Re: Three steps we could take to make supply chain attacks a bit harder

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, 2024-03-30 at 12:53 +0100, Kevin Kofler via devel wrote:
> I think the issue is that there is just too much stuff in critpath these 
> days. Whole desktop environments and all their transitive dependencies 
> probably ought to not be in there. If at all, I would put the display 
> manager in there, maybe the window manager, and no further.

I wrote a mail about this a while ago. The problem is really that the
"critical path" concept has changed somewhat over time, and gotten a
bit overloaded.

The original idea of critical path was to require special testing
attention for it. Back in Ye Earlie Days, critpath packages had all
kinds of special rules around them, including requiring +2 or +3 (it's
a long time ago, I forget) from "proven testers" (remember those?)

*Most* of that has now gone. The only significant of critpath for
manual testing in the current update policy is that critpath packages
have a longer minimum wait in updates-testing (14 days vs. 7 days, at
least after a certain point in the release cycle). They do not have
higher karma requirements (at least, not by policy; Bodhi doesn't
actually implement the policy correctly ATM, but I'm fixing that). The
karma minima defined in the updates policy are currently identical at
all points in the cycle for critpath and non-critpath updates. The
"proven testers" concept was put on ice long ago.

The primary 'meaning' of critpath these days is that it triggers openQA
testing, and critpath updates are gated on openQA testing. I set things
up this way really just because it was convenient, and as is the way of
things, now it's kinda baked in.

We probably want to look at separating out the concepts a bit. It's
certainly technically possible, it just requires some work. The
'releng.py' script that "generates the critical path" is really just a
comps-informed depsolver that spits out JSON. It could generate all
kinds of groups besides "critical path" groups. We'd just have to wire
them up to *mean*...whatever we want them to mean.
-- 
Adam Williamson (he/him/his)
Fedora QA
Fedora Chat: @adamwill:fedora.im | Mastodon: @adamw@xxxxxxxxxxxxx
https://www.happyassassin.net



--
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux