On Thu, 2010-04-29 at 10:58 -0700, Christopher Aillon wrote:
I really think that as a project, we'd be doing a lot better if
we
mandated upstream review before applying patches to any package if you
aren't an upstream maintainer of the code. As it is now, it's somewhat
scary to think how many packagers would take a bugfix patch and apply it
without being able to figure out if there's a potential hidden exploit
in it...
Review, perhaps, but not approval. Fedora and upstream are independent
organizations each pursing their own goals. Trademarks aside, Fedora
shouldn't be bound by upstream decisions any more than upstream is bound
by our packaging guidelines or obliged to accept patches to comply with
them. For comparison, disapproval from upstream libpng sure didn't stop
Mozilla from patching libpng with APNG support.
And the relevant qualification for a reviewer is knowledge of the code,
not affiliation with upstream.
--
Matt