting behavior of the forge here. When I want to assign this issue to me - by clicking "Assign to me" in the assign section, it gets assigned to abompard (I suppose because he is the first on the list of allowed assignees and I'm not in that list). I suppose I'd have to be added to the forge infra members group to be able to assign tickets to me here.

kevin commented

2026-03-06 17:51:57 +00:00

Owner

I've added you.

❤️ 1

lenkaseg commented

2026-03-06 19:58:17 +00:00

Member

So, I made a script to identify all packages that are:

retired on any active branch
got all their branches from distgit
made an intersection between active releases and each retired's package branches
example:
active releases are ['eln', 'epel10.1', 'epel10.2', 'epel10', 'epel8', 'epel9', 'epel9-next', 'f42', 'f43', 'f44', 'rawhide']
deepin-kwin's branches are ['f30', 'f31', 'f32', 'f33', 'f34', 'f35', 'f36', 'f37', 'f38', 'f39', 'f40','f41','main','rawhide']
The intersection would be ['rawhide'].
got koji tag for each branch in the intersection
listed the package (koji.listPackages) for those koji tags
checked if on each tag the package is blocked
=> when package is blocked in koji to each of it's active branch, then it is considered fully retired and sent for cleanup.

Could someone check this logic please? Because it identified a WHOLE LOT of such packages, does not feel right. I checked some of them randomly, would all these qualify for cleanup?

Only a sample, there were hundreds:
ant-antlr3, antic, deepin-kwin, rust-env_logger0.4, deepin-metacity, deepin-network-utils, deepin-qt5dxcb-plugin, deepin-topbar, contour, ...

So, I made a script to identify all packages that are: - retired on any active branch - got all their branches from distgit - made an intersection between active releases and each retired's package branches example: active releases are ['eln', 'epel10.1', 'epel10.2', 'epel10', 'epel8', 'epel9', 'epel9-next', 'f42', 'f43', 'f44', 'rawhide'] deepin-kwin's branches are ['f30', 'f31', 'f32', 'f33', 'f34', 'f35', 'f36', 'f37', 'f38', 'f39', 'f40','f41','main','rawhide'] The intersection would be ['rawhide']. - got koji tag for each branch in the intersection - listed the package (koji.listPackages) for those koji tags - checked if on each tag the package is blocked => when package is blocked in koji to each of it's active branch, then it is considered fully retired and sent for cleanup. Could someone check this logic please? Because it identified a WHOLE LOT of such packages, does not feel right. I checked some of them randomly, would all these qualify for cleanup? Only a sample, there were hundreds: ant-antlr3, antic, deepin-kwin, rust-env_logger0.4, deepin-metacity, deepin-network-utils, deepin-qt5dxcb-plugin, deepin-topbar, contour, ...

lenkaseg commented

2026-03-06 20:27:33 +00:00

Member

More of the log: https://gist.github.com/LenkaSeg/8d944d56d31d6437141a25c046e7bb5a

abompard was assigned by lenkaseg

2026-03-06 23:47:00 +00:00

abompard was unassigned by lenkaseg

2026-03-06 23:47:48 +00:00

lenkaseg self-assigned this

2026-03-06 23:49:41 +00:00

lenkaseg referenced this issue from apps/toddlers

2026-03-09 14:10:10 +00:00

[on hold] clean_retired_packages: Define retired package by blocked in koji #394

lenkaseg commented

2026-03-09 14:11:32 +00:00

Member

I opened this pull request:
apps/toddlers#394

Does the logic of identifying a fully retired packages make sense? Not too sure here.

