On Tue, Jan 19, 2021 at 6:44 PM Mark Pearson <markpearson@lenovo.com> wrote:
Release cadence is once. We just can't update our preload images that
often - there's a long test cycle, and energy certification that goes
with that image. It's one of the reasons the X1C8 is still shipping with
Fedora32, and P1G3 and P15 (soon!) will be with F33 for a long time. The
only reason to update would be a critical bug that couldn't be fixed
with an update once the platform was received.

If the cadence is once in a long time (related to new hardware introductions, so possibly once a year or similar), I think the best approach here is to have releng manually trigger an F33 Workstation Live image compose using the current updates repo. Assuming it's not a problem for them. We (the QA) can then trigger an OpenQA test run on it, create the release validation test matrices for it, and even ask the community in large to perform some manual tests if they have time. I believe some of us would devote some time to make sure at least the basics work correctly. I'm not sure if all the plumbing for this one-off compose is ready (in fedfind, relval, openqa and wherever else needed), but Adam will know more.

I don't want to just repeat Adam's words, but I'd like to stress out that from the security perspective, such a compose should really be created using the proper Fedora Infra tooling (or Lenovo itself using official Fedora bits). I don't want to belittle the people standing behind the unofficial Live respins, they are doing a great and useful work, but if this is going to be shipped preinstalled to thousands of customers, the whole process should be as verifiable as with our official releases.