Re: Checking signatures on package source tarballs

2016-03-30 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Mar 30, 2016 at 11:38:28AM -0500, Michael Catanzaro wrote: > On Wed, 2016-03-30 at 15:57 +, Ralf Senderek wrote: > > It cannot be automated, because it relies on using the correct public > > key, which always has to be checked manually by the packager > > (including the use of gpg). >

Re: Checking signatures on package source tarballs

2016-03-30 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Mar 30, 2016 at 04:19:49PM -, Ralf Senderek wrote: > In case of an incident where the private key may be compromized, upstream > is required to build the trust into the new key from the ground up. > > As these cases can be quite complicated and would need some serious actions > on beha

Re: Checking signatures on package source tarballs

2016-03-30 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Mar 30, 2016 at 04:31:14PM +0100, James Hogarth wrote: > On 30 March 2016 at 15:45, Zbigniew Jędrzejewski-Szmek > wrote: > > > On Wed, Mar 30, 2016 at 02:44:44PM +, Zbigniew Jędrzejewski-Szmek > > wrote: > > > On Wed, Mar 30, 2016 at 02:26:59PM -, Ralf Senderek wrote: > > > [snip

Re: Call for help contacting contributors

2016-03-30 Thread Kevin Fenzi
On Thu, 24 Mar 2016 19:55:54 +0100 Pierre-Yves Chibon wrote: > Dear all, > > Packagers, members of the fedorabugs group and people having a > 'watchbugzilla' ACL in pkgdb must have a bugzilla account attached to > the email they set in the Fedora Account System (FAS). > This is mandatory to allo

Schedule for Thursday's FPC Meeting (2016-03-31 16:00 UTC)

2016-03-30 Thread James Antill
Following is the list of topics that will be discussed in the FPC meeting Thursday at 2016-03-31 16:00 UTC in #fedora-meeting-1 on irc.freenode.net. Local time information (via. rktime): 2016-03-31 09:00 Thu US/Pacific PDT 2016-03-31 12:00 Thu US/Eastern EDT 2016-03-31 1

Re: Heads up, wcslib soname bump

2016-03-30 Thread Christian Dersch
F24 too I think, doesn't make sense to stay with 4.x there as upstream projects (e.g. astropy start dropping support for older releases and everything builds fine @24 too. Christian On 03/30/2016 08:00 PM, Adam Williamson wrote: > On Wed, 2016-03-30 at 19:14 +0200, Sergio Pascual wrote: >> Hello,

Re: Heads up, wcslib soname bump

2016-03-30 Thread Adam Williamson
On Wed, 2016-03-30 at 19:14 +0200, Sergio Pascual wrote: > Hello, tomorrow I'm going to update wcslib to 5.14, which includes a soname > bump. This change affects the following packages: Just for Rawhide, or F24 also? It's useful to mention this. -- Adam Williamson Fedora QA Community Monkey IRC:

Re: Heads up, wcslib soname bump

2016-03-30 Thread Christian Dersch
Hi, I'll take care @ kstars. astrometry is not an official package yet, it is in review. Greetings, Christian On 03/30/2016 07:14 PM, Sergio Pascual wrote: > > Hello, tomorrow I'm going to update wcslib to 5.14, which includes a > soname bump. This change affects the following packages: > > c

Heads up, wcslib soname bump

2016-03-30 Thread Sergio Pascual
Hello, tomorrow I'm going to update wcslib to 5.14, which includes a soname bump. This change affects the following packages: cpl kstars python-astropy astrometry Best regards, Sergio -- devel mailing list devel@lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/devel@lists.fedora

Fedora 24-20160330.n.0 compose check report

2016-03-30 Thread Fedora compose checker
Missing expected images: Kde live i386 Workstation live i386 Kde live x86_64 Cloud_base raw-xz x86_64 Cloud_base raw-xz i386 Atomic raw-xz x86_64 Workstation live x86_64 Images in this compose but not 24-20160329.n.1: Security live x86_64 Security live i386 Jam_kde live x86_64 Docker_base docker

Re: Checking signatures on package source tarballs

2016-03-30 Thread Michael Catanzaro
On Wed, 2016-03-30 at 15:57 +, Ralf Senderek wrote: > It cannot be automated, because it relies on using the correct public > key, which always has to be checked manually by the packager > (including the use of gpg). I mean, after the packager manually configures signature checking the first t

Re: Checking signatures on package source tarballs

2016-03-30 Thread Ralf Senderek
> On Wed, Mar 30, 2016 at 02:26:59PM -, Ralf Senderek wrote: > [snip the part I complete agree with] ... > In fact signatures and license files are quite similar: > our guidelines say that the license file MUST be installed if provided > by upstream, and packagers SHOULD ask upstream to provide

Re: Checking signatures on package source tarballs

2016-03-30 Thread Ralf Senderek
Michael Catanzaro writes: > Yeah, if this isn't automated SOMEHOW, I'm not going to do it, because > I don't understand how to use GPG. I doubt I'm unusual in this > regard It cannot be automated, because it relies on using the correct public key, which always has to be checked manually by th

Re: Checking signatures on package source tarballs

2016-03-30 Thread Michael Catanzaro
On Wed, 2016-03-30 at 12:14 +, Zbigniew Jędrzejewski-Szmek wrote: > I don't think you can discount this. Most maintainers don't check the > tarballs they download if they build fine, afaik. Checking the > signatures in %prep would force a significant change to how we build > srpms. Yeah, if th

Re: Checking signatures on package source tarballs

2016-03-30 Thread James Hogarth
On 30 March 2016 at 15:45, Zbigniew Jędrzejewski-Szmek wrote: > On Wed, Mar 30, 2016 at 02:44:44PM +, Zbigniew Jędrzejewski-Szmek > wrote: > > On Wed, Mar 30, 2016 at 02:26:59PM -, Ralf Senderek wrote: > > [snip the part I complete agree with] > > > > > Having said the above, I also advoc

