Re: fedup: does not verify source

2012-12-17 Thread Björn Persson
Adam Williamson wrote: > On Tue, 2012-12-18 at 02:05 +0100, Björn Persson wrote: > > Adam Williamson wrote: > > > anyhow, the tricky thing here lies in somehow making it safe for > > > fedup to *automatically* import the correct key for the next > > > release. This is a subtlish problem. > > > > T

Re: fedup: does not verify source

2012-12-17 Thread Adam Williamson
On Tue, 2012-12-18 at 02:05 +0100, Björn Persson wrote: > Adam Williamson wrote: > > On Mon, 2012-12-17 at 11:27 -0500, Przemek Klosowski wrote: > > > On 12/17/2012 01:58 AM, Adam Williamson wrote: > > > > fedup essentially automates doing yum distro-sync across a reboot > > > > and in an isolated

Re: fedup: does not verify source

2012-12-17 Thread Björn Persson
Adam Williamson wrote: > On Mon, 2012-12-17 at 11:27 -0500, Przemek Klosowski wrote: > > On 12/17/2012 01:58 AM, Adam Williamson wrote: > > > fedup essentially automates doing yum distro-sync across a reboot > > > and in an isolated environment > > > > I don't understand---the discussion started b

Re: fedup: does not verify source

2012-12-17 Thread Bruno Wolff III
On Mon, Dec 17, 2012 at 10:58:54 -0800, Adam Williamson wrote: anyhow, the tricky thing here lies in somehow making it safe for fedup to *automatically* import the correct key for the next release. This is a subtlish problem. I am biased by being a rawhide user and someone who regularly gra

Re: fedup: does not verify source

2012-12-17 Thread Josh Stone
On 12/17/2012 10:58 AM, Adam Williamson wrote: > When you do a yum distro-sync according to the instructions on the wiki, > you are supposed to manually import the GPG key for the next release. If > you're doing things Properly, you should somehow verify you're importing > the correct key and not j

Re: fedup: does not verify source

2012-12-17 Thread Adam Williamson
On Mon, 2012-12-17 at 11:27 -0500, Przemek Klosowski wrote: > On 12/17/2012 01:58 AM, Adam Williamson wrote: > > > fedup essentially automates doing yum distro-sync across a reboot and in > > an isolated environment, and provides an interface for hooking in any > > kind of outside-of-yum-mucking-a

Re: fedup: does not verify source

2012-12-17 Thread Przemek Klosowski
On 12/17/2012 01:58 AM, Adam Williamson wrote: fedup essentially automates doing yum distro-sync across a reboot and in an isolated environment, and provides an interface for hooking in any kind of outside-of-yum-mucking-about we might need to do (like the /usr move stuff). It's really just a sl

Re: fedup: does not verify source

2012-12-17 Thread Matthew Garrett
On Sun, Dec 16, 2012 at 07:34:17PM -0500, Rahul Sundaram wrote: > Hi > > > > fedup is supposed to support media upgrades yes. > > > > At this point, fedup doesn't > > " --iso ISO[TODO] installation image file" Media upgrades are --device. --iso is for local ISO files. -- Matthew

Re: fedup: does not verify source

2012-12-17 Thread Jaroslav Reznik
- Original Message - > > > > > > > On Sun, Dec 16, 2012 at 8:01 PM, Björn Persson < > bj...@xn--rombobjrn-67a.se > wrote: > > > Except for Yum, which has for years been the only method that was > both > secure and practical anyway, but I agree. As long as people are being > discoura

Re: fedup: does not verify source

2012-12-17 Thread Jóhann B. Guðmundsson
On 12/17/2012 01:23 PM, Marcela Mašláňová wrote: I don't think FESCo should interfere according to the process: https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process Imho you can join their next go/no-go meeting and try to persuade all stakeholders. This falls under fesco to decide. JB

Re: fedup: does not verify source

2012-12-17 Thread Rahul Sundaram
On 12/17/2012 08:23 AM, Marcela Mašláňová wrote: I don't think FESCo should interfere according to the process: https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process Imho you can join their next go/no-go meeting and try to persuade all stakeholders. FESCo is ultimately responsible for eng

