Some questions around coprs

[Matt_Domsch at Dell.com]

FESCo would have to change their rules prohibiting shipping non-official repo files in the main repository.  Assuming that political battle is successful...
I think signing must be done by the copr creator (personally).
As each copr repo is independently timed and created, I'd be OK with a frequently scheduled rsync that pulls all coprs and drops them into the master mirrors, for downstreams to pick up at will.  Probably in the pub/alt tree please.  That will minimize the # of mirrors that are looking for them too.
I think the purgatory problem is one for each copr to decide.  Some may be bleeding edge, some may be backports of good stuff that changes infrequently.
I'd say _no_ to the meta-repo, for exactly the above reasons, and so 2 coprs may conflict and/or compete.  That's their right.


--
Matt Domsch
Distinguished Engineer, Director
Dell | Software Group


-----Original Message-----
From: infrastructure-bounces at lists.fedoraproject.org [mailto:infrastructure-bounces at lists.fedoraproject.org] On Behalf Of Kevin Fenzi

Sent: Wednesday, December 04, 2013 2:20 PM
To: infrastructure at lists.fedoraproject.org
Subject: Some questions around coprs

So, at todays fesco meeting there was some discussion about coprs.
http://meetbot.fedoraproject.org/meetbot/fedora-meeting/2013-12-04/fesco.2013-12-04-17.59.log.html#l-52

In particular some folks want to be able to ship copr repo files in the main Fedora repository. This would allow users to easily install software from there without having to discover how to enable it.

However, copr packages are not signed or mirrored currently.

So, this brings up thoughts around if we can somehow sign them, and how we could mirror them, or even if we want to go down this road at all.

(as it seems like not a use case copr's was designed for anyhow).

So:

1. Do we even want to persue this?

2. If so, do we have any ideas how signing copr packages could work?

3. Mirroring doesn't seem like it would be that hard, just rsync off the repos and push them out in our regular mirroring system. Could be a fair bit of churn tho, and there's no set schedule, so we would have to decide on frequency, etc.

4. If coprs moves to being inside koji, could we at that point have a better time with these needs?

5. Perhaps we could propose some kind if pergatory type setup between coprs (experemental, just builds, may set your house on fire, may update incompatibly every day) and fedora repository packages (with all the updates guidelines, reviews, etc).

Thoughts? comments?

Possibly related to this: I wonder if copr could grow a 'meta repo'
that has all the repodata of all existing coprs. Then you could just enable one thing and be able to install any coprs?

kevin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/infrastructure/attachments/20131204/a8c631b8/attachment.html>