A proposal for Fedora updates

[Miroslav Suchý]

On 03/27/2015 01:49 PM, Kevin Fenzi wrote:
> * releng person gathers list of pending update requests from bodhi.
>   (a few minutes)
> 
> * releng person looks over list for anything out of the ordinary or
>   off. (another few minutes)
> 
> * releng person tells sigul to sign that list of packages and write out
>   the signed ones in koji. The releng person talks to the sigul bridge
>   and the sigul vault (which is not reachable via ssh) talks to the
>   bridge.

Few minutes, but manual minutes. IIRC rest of the process is automatic.
Do we really need human here? What can be extraordinary here? Even if I have that security incident years ago in my
mind, I could not figure out why we need human reviewing list of packages to sign.

-- 
Miroslav Suchy, RHCE, RHCDS
Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys