On 8 June 2011 23:38, Stew Benedict <[email protected]> wrote: > On 06/08/2011 05:31 PM, Michael Scherer wrote: >> >> Le mercredi 08 juin 2011 à 19:48 +0300, Ahmad Samir a écrit : >>> >>> On 8 June 2011 18:44, Michael Scherer<[email protected]> wrote: >>>> >>>> Le mercredi 08 juin 2011 à 10:40 +0200, Anne nicolas a écrit : >>>>> >>>>> Hi there >>>>> >>>>> We have some stuff to complete here: >>>>> http://mageia.org/wiki/doku.php?id=security >>>>> >>>>> <http://mageia.org/wiki/doku.php?id=security>Can we spend the 2 or 3 >>>>> coming >>>>> days to finalize it and start updates submits? >>>> >>>> Pascal is working on this. >>>> >>>> So here is a proposal : >>>> - anybody can submit a package to updates_testing. >>>> - once submitted to testing, it should ask to QA to test, along with : >>>> - a reason for the update ( likely bug number ) >>>> - potentially a priority ( ie, if this is just a translation update or >>>> a urgent 0 day exploit ) >>>> - a way to test the bug and see it is fixed >>>> - text for the update >>>> >>>> - qa validate the update ( with process to define ) >>>> >>>> - someone move the package from updates_testing to testing >>> >>> Isn't it cleaner to rebuild when submitting to */updates? instead of >>> moving. >> >> Well, that depend on the way package is built. In fact, it should not >> matter much, as we should not do a change that could break a existing >> software in update, and so this should be the same in updates_testing >> ( ie, they should be the same wrto ABI ) >> >> But that's also why I ask here :) >> >> > If you're going to rebuild *after* QA, you've just invalidated your QA. > (yeah, I know it *should* be the same, but stuff happens) >
You're right (even if that's never happened for 3-4 years in mdv, since sec team rebuilt the packages when pushing to */updates IIRC). > > -- > Stew Benedict > New Tazewell, TN > > > -- Ahmad Samir
