[Fedora-packaging] No pre-built applications rule

[Toshio Kuratomi]

On Sun, 2006-09-17 at 11:16 +0100, Paul wrote:
> Hi,
> 
> > It's come to my attention that we don't have a "Packages must be built
> > from source, no precompiled binaries" rule in the current guidelines.  I
> > think this is an oversight as the Binary Firmware section:
> > http://www.fedoraproject.org/wiki/Packaging/Guidelines#BinaryFirmware
> 
> I have a problem with that and it's called ikvm (one of the mono
> packages). It cannot be built from source as FE or FC doesn't have the
> bits in yet (I looked into it a while back, but it's beyond my knowledge
> to do things with java stuff that needs bringing in). The package that
> was accepted is prebuilt.
> 
I think this package shouldn't have made it through review.
Packaging/Mono clearly prohibits this already.  (It appears to have been
reviewed before the Guidelines were updated, though.)

The ikvm that's in cvs right now doesn't even include java or C# source.
Since it's licensed under the GPL, that's a sticky legal consideration
on top of the technical considerations.

> If ikvm comes out, then quite a number of the other mono packages in FE
> will be broken.
> 
Not sure what to do with packages that are already in (whether they
should be grandfathered or given a time limit to be fixed.)  I lean
towards a time limit to be fixed.

> However, I do agree that *new* packages should be covered by the "from
> source" only with a caveat that as soon as practicable, those already in
> are moved to source compiles.
> 
Packaging situations like ikvm are exactly what the Guidelines should be
preventing.  For python, mono, and other things that are compiled to a
more machine efficient form, this makes sure the byte code on the
machine comes from the auditable source.  (python can be fooled by
changing timestamps.  mono is just like any other compiled language)
Additionally, for C, C++, and native java this makes sure we compile
with FORTIFY_SOURCE for enhanced security.

-Toshio
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/fedora-packaging/attachments/20060917/0a1ebdac/attachment.sig>