toshio(a)tiki-lounge.com (Toshio) writes:
Concerns about the autobuilder downloading a different
src.rpm/tarball
than the QA testers can be alleviated (entirely?) by having QA testers
submit hashes of the files they're testing.
Already requested by fedora.us procedures:
http://www.fedora.us/wiki/PackageSubmissionQAPolicy
| In cases where a QA message would lead to package approval or publication,
| the message MUST be GPG clearsigned, and contain md5sums of the reviewed
| source RPM as well as preferably all upstream sources.
Then the autobuilder has to check that the files it's working
with
match the ones the QA testers tested.
fedora.us buildsystem is doing this exactly.
Enrico