[Mageia-dev] Finalizing update process

Thu Jun 9 11:05:16 CEST 2011

'Twas brillig, and Ahmad Samir at 08/06/11 22:48 did gyre and gimble:
+> On 8 June 2011 23:38, Stew Benedict <stewbintn at gmail.com> wrote:
+>> On 06/08/2011 05:31 PM, Michael Scherer wrote:
+>>>
+>>> Le mercredi 08 juin 2011 à 19:48 +0300, Ahmad Samir a écrit :
+>>>>
+>>>> On 8 June 2011 18:44, Michael Scherer<misc at zarb.org>  wrote:
+>>>>>
+>>>>> Le mercredi 08 juin 2011 à 10:40 +0200, Anne nicolas a écrit :
+>>>>>>
+>>>>>> Hi there
+>>>>>>
+>>>>>> We have some stuff to complete here:
+>>>>>> http://mageia.org/wiki/doku.php?id=security
+>>>>>>
+>>>>>> <http://mageia.org/wiki/doku.php?id=security>Can we spend the 2 or 3
+>>>>>> coming
+>>>>>> days to finalize it and start updates submits?
+>>>>>
+>>>>> Pascal is working on this.
+>>>>>
+>>>>> So here is a proposal :
+>>>>> - anybody can submit a package to updates_testing.
+>>>>> - once submitted to testing, it should ask to QA to test, along with :
+>>>>>  - a reason for the update ( likely bug number )
+>>>>>  - potentially a priority ( ie, if this is just a translation update or
+>>>>> a urgent 0 day exploit )
+>>>>>  - a way to test the bug and see it is fixed
+>>>>>  - text for the update
+>>>>>
+>>>>> - qa validate the update ( with process to define )
+>>>>>
+>>>>> - someone move the package from updates_testing to testing
+>>>>
+>>>> Isn't it cleaner to rebuild when submitting to */updates? instead of
+>>>> moving.
+>>>
+>>> Well, that depend on the way package is built. In fact, it should not
+>>> matter much, as we should not do a change that could break a existing
+>>> software in update, and so this should be the same in updates_testing
+>>> ( ie, they should be the same wrto ABI )
+>>>
+>>> But that's also why I ask here :)
+>>>
+>>>
+>> If you're going to rebuild *after* QA, you've just invalidated your QA.
+>> (yeah, I know it *should* be the same, but stuff happens)
+>>
+> 
+> You're right (even if that's never happened for 3-4 years in mdv,
+> since sec team rebuilt the packages when pushing to */updates IIRC).
+
+
+Personally, and this might just be me, I always submit my packages to
+*testing with a subrel of 0.1, 0.2 0.3 etc etc. Users then test my
+various iterations. When I'm happy and when it's ready to pass to QA, I
+set the subrel to 1. This way the final version that should hit updates
+is nice and neat.
+
+In an ideal world, QA would validate it for me then change the subrel
+for me. That process would require a rebuild.
+
+I'm not sure what others feel about this? It's not impossible to just do
+this as a matter of course as part of the process we go through and
+increment subrel to a round number before handing over to QA... although
+maybe I'm just a bit too anal about neat version numbers :p
+
+Col
+
+
+
+
+-- 
+
+Colin Guthrie
+mageia(at)colin.guthr.ie
+http://colin.guthr.ie/
+
+Day Job:
+  Tribalogic Limited [http://www.tribalogic.net/]
+Open Source:
+  Mageia Contributor [http://www.mageia.org/]
+  PulseAudio Hacker [http://www.pulseaudio.org/]
+  Trac Hacker [http://trac.edgewall.org/]
+