On 02/11/2014 07:58 PM, Matthew Miller wrote:
On Tue, Feb 11, 2014 at 07:53:14PM +0100, Honza Horak wrote:
I'm not sure that significantly is correct. It's not such a big problem now to package some sane code, go through formal review and then change the code to malware. As far as there is some quick "stop" button, I'd be ok with automatic reviews.
Sure. The current model is based on the idea of sponsorship, and the idea that the high bar of getting a package in creates a system of contributor trust. We should probably look at how true that is, too.
If the packager has devel cla, I would be fine with adding such collections into the repository. He should have at least some knowledge about proper packaging. I wouldn't start normal review process for such packages, because we would have even more packages with "high bar" for inclusion into Fedora repositories.
Marcela