Discussion: Usage of Repos Outside of Copr

Bohuslav Kabrda bkabrda at redhat.com
Fri Mar 1 08:26:09 UTC 2013


Hi all,
the previous mail [1] from Tomas Radej made me wondering, whether we should allow adding arbitrary repos to copr. Most importantly, anyone can build package A that is totally ok in copr, but make it depend on "evil" package B from an outside repo. So when a user would try to install all the dependencies of package A, that would also require installing package B (and user might just trust that B is ok, add the outside repo and go on). So from my point of view, we can't add third party repos to generated .repo files, that's for sure.
But that brings a question whether it even makes sense to add these to copr repos. Because they would only be good for building packages, but users would never be able to reach them.
So here is my proposal:
- For now, keep the posibility of adding arbitrary repos to copr, but never make them available through .repo files.
- Consider dropping these ^^ completely (I'm not sure about this point, I'd like to hear some opinions).
- A very nice functionality would be to only add other coprs to repos. This way, we could make sure that anything user tries to install will have dependencies met and also we will have them under control. Also, that would allow us to generate RPMs with .repo files that would depend on other (e.g. copr X depends on copr Y, generated RPM for X depends on RPM for Y, Yum can download that somehow). Thoughts?
And I still hope that this would actually not destroy any of Tomas's work :)

Please comment, I'd really love to hear some opinions on this.

Thanks!

-- 
Regards,
Bohuslav "Slavek" Kabrda.

[1] https://lists.fedorahosted.org/pipermail/copr-devel/2013-February/000512.html


More information about the copr-devel mailing list