Fedora Workstation and Third-Party Repositories

[David Benoit]

Hi all,

Regarding the inclusion of the fedora-workstation-repositories package in
F28, is there currently a policy in place against including it as a
dependency? From what I understand from the recent fedora magazine article
<https://fedoramagazine.org/third-party-repositories-fedora/> and the policy
wiki page
<https://fedoraproject.org/wiki/Workstation/Third_party_software_policies?...;,
the purpose of distributing the third-party repositories an rpm is to
ensure that a user must enable them explicitly.


Is there some some preventative measure in place to protect users from the
package being pulled in silently as a dependency? If repository-enabling
rpms are to become acceptable cases for package submissions, what
considerations are being taken to ensure such submissions are tracked and
handled similarly?


Apologies if this has been addressed before, but I haven't been able to
find any documentation on the subject.


Thanks,

DB

[Kevin Fenzi]

On 04/27/2018 02:56 PM, David Benoit wrote:
>  Hi all,
>  
>  Regarding the inclusion of the fedora-workstation-repositories package in
>  F28, is there currently a policy in place against including it as a
>  dependency? From what I understand from the recent fedora magazine article
>  <https://fedoramagazine.org/third-party-repositories-fedora/> and the policy
>  wiki page
>
> <https://fedoraproject.org/wiki/Workstation/Third_party_software_policies?...;,
>  the purpose of distributing the third-party repositories an rpm is to
>  ensure that a user must enable them explicitly.
>  
>  
>  Is there some some preventative measure in place to protect users from the
>  package being pulled in silently as a dependency?  
I don't understand why someone would add such a dep... but even if they
did, the repos would not be enabled when installed. They are disabled in
the rpm. The user must explicitly enable them.

>  If repository-enabling
>  rpms are to become acceptable cases for package submissions, what
>  considerations are being taken to ensure such submissions are tracked and
>  handled similarly? 
Well, depending on what they are they would need to pass Legal and FESCo
approval which would be via ticketing, etc.

Open to better ways to word that policy page for them...

kevin

[David Benoit]

Ah, I did not realize the repositories were disabled in the rpm.  Would it
be appropriate for me to update this
<https://fedoraproject.org/wiki/Workstation/Third_Party_Software_Repositor...
 page to mention that under the command line installation section?

Additionally, might it be worth adding a provision to the policy that new
repositories must be disabled?  Perhaps it is redundant since the request
goes through Legal and FESCo anyway, but it could be helpful to users and
packagers reading the policy.

Anyway, thanks very much!  I appreciate the clarification.  My initial
concern is completely put to rest.
DB


On Fri, Apr 27, 2018 at 7:38 PM, Kevin Fenzi <kevin(a)scrye.com&gt; wrote:

>  On 04/27/2018 02:56 PM, David Benoit wrote:
>  > Hi all,
>  >
>  > Regarding the inclusion of the fedora-workstation-repositories package
>  in
>  > F28, is there currently a policy in place against including it as a
>  > dependency? From what I understand from the recent fedora magazine
>  article
>  > <https://fedoramagazine.org/third-party-repositories-fedora/> and the
>  policy
>  > wiki page
>  > <https://fedoraproject.org/wiki/Workstation/Third_party_
>  software_policies?rd=Workstation/Third_party_software_proposal>,
>  > the purpose of distributing the third-party repositories an rpm is to
>  > ensure that a user must enable them explicitly.
>  >
>  >
>  > Is there some some preventative measure in place to protect users from
>  the
>  > package being pulled in silently as a dependency?
>
>  I don't understand why someone would add such a dep... but even if they
>  did, the repos would not be enabled when installed. They are disabled in
>  the rpm. The user must explicitly enable them.
>
>  > If repository-enabling
>  > rpms are to become acceptable cases for package submissions, what
>  > considerations are being taken to ensure such submissions are tracked and
>  > handled similarly?
>
>  Well, depending on what they are they would need to pass Legal and FESCo
>  approval which would be via ticketing, etc.
>
>  Open to better ways to word that policy page for them...
>
>  kevin
>
>
>
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>
>  

-- 

DAVID BENOIT

INTERN, multi-arch qe

Red Hat

<https://www.redhat.com/>
<https://red.ht/sig>

[Thomas Gilliard]

I found that

https://fedoraproject.org/wiki/Workstation/Third_Party_Software_Repositories

works in f28 KDE DE also:

'dnf install fedora-workstation-repositories' installs the extra third 
party repositories on the command line and makes the .repo files 
available in /etc/yum.repos.d/.

