On Wed, Aug 20, 2014 at 8:11 AM, Nico Kadel-Garcia <nkadel@xxxxxxxxx> wrote: > On Tue, Aug 19, 2014 at 9:01 AM, Neal Becker <ndbecker2@xxxxxxxxx> wrote: >> Something like github for fedora, where I can view/dl arbitrary files? I'd like >> to be able to view a spec file for any given package, without d/l the whole >> package. > > CentOS is doing something like this at https://git.centos.org. > Unfortunately, it's nightmarishly bad for simple viewability of > specific RPM You see, they seem unwilling to believe in 'git tags'. > They believe that it's somehow smarter and more reliable to rely on > using a git log with the word "import" in it as an indicator of which > corresponding SRPM the repository is tied to, and using the revision > of that git log as the way to indicate the state of the git repo for > that SRPM build. > > I leave it to our faithful readers to ponder the number of ways this > is *completely* nuts. It's also already broken, with SRPM's being > built without a corresponding "git log" entry in the git repository > for at least one package. I also leave it to our faithful readers to > look over the festonery and contemplate the security implications of > not using signed git tags to ensure the provenance of the contents of > a local git clone of a remote repository with critical system > software. > > Please, please, please never do this with Fedora? Please? If and as we > use git repos, use tags? We've been using git repos for packages since 2010. We don't use tags. Mostly because that would require koji to write back to the SCM, which it doesn't do. It does log which sha1sum it built the SRPM/RPM from though, and that is immutable. josh -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