I opened this pull request: https://forge.fedoraproject.org/apps/toddlers/pulls/394 Does the logic of identifying a fully retired packages make sense? Not too sure here.

lenkaseg commented

2026-03-09 14:22:46 +00:00

Member

Here's the script I used to look for the fully retired packages: https://gist.github.com/LenkaSeg/aec473156b05b88d8b33ae7c09913837

Getting the koji tags of retired's package's branches that correspond with active releases and checking if the package is blocked on all of them.
(The script is a bit cumbersome I know, but actually handwritten without AI :) )

Here's the script I used to look for the fully retired packages: https://gist.github.com/LenkaSeg/aec473156b05b88d8b33ae7c09913837 Getting the koji tags of retired's package's branches that correspond with active releases and checking if the package is blocked on all of them. (The script is a bit cumbersome I know, but actually handwritten without AI :) )

kevin commented

2026-03-09 17:13:48 +00:00

Owner

I think the logic makes sense to me. I spot checked a few packages and they all do indeed seem retired for a while, etc.

I think before we roll this out we might ask more widely if anyone sees any problems with this list.

I think the logic makes sense to me. I spot checked a few packages and they all do indeed seem retired for a while, etc. I think before we roll this out we might ask more widely if anyone sees any problems with this list.

👍 1 ❤️ 1

lenkaseg commented

2026-03-09 19:19:34 +00:00

Member

In that case I'll optimize the script and run it once more to get the full list of packages.

lenkaseg commented

2026-03-11 11:11:52 +00:00

Member

Improved the script a bit, but it still crashed in mid-rawhide loop.
Anyways, it collected more packages that are fully retired according to this new logic: https://gist.githubusercontent.com/LenkaSeg/11f06ad02b1e2f2745d38c02fa2bae04/raw/68885355a00ddf45c4123284f47cf4ddc7def876/gistfile1.txt

Improved the script a bit, but it still crashed in mid-rawhide loop. Anyways, it collected more packages that are fully retired according to this new logic: https://gist.githubusercontent.com/LenkaSeg/11f06ad02b1e2f2745d38c02fa2bae04/raw/68885355a00ddf45c4123284f47cf4ddc7def876/gistfile1.txt

kevin commented

2026-03-11 18:42:31 +00:00

Owner

sheesh, that seems like a pretty long list indeed... but again checking some seems they are all really fully retired.

😆 1

lenkaseg commented

2026-04-21 07:34:09 +00:00

Member

Talking about this issue with @abompard and I will add a filter to the script, that the output would show only packages that were not processed yet (they are blocked on all branches, that are active and at the same time have at least one access_user that is not orphan - so that would mean the package it is not fully processed.) That should filter out all of the fully processed retired packages and give us a smaller list of only those that would need processing. I'd ignore the access_groups for now.

lenkaseg commented

2026-04-23 10:05:11 +00:00

Member

Improved the script to filter out the already processed packages: https://gist.github.com/LenkaSeg/b844ea74f0ef3f890c6cb27db5253f9e

Looking at the output, checked some packages and they seem to be fully retired and unprocessed.
Sample:

['jsoncpp-epel', 'rust-annotate-snippets0.10', 'rust-annotate-snippets0.6', 'rust-ansi_term0.11', 'rust-bytes0.4', 'rust-futures0.1', 'rust-krata-tokio-tar', 'rust-password-hash0.4', 'rust-pbkdf2_0.11', 'rust-quick-xml0.34', 'rust-rand0.4', 'rust-tokio-io', 'rust-yansi0.5', 'selinux-policy-epel', 'wolfssl', 'flintqs', 'golang-github-prometheus-node-exporter', 'gradio', 'infoblox-client', 'python39-zstd-epel', 'egl-wayland-epel', 'python3.12-ramalama', 'python-pyside2', 'rust-async-fs1', 'rust-atomic-polyfill0.1', 'rust-bindgen0.59', 'rust-bitstream-io1', 'rust-block-modes', 'rust-bstr0.2', 'rust-bytes0.5', 'rust-cache-padded', 'rust-calloop0.12', 'rust-cargo_metadata0.12', 'rust-cargo_metadata0.17', 'rust-console0.14', 'rust-const-oid0.6', 'rust-cookie_store0.16', 'rust-criterion', 'rust-criterion-plot', 'rust-crossbeam-deque0.7', 'rust-crossbeam-epoch0.8', 'rust-crossbeam-queue0.2', 'rust-crossbeam-utils0.7', 'rust-crossterm0.19', 'rust-crossterm0.22', 'rust-crypto-bigint0.2', 'rust-darling0.12', 'rust-darling0.14', 'rust-darling_core0.12', 'rust-darling_core0.14', 'rust-darling_macro0.12', 'rust-darling_macro0.14', 'rust-deflate0.8', 'rust-der0.4', 'rust-der_derive0.4', 'rust-derive_builder0.12', 'rust-derive_builder0.9', 'rust-derive_builder_core0.12', 'rust-derive_builder_core0.9', 'rust-derive_builder_macro0.12', 'rust-des0.7', 'rust-directories3', 'rust-directories4', 'rust-dirs2', 'rust-dirs3', 'rust-drain', 'rust-dtoa0.4', 'rust-encoding', 'rust-encoding-index-japanese', 'rust-encoding-index-korean', 'rust-encoding-index-simpchinese', 'rust-encoding-index-singlebyte', 'rust-encoding_index_tests', 'rust-encoding-index-tradchinese', 'rust-enum-iterator0.6', 'rust-enum-iterator-derive0.6', 'rust-env_logger0.5', 'rust-env_logger0.6', 'rust-event-listener4', 'rust-event-listener-strategy0.4', 'rust-expat-sys', 'rust-femme', 'rust-fixedbitset0.2', 'rust-futures-cpupool', 'rust-ghost', 'rust-gif0.11', 'rust-gif0.12', 'rust-git2_0.13', 'rust-git2_0.14', 'rust-git2_0.16', 'rust-git2_0.17', 'rust-globwalk0.8', 'rust-goblin0.6', 'rust-goblin0.7', 'rust-hashbrown0.11', 'rust-humansize1', 'rust-idna0.1', 'rust-idna0.2', 'rust-image0.23', 'rust-indicatif0.15', 'rust-itertools-num', 'rust-jpeg-decoder0.1', 'rust-jwalk0.6', 'rust-kv-log-macro', 'rust-libbpf-cargo0.21', 'rust-libgit2-sys0.12', 'rust-libgit2-sys0.13', 'rust-libgit2-sys0.14', 'rust-libgit2-sys0.15', 'rust-libssh2-sys0.2', 'rust-lscolors0.15', 'rust-markup5ever_rcdom', 'rust-maybe-uninit', 'rust-memmap', 'rust-memoffset0.5', 'rust-memoffset0.8', 'rust-miniz_oxide0.3', 'rust-miniz_oxide0.5', 'rust-miniz_oxide0.6', 'rust-mio0.6', 'rust-mio0.7', 'rust-mio-extras', 