On Wed, Jan 07, 2004 at 06:11:21PM -0500, Eric S. Raymond wrote:
As for the DECSS problem, everybody understands it and we already have a workaround via the existence of livna.org.
I suggest that Fedora make the following offer to this group: Fedora will put these repositories in the distributed apt.sources and
I think you mean yum not apt ?
(2) RPMs must meet Fedora QA standards. Repository maintainers must expect their submission, test and build procedures to be audited, and will be dropped from the list of authoritative repositories if they fail to meet standards.
I doubt you'd get any pushback on these requirements. And the cost of QA-monitoring these repositories would undoubtedly be lower than the cost of building and maintaining one big repository of your own. You'd win fairly big on the download costs alone.
You assume that centralisation is good. From day one it was apparent that people would keep repositories however they felt like keeping them. Once things around Extras/Addons finally get saner I am sure there will be packages that migrate into that, and likewise I am sure there will be packages that move the other way.
Another thing to bear in mind is that quite a few of the repositories people run that are not so well known would fall flat if they were in the default yum configuration, just as some of the mirrors would if they were in the default configuration for the base packages and updates.
IMHO we are by far the better for having multiple repositories which maybe co-operate but don't share policy or agree on things entirely. It'll sort itself out over time as to which methods work best and what users like to do.
There are however some things that would definitely benefit the world whichever way we go. The most obvious one is a program and a description format for describing a repository and adding/removing it from /etc/yum.conf. The reason for that being to make it a mozilla helper so when you go to freshrpms or wherever you can simply click "Subscribe" and get a local dialog/tool doing the yum.conf updating, checking an GPG signature and if appropriate importing their GPG key.
Point and click subscribe solves a lot of the problems about finding stuff especially if someone decides to keep an index of repositories.
Alan