Re: Fedora Rawhide-20160330.n.0 compose check report

2016-03-30 Thread Adam Williamson
On Wed, 2016-03-30 at 12:49 +, Fedora compose checker wrote: > Failed openQA tests: 60 of 68 anaconda blew up in blivet: https://bugzilla.redhat.com/show_bug.cgi?id=1322497 it's being looked into now. Consider this compose as unusable for Rawhide install. Yesterday's compose mostly worked,

Fedora 24 compose report: 20160330.n.0 changes

2016-03-30 Thread Fedora Branched Report
OLD: Fedora-24-20160329.n.1 NEW: Fedora-24-20160330.n.0 = SUMMARY = Added packages: 11 Dropped packages:0 Upgraded packages: 90 Downgraded packages: 0 Size of added packages: 1.24 MiB Size of dropped packages:0.00 B Size of upgraded packages: 385.07 MiB Size of

RE: ddclient orphaned

2016-03-30 Thread John Florian
> -Original Message- > From: Scott Talbert [mailto:s...@techie.net] > Sent: Tuesday, March 29, 2016 16:29 > To: Development discussions related to Fedora > Subject: RE: ddclient orphaned > > On Tue, 29 Mar 2016, John Florian wrote: > > >> Somehow, somewhen, I wound up as the main contac

RE: ddclient orphaned

2016-03-30 Thread John Florian
> From: Adam Williamson [mailto:adamw...@fedoraproject.org] > Sent: Tuesday, March 29, 2016 19:30 > To: Development discussions related to Fedora > Subject: Re: ddclient orphaned > > On Tue, 2016-03-29 at 20:10 +, John Florian wrote: > > > > > > -Original Message- > > > From: Adam Will

Help with testing current kubernetes for f23

2016-03-30 Thread Jan Chaloupka
Hi, it has been a while since kubernetes was pushed to f23 stable repository. This is the first suitable build after more than half a year. Any help with testing and adding positive karmas is appreciated. Update is located here [1]. [1] https://bodhi.fedoraproject.org/updates/kubernetes-1.

Re: Checking signatures on package source tarballs

2016-03-30 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Mar 30, 2016 at 02:44:44PM +, Zbigniew Jędrzejewski-Szmek wrote: > On Wed, Mar 30, 2016 at 02:26:59PM -, Ralf Senderek wrote: > [snip the part I complete agree with] > > > Having said the above, I also advocate a SHOULD instead of a MUST in > > the guidelines as providing a signatu

Re: Checking signatures on package source tarballs

2016-03-30 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Mar 30, 2016 at 02:26:59PM -, Ralf Senderek wrote: [snip the part I complete agree with] > Having said the above, I also advocate a SHOULD instead of a MUST in > the guidelines as providing a signature with the source tarball is > voluntary for upstream and should be viewed as an addit

Re: Checking signatures on package source tarballs

2016-03-30 Thread Ralf Senderek
James Hogarth wrote: > We trust our packagers to do a lot, we can trust them to add this to their > packages if it helps them and for them to encourage it in their reviews if > they find a signed archive provided upstream. IMHO, this is the main point. Checking signatures automatically in %prep o

Re: [HEADS-UP] so-name-bump JSONCPP in rawhide

2016-03-30 Thread Björn Esser
All left-over rebuilds for Rawhide and fc24 have finished yesterday… The fc24-update [1] carries all needed rebuilds and has reached testing, waiting for some karma… ;) [1] https://bodhi.fedoraproject.org/updates/FEDORA-2016-3353070273 Am 29.03.2016 um 09:16 schrieb Björn Esser: Already r

Re: ddclient orphaned

2016-03-30 Thread Major Hayden
On 03/29/2016 03:28 PM, Scott Talbert wrote: > I adopted it. Working on updating it to the latest release. > > Scott Thank you, Scott! :) I use ddclient fairly regularly and I will be glad to test your updated package. -- Major Hayden signature.asc Description: OpenPGP digital signature --

Re: Checking signatures on package source tarballs

2016-03-30 Thread James Hogarth
On 30 Mar 2016 13:15, "Zbigniew Jędrzejewski-Szmek" wrote: > > On Wed, Mar 30, 2016 at 07:01:53AM +0100, James Hogarth wrote: > > And of course with the packager uploading both the key and the archive to > > git with no net access in koji to verify the key I really don't see what > > this actually

Fedora Rawhide-20160330.n.0 compose check report

2016-03-30 Thread Fedora compose checker
Missing expected images: Kde live i386 Workstation live i386 Kde live x86_64 Cloud_base raw-xz x86_64 Cloud_base raw-xz i386 Atomic raw-xz x86_64 Kde raw-xz armhfp Minimal raw-xz armhfp Workstation live x86_64 No images in this compose but not Rawhide-20160329.n.0 Images in Rawhide-20160329.n.0

Re: Checking signatures on package source tarballs

2016-03-30 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Mar 30, 2016 at 07:01:53AM +0100, James Hogarth wrote: > And of course with the packager uploading both the key and the archive to > git with no net access in koji to verify the key I really don't see what > this actually gives us The signature and key can be verified by anyone. The signat

Fedora rawhide compose report: 20160330.n.0 changes

2016-03-30 Thread Fedora Rawhide Report
OLD: Fedora-Rawhide-20160329.n.0 NEW: Fedora-Rawhide-20160330.n.0 = SUMMARY = Added packages: 5 Dropped packages:2 Upgraded packages: 102 Downgraded packages: 0 Size of added packages: 8.06 MiB Size of dropped packages:419.55 KiB Size of upgraded packages: 1.09 GiB