On 5/28/2013 02:44, Martin Wilke wrote:
On the first note, complain about the patches to the upstream, not to us. This
patches problem has been around since forever and so long the upstream
is not changing anything about it, nor do we.
Hi Martin,
This statement is hand-waives the entire discussion, which took as a
*given* that upstream is the problem who crazy policies will not change.
I already said that "95%" of the blame (probably more) should get
allocated there.
The whole discussion started because upstream will clearly not change.
About rolling your own distfile, I completely disagree because we do not
know what the maintaner has changed,
and seeing it from the security view, I prefer to get all my patches from the
original mirrors.
1. Yes, some amount of trust is necessary but hopefully we don't have
maintainers that aren't trusted.
2. A trivial script can verify the roll-up contains only official
patches, which could be executed by the committer prior to committing
changes to distfile. That's a pretty easy "security" issue to address.
I get your point but that issue could be solved.
John
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ports
To unsubscribe, send any mail to "[email protected]"