'rust-mio-uds', 'rust-net2', 'rust-nix0.20', 'rust-nom5', 'rust-normpath0.3', 'rust-nu-ansi-term0.49', 'rust-num-derive0.3', 'rust-oorandom', 'rust-opener0.5', 'rust-os_pipe0.9', 'rust-ouroboros0.17', 'rust-ouroboros_macro0.17', 'rust-partition-identity0.2', 'rust-password-hash0.3', 'rust-pbkdf2_0.10', 'rust-pbkdf2_0.9', 'rust-pem-rfc7468_0.2', 'rust-percent-encoding1', 'rust-petgraph0.5', 'rust-phf_codegen0.8', 'rust-pin-project-lite0.1', 'rust-pkcs1_0.2', 'rust-pkcs5_0.3', 'rust-pkcs8_0.7', 'rust-plotters-backend', 'rust-plotters-bitmap', 'rust-plotters', 'rust-plotters-svg', 'rust-png0.16', 'rust-powierza-coefficient', 'rust-pretty_assertions0.6', 'rust-pretty_assertions0.7', 'rust-pretty_env_logger0.4', 'rust-procfs0.9', 'rust-proc-macro2-0.4', 'rust-proc-mounts0.2', 'rust-proptest0.10', 'rust-proptest-derive0.3', 'rust-pulldown-cmark0.8', 'rust-pulldown-cmark0.9', 'rust-pyo3_0.21', 'rust-pyo3-build-config0.21', 'rust-pyo3-ffi0.21', 'rust-pyo3-macros0.21', 'rust-pyo3-macros-backend0.21', 'rust-quickcheck0.6', 'rust-quick-xml0.27', 'rust-quote0.6', 'rust-rand0.5', 'rust-rand0.6', 'rust-rand_chacha0.1', 'rust-rand_core0.3', 'rust-rand_core0.4', 'rust-rand_hc0.1', 'rust-rand_hc', 'rust-rand_isaac0.1', 'rust-rand_jitter0.1', 'rust-random-fast-rng', 'rust-randomize', 'rust-random-trait', 'rust-rand_os0.1', 'rust-rand_pcg0.1', 'rust-rand_xorshift0.1', 'rust-ratatui0.25', 'rust-regex-syntax0.7', 'rust-routinator-ui', 'rust-roxmltree0.18', 'rust-rustc-test', 'rust-rustc_version0.3', 'rust-rust-embed6', 'rust-rust-embed-impl6', 'rust-rust-embed-utils7', 'rust-salsa20_0.9', 'rust-scrypt0.8', 'rust-sd', 'rust-semver-parser0.9', 'rust-serde_buf', 'rust-serde_fmt', 'rust-serial_test0.6', 'rust-serial_test1', 'rust-serial_test_derive0.6', 'rust-serial_test_derive1', 'rust-servo-fontconfig', 'rust-servo-fontconfig-sys', 'rust-signature1', 'rust-signature_derive1', 'rust-skeptic', 'rust-snapbox0.4', 'rust-spin0.5', 'rust-spki0.4', 'rust-stability0.1', 'rust-standback', 'rust-structopt0.2', 'rust-structopt-derive0.2', 'rust-strum0.24', 'rust-sval_buffer', 'rust-sval_derive', 'rust-sval_derive_macros', 'rust-sval_dynamic', 'rust-sval_flatten', 'rust-sval_fmt', 'rust-sval', 'rust-sval_json', 'rust-sval_nested', 'rust-sval_ref', 'rust-sval_serde', 'rust-sval_test', 'rust-svgtypes', 'rust-symlink', 'rust-syn0.15', 'rust-sysinfo0.19', 'rust-term0.6', 'rust-test-case2', 'rust-test-case-macros2', 'rust-tiff0.6', 'rust-time0.2', 'rust-time-macros0.1', 'rust-time-macros-impl', 'rust-tinytemplate', 'rust-tokio0.1', 'rust-tokio0.2', 'rust-tokio-codec', 'rust-tokio-core', 'rust-tokio-current-thread', 'rust-tokio-executor', 'rust-tokio-fs', 'rust-tokio-macros0.2', 'rust-tokio-mock-task', 'rust-tokio-reactor', 'rust-tokio-sync', 'rust-tokio-tcp', 'rust-tokio-threadpool', 'rust-tokio-timer', 'rust-tokio-udp', 'rust-tokio-uds', 'rust-toml0.4', 'rust-toml_edit0.21', 'rust-treeline', 'rust-tree-sitter0.20', 'rust-trust-dns-proto', 'rust-trust-dns-resolver', 'rust-trycmd0.14', 'rust-ttf-parser0.12', 'rust-tui', 'rust-typed-arena1', 'rust-unescape', 'rust-unicode-xid0.1', 'rust-url1', 'rust-users', 'rust-value-bag', 'rust-value-bag-serde1', 'rust-value-bag-sval2', 'rust-vergen3', 'rust-vergen5', 'rust-version-sync0.8', 'rust-winnow0.4', 'rust-zstd0.12', 'rust-zstd-safe6', 'cnmatrix', 'dbus-parsec', 'gcc13', 'llvm-bolt', 'mbedtls3.6', 'parsec', 'parsec-tool', 'polly', 'pypy3.9', 'python-pep440', 'python-watchgod', 'rust-ashpd0.9', 'rust-aws-nitro-enclaves-cose0.4', 'rust-blosc2-rs', 'rust-blosc2-sys', 'rust-byte-unit3', 'rust-cairo-rs0.19', 'rust-cairo-sys-rs0.19', 'rust-clicolors-control', 'rust-console0.11', 'rust-console0.12', 'rust-console0.13', 'rust-console0.9', 'rust-deflate', 'rust-freetype-rs0.35', 'rust-gdk4_0.8', 'rust-gdk4-sys0.8', 'rust-gdk-pixbuf0.19', 'rust-gdk-pixbuf-sys0.19', 'rust-gio0.19', 'rust-gio-sys0.19', 'rust-glib0.19', 'rust-glib-macros0.19', 'rust-glib-sys0.19', 'rust-glycin-utils2', 'rust-gobject-sys0.19', 'rust-graphene-rs0.19', 'rust-graphene-sys0.19', 'rust-gsk4_0.8', 'rust-gsk4-sys0.8', 'rust-gtk4_0.8', 'rust-gtk4-macros0.8', 'rust-gtk4-sys0.8', 'rust-gufo-common0.1', 'rust-gufo-exif0.1', 'rust-gufo-jpeg0.1', 'rust-hidpipe', 'rust-isal-rs', 'rust-isal-sys', 'rust-libadwaita0.6', 'rust-libadwaita-sys0.6', 'rust-libcramjam0.6', 'rust-libcryptsetup-rs0.9', 'rust-nparse', 'rust-pango0.19', 'rust-pango-sys0.19', 'rust-parsec-client', 'rust-parsec-interface', 'rust-pem0.8', 'rust-prost0.10', 'rust-prost-build0.10', 'rust-prost-derive0.10', 'rust-prost-types0.10', 'rust-reis0.2', 'rust-smallstr', 'rust-sysinfo0.23', 'rust-tokio-tar', 'rust-unidecode', 'rust-xcb', 'python3-sphinxcontrib-doxylink', 'rust-gstreamer0.23', 'rust-gstreamer-audio0.23', 'rust-gstreamer-audio-sys0.23', 'rust-gstreamer-base0.23', 'rust-gstreamer-base-sys0.23', 'rust-gstreamer-pbutils0.23', 'rust-gstreamer-pbutils-sys0.23', 'rust-gstreamer-sys0.23', 'rust-gstreamer-video0.23', 'rust-gstreamer-video-sys0.23', 'abrt-java-connector', 'adapt', 'adwaita-blue-gtk-theme', 'adwaita-qt', 'anaconda-user-help', 'antic', 'antlr-maven-plugin', 'apmd', 'apostrophe', 'arb', 'ardour5', 'aron', 'astrometry-tycho2', 'atinject', 'autoconf268', 'avocado-vt', 'azure-nvme-utils', 'bacula-docs', 'baloo', 'beneath-a-steel-sky-cd', 'berry', 'bes', 'bird2', 'bismuth']

