RPM submission procedure

[Alan Cox]

On Wed, Jan 07, 2004 at 06:11:21PM -0500, Eric S. Raymond wrote:
> As for the DECSS problem, everybody understands it and we already
> have a workaround via the existence of livna.org.  
> 
> I suggest that Fedora make the following offer to this group: Fedora
> will put these repositories in the distributed apt.sources and

I think you mean yum not apt ?

> (2) RPMs must meet Fedora QA standards.  Repository maintainers must
>     expect their submission, test and build procedures to be audited, 
>     and will be dropped from the list of authoritative repositories if 
>     they fail to meet standards.
> 
> I doubt you'd get any pushback on these requirements.  And the cost of 
> QA-monitoring these repositories would undoubtedly be lower than the
> cost of building and maintaining one big repository of your own.  You'd
> win fairly big on the download costs alone.

You assume that centralisation is good. From day one it was apparent that
people would keep repositories however they felt like keeping them. Once
things around Extras/Addons finally get saner I am sure there will be
packages that migrate into that, and likewise I am sure there will be packages
that move the other way.

Another thing to bear in mind is that quite a few of the repositories people
run that are not so well known would fall flat if they were in the 
default yum configuration, just as some of the mirrors would if they were
in the default configuration for the base packages and updates.

IMHO we are by far the better for having multiple repositories which maybe
co-operate but don't share policy or agree on things entirely. It'll sort
itself out over time as to which methods work best and what users like
to do.

There are however some things that would definitely benefit the world whichever
way we go. The most obvious one is a program and a description format for
describing a repository and adding/removing it from /etc/yum.conf. The
reason for that being to make it a mozilla helper so when you go to
freshrpms or wherever you can simply click "Subscribe" and get a local
dialog/tool doing the yum.conf updating, checking an GPG signature and if
appropriate importing their GPG key.

Point and click subscribe solves a lot of the problems about finding stuff
especially if someone decides to keep an index of repositories.

Alan