Discussion: Usage of Repos Outside of Copr

seth vidal skvidal at fedoraproject.org
Wed Mar 6 05:31:24 UTC 2013


On Fri, 1 Mar 2013 03:26:09 -0500 (EST)
Bohuslav Kabrda <bkabrda at redhat.com> wrote:

> Hi all,
> the previous mail [1] from Tomas Radej made me wondering, whether we
> should allow adding arbitrary repos to copr. Most importantly, anyone
> can build package A that is totally ok in copr, but make it depend on
> "evil" package B from an outside repo. So when a user would try to
> install all the dependencies of package A, that would also require
> installing package B (and user might just trust that B is ok, add the
> outside repo and go on). So from my point of view, we can't add third
> party repos to generated .repo files, that's for sure. But that
> brings a question whether it even makes sense to add these to copr
> repos. Because they would only be good for building packages, but
> users would never be able to reach them. So here is my proposal:
> - For now, keep the posibility of adding arbitrary repos to copr, but
> never make them available through .repo files.
> - Consider dropping these ^^ completely (I'm not sure about this
> point, I'd like to hear some opinions).
> - A very nice functionality would be to only add other coprs to
> repos. This way, we could make sure that anything user tries to
> install will have dependencies met and also we will have them under
> control. Also, that would allow us to generate RPMs with .repo files
> that would depend on other (e.g. copr X depends on copr Y, generated
> RPM for X depends on RPM for Y, Yum can download that somehow).
> Thoughts? And I still hope that this would actually not destroy any
> of Tomas's work :)


okay - the whole point of coprs is to allow you to build pkgs including
build requirements from an arbitrary set of repositories. From ANYWHERE
NO MATTER WHAT. If that functionality is not allowed in coprs - then
there is no point in coprs. B/c that functionality is ENTIRELY provided
by scratch and chain builds in koji.


The reason why we're building on brand new cloud instances and then
immediately destroying the instances is b/c we CANNOT trust or know
where the buildrequirements are coming from. We have to assume that the
system could have been compromised by a %post script in a buildreq
running as root on the builder.

This is identical to how PPAs work, afaik. The user is taking a risk -
that's just how it is. 

We are not offering pristine builds, nor are we offering any guarantee
that the set of pkgs that these pkgs were built from are not trojanned
or compromised. The whole point is that people want to be able to build
arbitrary stuff and the majority of people are trustworthy and not out
to get anyone.

Which, for the record, is the case.

-sv


More information about the copr-devel mailing list