Chrome browser is installed

satellit
On 04/27/2018 05:39 PM, David Benoit wrote:
>  Ah, I did not realize the repositories were disabled in the rpm.
> Would 
>  it be appropriate for me to update this 
>  <https://fedoraproject.org/wiki/Workstation/Third_Party_Software_Repositor...
>
>  to mention that under the command line installation section?
>
>  Additionally, might it be worth adding a provision to the policy that 
>  new repositories must be disabled?  Perhaps it is redundant since the 
>  request goes through Legal and FESCo anyway, but it could be helpful 
>  to users and packagers reading the policy.
>
>  Anyway, thanks very much!  I appreciate the clarification. My initial 
>  concern is completely put to rest.
>  DB
>
>
>  On Fri, Apr 27, 2018 at 7:38 PM, Kevin Fenzi <kevin(a)scrye.com 
>  <mailto:[e-mail]>> wrote:
>
>      On 04/27/2018 02:56 PM, David Benoit wrote:
>      > Hi all,
>      >
>      > Regarding the inclusion of the fedora-workstation-repositories
>      package in
>      > F28, is there currently a policy in place against including it as a
>      > dependency? From what I understand from the recent fedora
>      magazine article
>      > <https://fedoramagazine.org/third-party-repositories-fedora/
>      <https://fedoramagazine.org/third-party-repositories-fedora/>> and
>      the policy
>      > wiki page
>      >
>     
> <https://fedoraproject.org/wiki/Workstation/Third_party_software_policies?...
>     
> <https://fedoraproject.org/wiki/Workstation/Third_party_software_policies?...;,
>      > the purpose of distributing the third-party repositories an rpm is to
>      > ensure that a user must enable them explicitly.
>      >
>      >
>      > Is there some some preventative measure in place to protect
>      users from the
>      > package being pulled in silently as a dependency?
>
>      I don't understand why someone would add such a dep... but even if
>      they
>      did, the repos would not be enabled when installed. They are
>      disabled in
>      the rpm. The user must explicitly enable them.
>
>      > If repository-enabling
>      > rpms are to become acceptable cases for package submissions, what
>      > considerations are being taken to ensure such submissions are
>      tracked and
>      > handled similarly?
>
>      Well, depending on what they are they would need to pass Legal and
>      FESCo
>      approval which would be via ticketing, etc.
>
>      Open to better ways to word that policy page for them...
>
>      kevin
>
>
>
>      _______________________________________________
>      devel mailing list -- devel(a)lists.fedoraproject.org
>      <mailto:[e-mail]>
>      To unsubscribe send an email to
>      devel-leave(a)lists.fedoraproject.org
>      <mailto:[e-mail]>
>
>
>
>
>  -- 
>
>  DAVID BENOIT
>
>  INTERN, multi-arch qe
>
>  Red Hat
>
>  <https://www.redhat.com/>
>
>  <https://red.ht/sig>
>
>
>
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org

[Kevin Fenzi]

On 04/27/2018 05:39 PM, David Benoit wrote:
>  Ah, I did not realize the repositories were disabled in the rpm. 
> Would it
>  be appropriate for me to update this
>  <https://fedoraproject.org/wiki/Workstation/Third_Party_Software_Repositor...
>   page to mention that under the command line installation section? 
Sure.

>  Additionally, might it be worth adding a provision to the policy that
> new
>  repositories must be disabled?  Perhaps it is redundant since the request
>  goes through Legal and FESCo anyway, but it could be helpful to users and
>  packagers reading the policy. 
They should be as all 3rd party repos are required to be opt in.
If you want to add a clarification, that would be great.

kevin

[Todd Zullinger]

Kevin Fenzi wrote:
>  On 04/27/2018 05:39 PM, David Benoit wrote:
> > Ah, I did not realize the repositories were disabled in the rpm.  Would it
> > be appropriate for me to update this
> > <https://fedoraproject.org/wiki/Workstation/Third_Party_Software_Repositor...
> >  page to mention that under the command line installation section?
>  
>  Sure. 
I happened to edit the page a little earlier, after seeing
some questions from users in IRC about it.  I didn't
remember you'd asked this question David.  Hopefully the
edits I made look alright.

-- 
Todd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Man is a rational animal who always loses his temper when he is called
upon to act in accordance with the dictates of reason.
    -- Oscar Wilde