A proposal for Fedora updates

[Corey Sheldon]

Sanity of the key vault as i understand it  as its air-gapped  (the no ssh
part)


Corey W Sheldon
Freelance IT Consultant, Multi-Discipline Tutor
(p) 310.909.7672
G+: <https://www.plus.google.com/+CoreySheldon>
LinkedIn: <https://www.linkedin.com/profile/view?id=70127804>
Github: <https://www.github.com/linux-modder>
Facebook: <https://www.facebook.com/corey.sheldon>
Several Communities on Stack Exchange <https://www.stackexchange.com>

<http://www.facebook.com/1stclassmobileshine>

Tutoring in person or via any of the following platforms:
HackHands <https://www.hackhands.com>
Wizpert <https://www.wizperts.com>
FieldNation <https://www.fieldnation.com>
AirPair <https://www.airpair.com>
Truelancer <http://www.truelancer.com>

{PayPal,Google Wallet/Play store, Apple Pay}
---------------------------------------------------------------------------------------------------
pub  3072D/718BF597
<http://pgp.mit.edu/pks/lookup?op=get&search=0xE958C5D6718BF597> 2014-12-08
      Key fingerprint = 2930 99EB 083D D332 0752 88C4 E958 C5D6 718B F597
uid     Corey Sheldon (Fedora Key) <sheldon.corey at gmail.com>
---------------------------------------------------------------------------------------------------

On Tue, Mar 31, 2015 at 4:55 AM, Miroslav Suchý <msuchy at redhat.com> wrote:

> On 03/27/2015 01:49 PM, Kevin Fenzi wrote:
> > * releng person gathers list of pending update requests from bodhi.
> >   (a few minutes)
> >
> > * releng person looks over list for anything out of the ordinary or
> >   off. (another few minutes)
> >
> > * releng person tells sigul to sign that list of packages and write out
> >   the signed ones in koji. The releng person talks to the sigul bridge
> >   and the sigul vault (which is not reachable via ssh) talks to the
> >   bridge.
>
> Few minutes, but manual minutes. IIRC rest of the process is automatic.
> Do we really need human here? What can be extraordinary here? Even if I
> have that security incident years ago in my
> mind, I could not figure out why we need human reviewing list of packages
> to sign.
>
> --
> Miroslav Suchy, RHCE, RHCDS
> Red Hat, Senior Software Engineer, #brno, #devexp, #fedora-buildsys
> --
> devel mailing list
> devel at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/devel
> Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/devel/attachments/20150331/4421b39e/attachment.html>