OpenMandriva claims disgruntled admin trashed repos after community bust-up

SOFTWARE

Linux distro accuses former contributor of deleting years of work and pushing a package that could have broken installs

OpenMandriva has accused a former contributor of using his trusted admin access to trash repositories and push a package that could have broken desktop installations after a community dispute spilled over into the project's infrastructure.

The Linux distribution disclosed the incident in a forum post this week, describing what it called an attempted act of "distribution sabotage" allegedly involving Davide Beatrici, a developer known for his work on the Mumble instant messaging app.

According to OpenMandriva, Beatrici joined the project some time ago and later offered to migrate its repository infrastructure from GitHub to his privately operated OneDev instance, mirroring several dozen repositories in the process.

While some maintainers were uneasy about concentrating so much of the project's infrastructure in one person's hands, the proposal went ahead because, as the project put it, "he was such a well-known figure that we didn't expect anything bad."

OpenMandriva says trouble started after two other contributors joined alongside Beatrici. One allegedly engaged in repeated abusive behavior toward users and project members, much of it in private messages. The project says several contributors left before the maintainers finally stepped in, kicking the individual out of the OpenMandriva-Cooker Matrix chat. He wasn't banned from the project, but OpenMandriva says the decision "triggered a cascade of events."

Beatrici and another contributor then resigned. When OpenMandriva later decided there was little point continuing to mirror repositories to Beatrici's private infrastructure, it says it began severing those connections.

According to the project, that didn't go down well. "This infuriated Davide so much that, abusing of the administrative privileges he still had, he sabotaged the distribution today in the early morning hours," the statement says.

OpenMandriva alleges Beatrici deleted parts of its GitHub repositories containing years of development work. It also says he "decided to publish an empty package in the cooker repository, which obsoleted all gnome and cosmic packages, which could have damaged the systems of people using gnome or cosmic."

The Cooker repository is OpenMandriva's rolling development branch, not a stable release, so the damage appears to have been confined to bleeding-edge users rather than to everyone running the distro. Even so, having one disgruntled admin yank years of work and potentially break package updates isn't the sort of resilience test most projects volunteer for.

The project says it is restoring the deleted repositories and repairing the affected packages. It also says it carried out "a full system audit" and found that "aside from the removed packages, we found no other violations."

OpenMandriva adds that it considered legal action, saying the alleged sabotage "constituted a criminal offense," but ultimately decided against it.

According to tech publication The Lunduke Journal, Beatrici said that "this was by no means a sabotage. The objective was not to harm the distribution I cared for." He reportedly admitted deleting Cosmic and Gnome repositories and said he did this because someone was "messing with my work."

The Register has contacted OpenMandriva to ask whether any stable releases were affected, how many repositories were deleted or modified, and what changes the project plans to make to administrative access. We also reached out to Beatrici but have not heard back. 

Every project needs contributors, but they don't all need the kind of access that can turn a disagreement into a recovery exercise. ®