Re: fedup: does not verify source

2012-12-17 Thread Marcela Mašláňová
On 12/17/2012 03:15 AM, Rahul Sundaram wrote: On Sun, Dec 16, 2012 at 8:01 PM, Björn Persson mailto:bj...@xn--rombobjrn-67a.se>> wrote: Except for Yum, which has for years been the only method that was both secure and practical anyway, but I agree. As long as people are being disc

Re: fedup: does not verify source

2012-12-16 Thread Adam Williamson
On Sun, 2012-12-16 at 22:00 -0500, Simo Sorce wrote: > On Sun, 2012-12-16 at 21:15 -0500, Rahul Sundaram wrote: > > > > > > > > On Sun, Dec 16, 2012 at 8:01 PM, Björn Persson > > wrote: > > Except for Yum, which has for years been the only method that > > was both > > se

Re: fedup: does not verify source

2012-12-16 Thread Simo Sorce
On Sun, 2012-12-16 at 21:15 -0500, Rahul Sundaram wrote: > > > > On Sun, Dec 16, 2012 at 8:01 PM, Björn Persson > wrote: > Except for Yum, which has for years been the only method that > was both > secure and practical anyway, but I agree. As long as people > are

Re: fedup: does not verify source

2012-12-16 Thread Rahul Sundaram
On Sun, Dec 16, 2012 at 8:01 PM, Björn Persson wrote: > Except for Yum, which has for years been the only method that was both > secure and practical anyway, but I agree. As long as people are being > discouraged from upgrading by Yum because it's "unsupported", removing > the only "supported" and

Re: fedup: does not verify source

2012-12-16 Thread Björn Persson
Rahul Sundaram wrote: > So unless that feature is marked as a blocker, we would be releasing > Fedora 18 with no secure method to upgrade to it. That seems > irresponsible. Except for Yum, which has for years been the only method that was both secure and practical anyway, but I agree. As long as

Re: fedup: does not verify source

2012-12-16 Thread Rahul Sundaram
Hi > fedup is supposed to support media upgrades yes. > At this point, fedup doesn't " --iso ISO[TODO] installation image file" So unless that feature is marked as a blocker, we would be releasing Fedora 18 with no secure method to upgrade to it. That seems irresponsible. Rahul

Re: fedup: does not verify source

2012-12-16 Thread drago01
On Mon, Dec 17, 2012 at 1:14 AM, Rahul Sundaram wrote: > Hi > >> >> Isn't it not a regression because _Anaconda_ never verified the source? >> >> (That is, good old bug #998.) > > > I am aware of that bug but then media based upgrades have always been > supported as a workaround. Is that still th

Re: fedup: does not verify source

2012-12-16 Thread Rahul Sundaram
Hi > Isn't it not a regression because _Anaconda_ never verified the source? > > (That is, good old bug #998.) > I am aware of that bug but then media based upgrades have always been supported as a workaround. Is that still the case? Rahul -- devel mailing list devel@lists.fedoraproject.org h

Re: fedup: does not verify source

2012-12-16 Thread drago01
On Sun, Dec 16, 2012 at 9:03 PM, Rahul Sundaram wrote: > Hi > > https://bugzilla.redhat.com/show_bug.cgi?id=877623 > > Why was this rejected as a blocker? Even if one considers that it isn't a > regression compared to PreUpgrade, the situation has changed now that > Anaconda itself doesn't provid

Re: fedup: does not verify source

2012-12-16 Thread Matthew Miller
On Sun, Dec 16, 2012 at 03:03:27PM -0500, Rahul Sundaram wrote: > https://bugzilla.redhat.com/show_bug.cgi?id=877623 > Why was this rejected as a blocker? Even if one considers that it > isn't a regression compared to PreUpgrade, the situation has changed > now that Anaconda itself doesn't provide

fedup: does not verify source

2012-12-16 Thread Rahul Sundaram
Hi https://bugzilla.redhat.com/show_bug.cgi?id=877623 Why was this rejected as a blocker? Even if one considers that it isn't a regression compared to PreUpgrade, the situation has changed now that Anaconda itself doesn't provide any upgrade method directly. Rahul -- devel mailing list deve