two questions

[John Pye]

Hi all,

I have contributed two packages now, and I have some questions that
don't seem to have been clearly addressed in a way that I've actaully
understood:

(1) after my package review, I get to add my files to CVS and build the
package that ultimately gets into Fedora. What is to stop me from
uploading something subtly (or even maliciously) different from the
files that were actually reviewed? Thinking about that, wouldn't it be
better if CVS access (or some other kind of controlled file space) were
used from the *start* of the package review process, rather than only at
the end?

(2) once my package is uploaded at it gets the NEXTRELEASE status, how
does my package, which is currently shown with
'dist-fc7-updates-candidate' tag in koji, end up eventually in the
Fedora Updates repository? Are there more steps that I need to follow?
Is there some other review happening?

Cheers
JP