Full list coming soon.

Improved the script to filter out the already processed packages: https://gist.github.com/LenkaSeg/b844ea74f0ef3f890c6cb27db5253f9e Looking at the output, checked some packages and they seem to be fully retired and unprocessed. Sample: ``` ['jsoncpp-epel', 'rust-annotate-snippets0.10', 'rust-annotate-snippets0.6', 'rust-ansi_term0.11', 'rust-bytes0.4', 'rust-futures0.1', 'rust-krata-tokio-tar', 'rust-password-hash0.4', 'rust-pbkdf2_0.11', 'rust-quick-xml0.34', 'rust-rand0.4', 'rust-tokio-io', 'rust-yansi0.5', 'selinux-policy-epel', 'wolfssl', 'flintqs', 'golang-github-prometheus-node-exporter', 'gradio', 'infoblox-client', 'python39-zstd-epel', 'egl-wayland-epel', 'python3.12-ramalama', 'python-pyside2', 'rust-async-fs1', 'rust-atomic-polyfill0.1', 'rust-bindgen0.59', 'rust-bitstream-io1', 'rust-block-modes', 'rust-bstr0.2', 'rust-bytes0.5', 'rust-cache-padded', 'rust-calloop0.12', 'rust-cargo_metadata0.12', 'rust-cargo_metadata0.17', 'rust-console0.14', 'rust-const-oid0.6', 'rust-cookie_store0.16', 'rust-criterion', 'rust-criterion-plot', 'rust-crossbeam-deque0.7', 'rust-crossbeam-epoch0.8', 'rust-crossbeam-queue0.2', 'rust-crossbeam-utils0.7', 'rust-crossterm0.19', 'rust-crossterm0.22', 'rust-crypto-bigint0.2', 'rust-darling0.12', 'rust-darling0.14', 'rust-darling_core0.12', 'rust-darling_core0.14', 'rust-darling_macro0.12', 'rust-darling_macro0.14', 'rust-deflate0.8', 'rust-der0.4', 'rust-der_derive0.4', 'rust-derive_builder0.12', 'rust-derive_builder0.9', 'rust-derive_builder_core0.12', 'rust-derive_builder_core0.9', 'rust-derive_builder_macro0.12', 'rust-des0.7', 'rust-directories3', 'rust-directories4', 'rust-dirs2', 'rust-dirs3', 'rust-drain', 'rust-dtoa0.4', 'rust-encoding', 'rust-encoding-index-japanese', 'rust-encoding-index-korean', 'rust-encoding-index-simpchinese', 'rust-encoding-index-singlebyte', 'rust-encoding_index_tests', 'rust-encoding-index-tradchinese', 'rust-enum-iterator0.6', 'rust-enum-iterator-derive0.6', 'rust-env_logger0.5', 'rust-env_logger0.6', 'rust-event-listener4', 'rust-event-listener-strategy0.4', 'rust-expat-sys', 'rust-femme', 'rust-fixedbitset0.2', 'rust-futures-cpupool', 'rust-ghost', 'rust-gif0.11', 'rust-gif0.12', 'rust-git2_0.13', 'rust-git2_0.14', 'rust-git2_0.16', 'rust-git2_0.17', 'rust-globwalk0.8', 'rust-goblin0.6', 'rust-goblin0.7', 'rust-hashbrown0.11', 'rust-humansize1', 'rust-idna0.1', 'rust-idna0.2', 'rust-image0.23', 'rust-indicatif0.15', 'rust-itertools-num', 'rust-jpeg-decoder0.1', 'rust-jwalk0.6', 'rust-kv-log-macro', 'rust-libbpf-cargo0.21', 'rust-libgit2-sys0.12', 'rust-libgit2-sys0.13', 'rust-libgit2-sys0.14', 'rust-libgit2-sys0.15', 'rust-libssh2-sys0.2', 'rust-lscolors0.15', 'rust-markup5ever_rcdom', 'rust-maybe-uninit', 'rust-memmap', 'rust-memoffset0.5', 'rust-memoffset0.8', 'rust-miniz_oxide0.3', 'rust-miniz_oxide0.5', 'rust-miniz_oxide0.6', 'rust-mio0.6', 'rust-mio0.7', 'rust-mio-extras', 'rust-mio-uds', 'rust-net2', 'rust-nix0.20', 'rust-nom5', 'rust-normpath0.3', 'rust-nu-ansi-term0.49', 'rust-num-derive0.3', 'rust-oorandom', 'rust-opener0.5', 'rust-os_pipe0.9', 'rust-ouroboros0.17', 'rust-ouroboros_macro0.17', 'rust-partition-identity0.2', 'rust-password-hash0.3', 'rust-pbkdf2_0.10', 'rust-pbkdf2_0.9', 'rust-pem-rfc7468_0.2', 'rust-percent-encoding1', 'rust-petgraph0.5', 'rust-phf_codegen0.8', 'rust-pin-project-lite0.1', 'rust-pkcs1_0.2', 'rust-pkcs5_0.3', 'rust-pkcs8_0.7', 'rust-plotters-backend', 'rust-plotters-bitmap', 'rust-plotters', 'rust-plotters-svg', 'rust-png0.16', 'rust-powierza-coefficient', 'rust-pretty_assertions0.6', 'rust-pretty_assertions0.7', 'rust-pretty_env_logger0.4', 'rust-procfs0.9', 'rust-proc-macro2-0.4', 'rust-proc-mounts0.2', 'rust-proptest0.10', 'rust-proptest-derive0.3', 'rust-pulldown-cmark0.8', 'rust-pulldown-cmark0.9', 'rust-pyo3_0.21', 'rust-pyo3-build-config0.21', 'rust-pyo3-ffi0.21', 'rust-pyo3-macros0.21', 'rust-pyo3-macros-backend0.21', 'rust-quickcheck0.6', 'rust-quick-xml0.27', 'rust-quote0.6', 'rust-rand0.5', 'rust-rand0.6', 'rust-rand_chacha0.1', 'rust-rand_core0.3', 'rust-rand_core0.4', 'rust-rand_hc0.1', 'rust-rand_hc', 'rust-rand_isaac0.1', 'rust-rand_jitter0.1', 'rust-random-fast-rng', 'rust-randomize', 'rust-random-trait', 'rust-rand_os0.1', 'rust-rand_pcg0.1', 'rust-rand_xorshift0.1', 'rust-ratatui0.25', 'rust-regex-syntax0.7', 'rust-routinator-ui', 'rust-roxmltree0.18', 'rust-rustc-test', 'rust-rustc_version0.3', 'rust-rust-embed6', 'rust-rust-embed-impl6', 'rust-rust-embed-utils7', 'rust-salsa20_0.9', 'rust-scrypt0.8', 'rust-sd', 'rust-semver-parser0.9', 'rust-serde_buf', 'rust-serde_fmt', 'rust-serial_test0.6', 'rust-serial_test1', 'rust-serial_test_derive0.6', 'rust-serial_test_derive1', 'rust-servo-fontconfig', 'rust-servo-fontconfig-sys', 'rust-signature1', 'rust-signature_derive1', 'rust-skeptic', 'rust-snapbox0.4', 'rust-spin0.5', 'rust-spki0.4', 'rust-stability0.1', 'rust-standback', 'rust-structopt0.2', 'rust-structopt-derive0.2', 'rust-strum0.24', 'rust-sval_buffer', 'rust-sval_derive', 'rust-sval_derive_macros', 'rust-sval_dynamic', 'rust-sval_flatten', 'rust-sval_fmt', 'rust-sval', 'rust-sval_json', 'rust-sval_nested', 'rust-sval_ref', 'rust-sval_serde', 'rust-sval_test', 'rust-svgtypes', 'rust-symlink', 'rust-syn0.15', 'rust-sysinfo0.19', 'rust-term0.6', 'rust-test-case2', 'rust-test-case-macros2', 'rust-tiff0.6', 'rust-time0.2', 'rust-time-macros0.1', 'rust-time-macros-impl', 'rust-tinytemplate', 'rust-tokio0.1', 'rust-tokio0.2', 'rust-tokio-codec', 'rust-tokio-core', 'rust-tokio-current-thread', 'rust-tokio-executor', 'rust-tokio-fs', 'rust-tokio-macros0.2', 'rust-tokio-mock-task', 'rust-tokio-reactor', 'rust-tokio-sync', 'rust-tokio-tcp', 'rust-tokio-threadpool', 'rust-tokio-timer', 'rust-tokio-udp', 'rust-tokio-uds', 'rust-toml0.4', 'rust-toml_edit0.21', 'rust-treeline', 'rust-tree-sitter0.20', 'rust-trust-dns-proto', 'rust-trust-dns-resolver', 'rust-trycmd0.14', 'rust-ttf-parser0.12', 