You mean like quota-devel?
Sent from my iPhone
> On Nov 12, 2019, at 4:14 PM, Dominik 'Rathann' Mierzejewski
<dominik(a)greysector.net> wrote:
>
> On Tuesday, 12 November 2019 at 22:07, Stephen Gallagher wrote:
>>> On Tue, Nov 12, 2019 at 4:03 PM Dominik 'Rathann' Mierzejewski
>>> <dominik(a)greysector.net> wrote:
>>>
>>>> On Tuesday, 12 November 2019 at 21:15, Stephen Gallagher wrote:
>>> [...]
>>>> I agree with Aleksandra here. And we *did* establish that our policy
>>>> going forward is that we will forbid any default stream from providing
>>>> non-API content. (Filtered out packages are orthogonal to this.)
>>>
>>> What does that even mean?
>>>
>>
>> Modular builds have metadata that can indicate to consumers which
>> subpackages in this module should be considered "API". If a module
>> produces a package artifact and does not list it thusly, it is meant
>> to be treated as an internal implementation detail of the module (and
>> that the maintainer is not committing to maintaining that particular
>> package for any purpose other than supporting the API content of this
>> module).
>>
>> We also have "filters" which are intended for allowing module
>> packagers to build and use build-time-only packages. They are built
>> and added to the module buildroot as part of the build process, but
>> they are filtered out so they don't end up in the final composed
>> repository. (This is useful if, for example, your package used a small
>> subset of some other package only at build-time and you don't want to
>> have to maintain that package for everyone in the distro just to build
>> yours).
>
> OK. Let's say one of those is a static library that doesn't get exposed
> in the final composed repository. Suppose there's a security bug in that
> exact version but that bug doesn't occur in the traditionally-maintained
> package in Fedora (perhaps because the vulnerable version was skipped).
> How do you detect that and know which packages (modules?) need to be
> rebuilt?
>
> Regards,
> Dominik
> --
> Fedora
https://getfedora.org | RPM Fusion
http://rpmfusion.org
> There should be a science of discontent. People need hard times and
> oppression to develop psychic muscles.
> -- from "Collected Sayings of Muad'Dib" by the Princess Irulan
> _______________________________________________
> devel mailing list -- devel(a)lists.fedoraproject.org
> To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org