updates-testing --> updates policy discussion

[Warren Togami]

Massive headache...

Jesse Keating wrote:
> On Thursday 08 January 2004 16:15, Warren Togami wrote:
> 
>>http://www.fedora.us/wiki/PackageSubmissionQAPolicy
>>We need to discuss how to change this procedure for Legacy specific
>>packages.
> 
> 
> Post message to either "fedora-legacy-announce" or "fedora-legacy-devel" 
> about a suspected vulnerability or bugfix that you'd like to fix.

I agree with fedora-legacy-devel, but fedora-legacy-announce is for 
official announcements of the Legacy project, like security advisories 
only.  Right?  Well that's what I would expect anyhow...

> 
> Use "FedoraLegacy Package Naming Guidelines" instead of generic 
> fedora.us guidelines

Of course.

> 
> Fix the numbering scheme... 1,2,3,4,1,2,3,4 ?  why start over?  Move the 
> signing from before the optional rpmlint to after the option rpmlint.
>

The formatting of the document isn't important in this discussion.  The 
actual process is.

> 2 initial keywords.  "updates-testing" or "updates", and "security" or 
> "bugfix" to indicate what type of update it is.
> 
> Change "fedora-package-announce" to "fedora-legacy-announce".
> 

Exactly.

> 
>>We also need to change the definition of "trusted" for Legacy
>>specific packages, along with the requirements for reaching the
>>"trusted" status.
>>
>>Thoughts?
> 
> 
> Trusted could be a term given to those developers who've put forth and 
> followed through with a certain number of security fixes in packages.  
> I'd say untrusted == 0-5, semi-trusted == 6-9, trusted == 10=+.  A 
> package can inherit it's trusted status from the developer who puts if 
> forth.  Now where we use the term or what it really means to the end 
> users is yet another point of discussion.
> 

I'm not sure how to respond here except to say I have a bad feeling 
about this.  I am realizing that it was a bad time to ask this specific 
question.

Giving hard numbers for thresholds of "trust" IMHO is a mistake.  You 
cannot earn "trust" by mechanically doing a set number of tasks.  It 
could even be dangerous to make such a policy.

"Trust" is something that you earn through dedication and hard work. 
Trust is not something that can be given cold, quantized numbers.

http://www.fedora.us/LEGACY

These are the folks that gain trust.  Those who spend hours doing boring 
work of porting patches, building and testing packages for a lazy 
userbase waiting for a free lunch - someone else to do the work for them.

Hard work and dedication is what built the "trusted" group in the 
original fedora.us project, and I would suggest doing the same here.

Follow the process, and review the patches.  That is the only way we can 
get these packages published.

Warren