Re: mono and snk key files
by Christopher Brown
2009/12/21 Tom "spot" Callaway <tcallawa(a)redhat.com>:
> On 12/19/2009 11:03 AM, Christopher Brown wrote:
>> 2009/12/15 Adam Goode <adam(a)spicenitz.org>:
>>> On 12/13/2009 06:16 AM, Christopher Brown wrote:
>>>> 2009/12/11 Adam Goode <adam(a)spicenitz.org>:
>>>>> We should definitely use Debian's key, right? Otherwise some Fedora CLI
>>>>> libraries would be unnecessarily incompatible with Debian, and whoever
>>>>> else uses Debian's key.
>>>>>
>>>>> The whole business of not shipping code-signing keys is a little
>>>>> contrary to open source. I think this is something that GPLv3 would
>>>>> prohibit. We should use a single well-known signing key for any package
>>>>> that we don't have the keys for, I think.
>>>>
>>>> You're right.
>>>>
>>>> This has already been resolved in devel by added mono.snk to the
>>>> mono-devel package. I'm just waiting on commit access to make the
>>>> required changes to F-11 and F-12 unless someone else wants to do it.
>>>>
>>>
>>> It looks like spot generated a new mono.snk. I was arguing to use
>>> Debian's mono.snk, for cross-distro compatibility. Shouldn't everyone
>>> should use Debian's key unless a package provides its own?
>>
>> Ideally we (Fedora and Debian) should use a single key generated by
>> upstream but as this issue is only problematic due to cyclic dep
>> problems in the build process I think that using our own is enough.
>> Unfortunately I don't care enough to chase this issue further.
>
> Yeah, I think there is very little merit in giving any amount of trust
> to that key, nor is there any real value in picking up mono bits built
> for Debian and putting them on Fedora and expecting them to work (or
Christian - any chance of pushing this to F-12 sooner rather than later?
--
Christopher Brown
14 years, 3 months
Re: mono and snk key files
by Christian Krause
[moving to fedora-mono]
Hi Christopher, Hi All,
On 12/13/2009 12:16 PM, Christopher Brown wrote:
>> The whole business of not shipping code-signing keys is a little
>> contrary to open source. I think this is something that GPLv3 would
>> prohibit. We should use a single well-known signing key for any package
>> that we don't have the keys for, I think.
>
> You're right.
>
> This has already been resolved in devel by added mono.snk to the
> mono-devel package. I'm just waiting on commit access to make the
> required changes to F-11 and F-12 unless someone else wants to do it.
I'm currently preparing an update of mono for F12 to the new upstream
bugfix release 2.4.3.
I would volunteer to add mono.snk as well.
However, I have two questions:
1. I've seen that you've uploaded mono.snk to the lookaside cache, but
it is currently also checked in into CVS. Where should it finally reside?
2. Using a static key for all updates of a certain mono package which does
not provide one itself will result in the problem, that our package will
make promises about ABI stability which may not be true. Although the
package/library may have an ABI change, it won't look like this.
Would it be acceptable just to push out e.g. such a library with all other
packages which depend on it or would it make sense to reflect ABI changes
then in the Requires of the packages so that a specific version (or
greater) of the library will be enforced?
@Christopher: If you like you can subscribe to fedora-mono, probably the
list can be revived... ;-)
Best regards,
Christian
14 years, 4 months
Looking for volunteer to take over the mailing list
by David Nielsen
As people know I am no longer a Fedora developer and my involvement with the
Mono SIG has also faded into pretty much nothingness. So I think it would be
in everyones interest if this mailing list was no longer owned by me, in
that spirit I am looking for a volunteer to take the list off my hands.
Kind regards,
David
14 years, 4 months