On Fri, Apr 17, 2020 at 10:06:02PM +0200, Thorsten Leemhuis wrote: > Hi Don! > > Am 17.04.20 um 20:55 schrieb Don Zickus: > > > > I know as Jeremy and Justin have rolled out changes recently there have been > > > concerns over technical and non-technical issues. While they are happy to > > > make various tweaks to the workflow that might have broken during the > > > conversion, I am asking for some of the bigger concerns, folks reach out to > > > me. > > FWIW from the perspective of someone that deals with kernel.spec in his > spare time occasionally I think the conversation worked mostly well. Thx > for that. A bit of fine tuning might be needed here and there, but well, > that's often the case in situations like this :-D > > > I am sure there are pieces we overlooked in our attempt to change the > > workflow and over the next few months we will try to address what makes > > sense. I just ask folks to redirect their concerns to me and work with us > > to get them resolved. > > > > The two concerns I am aware that need addressing are: > > * broken out patches > > Which is already in the works (thx again Jeremy!) > > > * handle drive-by users who know dist-git by not the source git tree > > A few additional comments in the spec file and the readme that Jeremy > proposed will take care of most of it afaics. And one more thing, see > next part of this reply. > > > Is there any other large concern with the new workflow? > > The more I think about this the more I dislike that we are not using > official, pristine tarballs anymore. This "Source0 is a tarball > generated from a git tree maintained outside of the Fedora infra and > patched with buildscripts" IMHO violates the intention of the SourceURL > part of the Fedora Packaging Guidelines that was put in place for good > reasons (by both red hat and community contributors): > https://docs.fedoraproject.org/en-US/packaging-guidelines/SourceURL/ > It sounds like maybe there's confusion about what the new tarball contains. The tarballs that are generated and checked into dist-git contain no Fedora modifications and are directly from a commit or tag Linus's git tree generated with git-archive[0]. The only thing that changed is before we took the latest tagged release, then applied an rc patch from upstream if available, then the snapshot from that week's development as a patch generated on the maintainer's machine, then applied Fedora-specific patches. Now we just git-archive Linus's master branch for the day. We can download the tarball (created by git-archive on a signed tag) from kernel.org instead of running git-archive on a signed tag ourselves if that will really help people sleep at night, but we'll still be slapping unsigned snapshots on top of that so it's not clear to me that we'll be gaining much. [0] https://gitlab.com/cki-project/kernel-ark/-/blob/internal/redhat/scripts/create-tarball.sh - Jeremy _______________________________________________ kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx
