On Tue, Jun 28, 2022 at 03:05:32PM +0200, Ralf Corsépius wrote:
Am 28.06.22 um 14:51 schrieb Zbigniew Jędrzejewski-Szmek:
> On Tue, Jun 28, 2022 at 02:41:42PM +0200, Kevin Kofler via devel wrote:
> > > It certainly is not true that the feedback was not considered by FESCo:
> > > there was a long discussion on IRC, and FESCo members also participated
in
> > > the mailing list thread.
> >
> > Yet, the outcome is diametrically opposed to the mailing list consensus.
>
> I don't think it makes sense to restart the discussion here. I disagree
And I disagree with you.
This decision is such kind of harmful to Fedora, this decision should be
reverted. This decision communicates the attitude of FESCO not caring about
security, maintainablity and further related topics.
I don't see that attitude in reading the IRC logs of the meeting,
and I think that characterization is rather unfair to those
involved.
> Personally, I see a lot of value in having Java packaged
> for Fedora, and use it for my stuff.
So do I, but this doesn't invalidate the the thought of "bundling" and
"static linkage" being a prime security risk.
I see people aware of the downsides of bundling and static linking,
but they're not the sole factors to be considered. Our packaging
guidelines on the topic of bundling are more nuanced and this is
what FESCO has considered when evaluating this feature from what
I can read in the meeting minutes.
IOW, if people think the outcome is wrong, then the problem really
lies with the agreed packaging guidelines wrt to bundling, not with
FESCOs decision which looks to be in compliance with the stated
guidelines.
With regards,
Daniel
--
|:
https://berrange.com -o-
https://www.flickr.com/photos/dberrange :|
|:
https://libvirt.org -o-
https://fstop138.berrange.com :|
|:
https://entangle-photo.org -o-
https://www.instagram.com/dberrange :|