On Fri, Sep 11, 2020 at 10:54 AM Tomasz Torcz <tomek@xxxxxxxxxxxxxx> wrote:
>
> On Fri, Sep 11, 2020 at 10:16:02AM +0200, Mikolaj Izdebski wrote:
> > You get a side tag in Koji where you can have private build-only
> > dependencies that are discarded (filtered) once they are no longer
> > needed, after module build is done. For build-only packages most of
> > security vulnerabilities are not exploitable easily, or at all,
> > therefore are low-severity, which greatly limits maintenance work
> > required to address them. For example, if upstream tests are ran on an
> > obsolete, 12-years old version of Tomcat, I don't need to skip tests,
> > but I can package old Tomcat and run the tests.
>
> Whoha! Let's step back for a minute and look at this example.
> What are the reasons to run tests? To make sure the package will run
> correctly..
To prevent RPM build from succeeding in case bugs are found and
forcing the maintainer to investigate the issue (fix the bug, disable
broken test etc.)
> Why run tests on 12-years old version instead of on current one?
> Probably because tests fail on current version?
Because at the time tests were developed that was the most recent
Tomcat version. Since then upstream did not update the perfectly
working test suite ("If it ain't broke, don't fix it"). They will not
even accept our contribution to update the test suite.
> Will the end user run the package on obsolete Tomcat or on the current one?
Neither. The package is a HTTP client and tests merely need the server
side (Tomcat).
> Of course on the current one. The one on which tests fail.
> Tests in this case are worthless, they are not testing the real
> situation. Disabling tests is no worse than testing on obsolete version.
> Relying on such tests is a disservice for the end user.
>
> The point of testing is to validate code in real situation.
> Crafting special, unrealistic environment (12 years old Tomcat) just to have
> test pass is missing the point of tests.
>
> --
> Tomasz Torcz There exists no separation between gods and men:
> tomek@xxxxxxxxxxxxxx one blends softly casual into the other. — Frank Herbert
> _______________________________________________
> devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
> To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