'rust-tui', 'rust-typed-arena1', 'rust-unescape', 'rust-unicode-xid0.1', 'rust-url1', 'rust-users', 'rust-value-bag', 'rust-value-bag-serde1', 'rust-value-bag-sval2', 'rust-vergen3', 'rust-vergen5', 'rust-version-sync0.8', 'rust-winnow0.4', 'rust-zstd0.12', 'rust-zstd-safe6', 'cnmatrix', 'dbus-parsec', 'gcc13', 'llvm-bolt', 'mbedtls3.6', 'parsec', 'parsec-tool', 'polly', 'pypy3.9', 'python-pep440', 'python-watchgod', 'rust-ashpd0.9', 'rust-aws-nitro-enclaves-cose0.4', 'rust-blosc2-rs', 'rust-blosc2-sys', 'rust-byte-unit3', 'rust-cairo-rs0.19', 'rust-cairo-sys-rs0.19', 'rust-clicolors-control', 'rust-console0.11', 'rust-console0.12', 'rust-console0.13', 'rust-console0.9', 'rust-deflate', 'rust-freetype-rs0.35', 'rust-gdk4_0.8', 'rust-gdk4-sys0.8', 'rust-gdk-pixbuf0.19', 'rust-gdk-pixbuf-sys0.19', 'rust-gio0.19', 'rust-gio-sys0.19', 'rust-glib0.19', 'rust-glib-macros0.19', 'rust-glib-sys0.19', 'rust-glycin-utils2', 'rust-gobject-sys0.19', 'rust-graphene-rs0.19', 'rust-graphene-sys0.19', 'rust-gsk4_0.8', 'rust-gsk4-sys0.8', 'rust-gtk4_0.8', 'rust-gtk4-macros0.8', 'rust-gtk4-sys0.8', 'rust-gufo-common0.1', 'rust-gufo-exif0.1', 'rust-gufo-jpeg0.1', 'rust-hidpipe', 'rust-isal-rs', 'rust-isal-sys', 'rust-libadwaita0.6', 'rust-libadwaita-sys0.6', 'rust-libcramjam0.6', 'rust-libcryptsetup-rs0.9', 'rust-nparse', 'rust-pango0.19', 'rust-pango-sys0.19', 'rust-parsec-client', 'rust-parsec-interface', 'rust-pem0.8', 'rust-prost0.10', 'rust-prost-build0.10', 'rust-prost-derive0.10', 'rust-prost-types0.10', 'rust-reis0.2', 'rust-smallstr', 'rust-sysinfo0.23', 'rust-tokio-tar', 'rust-unidecode', 'rust-xcb', 'python3-sphinxcontrib-doxylink', 'rust-gstreamer0.23', 'rust-gstreamer-audio0.23', 'rust-gstreamer-audio-sys0.23', 'rust-gstreamer-base0.23', 'rust-gstreamer-base-sys0.23', 'rust-gstreamer-pbutils0.23', 'rust-gstreamer-pbutils-sys0.23', 'rust-gstreamer-sys0.23', 'rust-gstreamer-video0.23', 'rust-gstreamer-video-sys0.23', 'abrt-java-connector', 'adapt', 'adwaita-blue-gtk-theme', 'adwaita-qt', 'anaconda-user-help', 'antic', 'antlr-maven-plugin', 'apmd', 'apostrophe', 'arb', 'ardour5', 'aron', 'astrometry-tycho2', 'atinject', 'autoconf268', 'avocado-vt', 'azure-nvme-utils', 'bacula-docs', 'baloo', 'beneath-a-steel-sky-cd', 'berry', 'bes', 'bird2', 'bismuth'] ``` Full list coming soon.

lenkaseg commented

2026-04-23 13:47:23 +00:00

Member

More complete log:
https://gist.githubusercontent.com/LenkaSeg/24f92264dcd6176bd9744a6fb74252b2/raw/990065a89c846b49d2a432c40d75dfadf3c8440a/gistfile1.txt

More complete log: https://gist.githubusercontent.com/LenkaSeg/24f92264dcd6176bd9744a6fb74252b2/raw/990065a89c846b49d2a432c40d75dfadf3c8440a/gistfile1.txt

kevin referenced this issue from releng/tickets

2026-06-18 22:29:14 +00:00

incomplete processing of orphaning / ACL reset for packages retired on all branches #13373

Rows
Columns

package ACL cleanup for packages that are retired on all branches currently doesn't happen #13155

Description of request