Hi all,
the previous mail [1] from Tomas Radej made me wondering, whether we should allow adding
arbitrary repos to copr. Most importantly, anyone can build package A that is totally ok
in copr, but make it depend on "evil" package B from an outside repo. So when a
user would try to install all the dependencies of package A, that would also require
installing package B (and user might just trust that B is ok, add the outside repo and go
on). So from my point of view, we can't add third party repos to generated .repo
files, that's for sure.
But that brings a question whether it even makes sense to add these to copr repos. Because
they would only be good for building packages, but users would never be able to reach
them.
So here is my proposal:
- For now, keep the posibility of adding arbitrary repos to copr, but never make them
available through .repo files.
- Consider dropping these ^^ completely (I'm not sure about this point, I'd like
to hear some opinions).
- A very nice functionality would be to only add other coprs to repos. This way, we could
make sure that anything user tries to install will have dependencies met and also we will
have them under control. Also, that would allow us to generate RPMs with .repo files that
would depend on other (e.g. copr X depends on copr Y, generated RPM for X depends on RPM
for Y, Yum can download that somehow). Thoughts?
And I still hope that this would actually not destroy any of Tomas's work :)
Please comment, I'd really love to hear some opinions on this.
Thanks!
--
Regards,
Bohuslav "Slavek" Kabrda.
[1]
https://lists.fedorahosted.org/pipermail/copr-devel/2013-February/000512....