[releng] Issue #6663 `Create another new tag for Modularity`
by Ralph Bean
ralph reported a new issue against the project: `releng` that you are following:
``
This is related to #6658 but is different.
Through discussions with @puiterwijk in and audit of the MBS code, we are trying to reduce the permissions required by the module-build-service, so that it poses less of a risk.
In order to do that (for [mbs#333](https://pagure.io/fm-orchestrator/issue/333)) we need a new tag created that has the full package list for Fedora, but which should not inherit from an existing Fedora tag.
Let's call the new tag `module-package-list` (which describes precisely what it is for).
# Why we need a tag with the full package list
Current, MBS runs with admin permissions. When it tags builds into tags that it has created, it does so with `force=True` which automatically adds the package to the package list of the tag first, before tagging the build.
We want to remove `force=True` because it is too heavy handed.
We could dynamically add packages to the package list of the new module tag every time a new build comes along, but that requires elevated permissions.
Instead, if we have a master tag with a full package list of every package in Fedora, and if our new modules tags inherit from that tag, then we don't have to worry about the package list or have any special rights to manipulate it (good).
# Why the new tag should not inherit from an existing tag.
*If* we made this new tag inherit from the rawhide tag, then it would automatically get the nice package list that we need.
However, we need to ensure that the new tag does not accidentally provide any `BuildRequires` which are not explicitly specified by the module being built. If a `BuildRequires` is absent, we want the build to fail to ensure modules are really isolated from one another.
Therefore, we need this new tag to *not* inherit from any other tags.
Once created, we will need to patch [this script](https://infrastructure.fedoraproject.org/cgit/ansible.git/tree/ro... to automatically populate the package list of this new tag, while not contributing any builds.
``
To reply, visit the link below or just reply to this email
https://pagure.io/releng/issue/6663
7 years, 2 months