On Friday 24 October 2003 20:43, Warren Togami uttered: > fedora.us currently doesn't build packages until they are fully approved > by the QA people, then our package goes into a "pending" repository for > easy installation and binary verification. After that point the QA people > can give the final "VERIFIED" message and the package is published. Ok, thats doable. > Some of us have wanted to make a "submission" repository containing > packages that have not yet been checked by QA, but the big concern there > is security of the sources and trust. 90% of the current fedora.us team > refuses to install anything unless they check the SRPM over manually > first. This really slowed things down, but I believe it should work for > Legacy since much fewer packages need QA, and they can all be verified by > reading diffs from the previous version. Well, I had kinda hoped for something like this. I would want to QA not only on the srpm, but on what would come out of the buildsystem and published, in case there was something funky in the buildsystem. A rawhide like repot for Legacy seems in order, where we can build it on the build system, drop it into a rawhide like place for even more QA (with SRPMS avail), then if all is cool build it one more time with gpg sigs(is another whole build necessary?) and push it into our actual repository. Speaking of repository, do you think there would be too much backlash if we only yumified the repot, and not aptified it? -- Jesse Keating RHCE MCSE (http://geek.j2solutions.net) Fedora Legacy Team (http://www.fedora.us/wiki/FedoraLegacy) Mondo DevTeam (www.mondorescue.org) GPG Public Key (http://geek.j2solutions.net/jkeating.j2solutions.pub) Was I helpful? Let others know: http://svcs.affero.net/rm.php?r=jkeating
Attachment:
pgp00077.pgp
Description: signature
