Am 04.04.24 um 19:23 schrieb Kevin Fenzi:
On Thu, Apr 04, 2024 at 01:26:14PM +0000, Arnie T via devel wrote:
Hi,
I just installed Fedora on 2 of my PCs a couple of weeks ago. One version of Fedora 39 release and one of Fedora 40 to see where things are going.
I learned about this XZ-hack from Ars Technica & The Economist.
I got to the Fedora Magazine article and wasn't really clear on that.
So I followed the discussion to this thread in this Development mailing list.
I read a lot of it but _still_ can't 100% figure out what the final solution is going to be.
There's no 'solution' really... there's a lot of discussion around what
we can improve at the distro level, what we can urge upstreams to do,
how we can help out more, etc.
I'm hopeful some things will come out of this as it's a chance for us to
look at our processes and improve them.
One approach that would be at least bring some light into "weak"
(non technical layer) components (albeit not sure how feasible it is),
could be:
- Checking the resources of a packaged project.
Resources in terms of man or firm power that backup the project
- Contribution activity of people
- General activity of the project
- Transparency of the workflow / tools
and that for all projects that the distribution includes.
Why? This would allow to plan internal review activities
(or processes) more effectively. They would be directed
to the "weak" components with higher priority (recurrent, actions).
Like the current process for checking the license (SPDX) of a project,
it could also collect such metrics right away.
--
Leon
--
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
