[rhn-users] repositories of trust?

[Hiren Patel]

hi all,

apologies if this is not directly rhn related, but using the same tools
on other repositories might make it somehow related, at least i hope so.

i have a scenario where i require packages not provided by rhn, and have
been thinking that the best way to use packages from external sources on
production machines is to setup a build system of the same type to the
production machines, download srpms, verify scripts and program sources
using digital signatures etc, build and use.

there are two issues, one being that some environments don't always have
the resources to monitor these external packages for updates, run
through the whole build process and testing process etc, second issue
being that this cannot be automated easily enough.

my question then is what external repositories do some of the folk use?
simply configuring machines to use external repositories release this
entire process off the system admins in an environment i would think,
but to what level can one trust these sources for good maintenance,
regular and timely updates etc. 
i know there are a few popular ones such as DAG.
any advice would be appreciated.

the other question, to what level would one steer off course on
insisting that packages being used from external sources are
compiled/built on the same distribution etc, for example for RHEL, my
guess is that the next best thing would be EPEL, then maybe Centos
extras/addons/contrib, then maybe fedora.. etc. how is this determined
or planed by some?

and one last question, how would one determine what version of fedora a
RHEL release is based off? if package finding goes all the way down to
fedora, i would imagine using packages from the release of fedora, that
the version of RHEL one is using, is based off, would be the best way to
go.

any comments/suggestions/advice would be much appreciated.

thanks.

-- 
Hiren Patel

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This e-mail and its contents are subject to the Telkom SA Limited
e-mail legal notice available at 
http://www.telkom.co.za/TelkomEMailLegalNotice.PDF
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~