On 2017-09-26, Richard W.M. Jones <rjones(a)redhat.com> wrote:
On Tue, Sep 26, 2017 at 07:18:12AM +0000, Petr Pisar wrote:
> On 2017-09-25, Hedayat Vatankhah <hedayat.fwd(a)gmail.com> wrote:
> > /*Pierre-yves Chibon*/ wrote on Mon, 25 Sep 2017 09:38:39 +0200:
> >> It's an interesting idea but then it would become quite hard to check
> >> if there is a mitm attack of some sort. With the current process, at
> >> least the packager has the possibility to check the sources locally
> >> before uploading them into Fedora.
> >> The solution would be to provide the sha + the url and let the down
> >> be server side but that won't save you from downloading the sources
> >> locally first.
> > Yes, but even if I'm forced to download locally, it is much better than
> > being forced to upload it again. (Also, note that the current process
> > doesn't prevent MITM if it happens when I download the source).
> A packager is responsible for reviewing the code before uploading it to the
> Fedora infrastructure. It does not mattter whether the code matches what
> upstream released. Actually in some cases the code is intentionally
> changed by the packagers (e.g. when removing bad-licensed code).
Are there any tools you'd like to suggest for reviewing 100GB
(or even 10MB) of code?
diff. First you review 100GB code, and then you review differences only.
Actually you do not need to review 100GB of code. You can unbudle it
first. I doubt the 100GB were written from scratch.