On Thu, Jun 09, 2022 at 09:09:30PM +0200, Miro Hrončok wrote:
Hello,
I've recently seen a package that was imported into Fedora without a package
review. I've noticed this because the packages doesn't even install and I
wanted to check if this could have been caught in the package review but I
couldn't find it, so I've checked the fedora-scm-requests ticket.
The ticket at fedora-scm-requests was created with exception=true. I am not
going to link to it, because I am not here to point fingers. I am just
genuinely curious.
According to
https://docs.fedoraproject.org/en-US/packaging-guidelines/ReviewGuideline...
we have 3 kinds of exceptions:
- FPC grants an explicit exemption from the process...
- The package is being created so that multiple versions of the same package
can coexist in the distribution...
- The package exists in both Fedora and RHEL, but the packager wants to ship
it in EPEL under an alternative name...
In those cases, the packager requests the repo with --exception, makes sense.
However, who checks if the flag was used according to the rules? Because
apparently, is seems that nobody does. Is it expected that we are all
responsible people who would not abuse this simply to avoid package reviews?
The scm admin processing the request should check it. :(
Perhaps this was simply missed and/or perhaps the tool could be better
about showing when a ticket is an exception. ;(
Do note that we are working on automating most of this away.
If/when that happens the exceptions would then be... exceptions.
(ie, the automation would refuse to process them and ask a human to do
so, unless we can come up with a way to check these cases in an
unattended way).
kevin