Rings and building in copr (non-koji)

[Honza Horak]

Hi,

this is related to today's meeting discussion [1] about rings and 
utilizing koji and copr as well.. I got quite important comment from 
Dennis (CC'd):

"If its going to be part of fedora in any shape or form officially it 
has to be built in koji ... it allows releng to control shipping, 
signing and delivery, it allows updates to go through bodhi ... it gives 
a central place for people to look at fedora builds"

I think these are valid points but to me it still seems like we may 
still work with that. It would just mean non-koji-Rings wouldn't be 
considered "official fedora", which seems similar to less-strict rules 
and thus lesser quality expectations.

Or is it a bigger issue?

[1] 
http://meetbot.fedoraproject.org/fedora-meeting/2015-01-14/env-and-stacks...

Honza

[John Dulaney]

>  Date: Wed, 14 Jan 2015 16:12:12 +0100
>  From: hhorak(a)redhat.com
>  To: env-and-stacks(a)lists.fedoraproject.org
>  Subject: Rings and building in copr (non-koji)
>  CC: dennis(a)ausil.us
>
>  Hi,
>
>  this is related to today's meeting discussion [1] about rings and
>  utilizing koji and copr as well.. I got quite important comment from
>  Dennis (CC'd):
>
>  "If its going to be part of fedora in any shape or form officially it
>  has to be built in koji ... it allows releng to control shipping,
>  signing and delivery, it allows updates to go through bodhi ... it gives
>  a central place for people to look at fedora builds"
>
>  I think these are valid points but to me it still seems like we may
>  still work with that. It would just mean non-koji-Rings wouldn't be
>  considered "official fedora", which seems similar to less-strict rules
>  and thus lesser quality expectations.
>
>  Or is it a bigger issue?
>
>  [1]
>
> http://meetbot.fedoraproject.org/fedora-meeting/2015-01-14/env-and-stacks...
>
>  Honza 
I agree, anything that is going to be part of Fedora should be built in
Koji; anything else is not official and accordingly should have expectations
set that it is not going to be signed or may not have gone through the QA
process.

Conversely, QA should not be expected to test anything that is built outside
of Koji.

John.

[Nick Coghlan]

On 15 January 2015 at 01:40, John Dulaney <jdulaney(a)fedoraproject.org&gt; wrote:
>  I agree, anything that is going to be part of Fedora should be built
> in
>  Koji; anything else is not official and accordingly should have expectations
>  set that it is not going to be signed or may not have gone through the QA
>  process.
>
>  Conversely, QA should not be expected to test anything that is built outside
>  of Koji. 
+1 from me for this being the dividing line - anything built outside
of Koji just has the basic checks for license compatibility and an
apparent lack of malicious content.

Regards,
Nick.

-- 
Nick Coghlan   |   ncoghlan(a)gmail.com   |   Brisbane, Australia

[Matthew Miller]

On Wed, Jan 14, 2015 at 04:12:12PM +0100, Honza Horak wrote:
>  "If its going to be part of fedora in any shape or form
> officially
>  it has to be built in koji ... it allows releng to control shipping,
>  signing and delivery, it allows updates to go through bodhi ... it
>  gives a central place for people to look at fedora builds" 
This kind of comes to a semantic distinction about what exactly
"Fedora" means and includes. We use the term to refer to both the
project as a whole, and the distribution that is our major output.
In cases like this, though, we should be more clear. Copr is _already_
part of the Fedora Project officially, in a very real shape and form.
However, packages built in Copr aren't part of the Fedora OS
distribution — at least not as we have now.

I also would like to step a bit back from making our rules tied to a
specific piece of named technology — that is, rather than saying "in
order to be officially in the distro, it needs to go through koji", say
"needs an open, trackable workflow which has qualities x, y, and z".

>  I think these are valid points but to me it still seems like we may
>  still work with that. It would just mean non-koji-Rings wouldn't be
>  considered "official fedora", which seems similar to less-strict
>  rules and thus lesser quality expectations. 
I think we can also draw finer distinctions here — some things in "ring
3" can be "recommended by Fedora" or "reviewed by Fedora", while
others
can be missing that sticker.


-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader

[Nick Coghlan]

On 23 January 2015 at 00:30, Matthew Miller <mattdm(a)fedoraproject.org&gt; wrote:
>  I think we can also draw finer distinctions here — some things in
> "ring
>  3" can be "recommended by Fedora" or "reviewed by Fedora", while
> others
>  can be missing that sticker. 
I like the idea of having "recommended", "reviewed",
"redistributed"
as further tiers within Ring 3. The "redistributed" level would
capture the requirement for something to be built in COPR: it has to
be legal for Fedora as a *project* to redistribute it. The further
tiers (reviewed, recommended, Ring 2, Ring 1, Ring 0) would then
reflect various additional criteria that can be applied to the
package, with accordingly increased levels of scrutiny.

FHS compliance, for example, might be required for a package to be
considered "recommended".

Cheers,
Nick.

-- 
Nick Coghlan   |   ncoghlan(a)gmail.com   |   Brisbane, Australia