Message-ID: <1341835813.9579.18.camel@lenovo01-laptop03.gunduz.org>
Subject: Re: Linux Downloads page change
From: Devrim =?ISO-8859-1?Q?G=DCND=DCZ?= <devrim@gunduz.org>
To: Simon Riggs <simon@2ndQuadrant.com>
Cc: Dave Page <dpage@pgadmin.org>, Magnus Hagander <magnus@hagander.net>,
	Scott Mead <scottm@openscg.com>, "pgsql-www@postgresql.org"
	<pgsql-www@postgresql.org>
In-Reply-To: 
 <CA+U5nMJqmeepcZ1vg24UrHHtKC+zXjgSy-u-peRmJNW2EFJy-A@mail.gmail.com>
References: 
 <CAKq0gvKgeckkBa0xm6xsrmNvk=Cm6zPP4n1O3CQCvDUvCYCs8w@mail.gmail.com>
	<CABUevEyONmEeqwU4VJgs8vTV3yW3dsNLPiFfPnAKJOCLgYbvYA@mail.gmail.com>
	<CAKq0gvL-s4_Mk0ztGh+yywH5v4Jvnm2Fs2k-gq2wcrW+kfY2xQ@mail.gmail.com>
	<1341692590.1122.1.camel@lenovo01-laptop03.gunduz.org>
	<2476F91B-A1B2-45DA-96EB-8F33C79A0E05@openscg.com>
	<1341781012.3451.0.camel@lenovo01-laptop03.gunduz.org>
	<CA+OCxoxExqHx_ZNRpvmJpVoNCOa9yO4C3HTZ4Ob7e32Wn2+fcQ@mail.gmail.com>
	<CABUevEzm09To=uzW=+F==G98HK2YZNXsXwv+NW-7uOgqGLOxoQ@mail.gmail.com>
	<CA+OCxox1pCaXvOeVmv0gECbXsOqGeXQL-O2QsyWmFS9ZvCkjbg@mail.gmail.com>
	<CABUevEx_7-Xm+z5oc+61TuHzSbu34fWAKiRxAXjGwfCzff=OZA@mail.gmail.com>
	<CA+OCxoyGPVRQ+1tnxGuFS1JACr1QJUchS90qxXHuN_YTUNj8QA@mail.gmail.com>
	<CA+U5nMK86koEcfkBwUWRPqGTT1b8Qjp3hN=pk3to+kqaUoWp=w@mail.gmail.com>
	<CA+OCxoxxW3EOoLpWuTk=GW2Hr-Z+8m0_oN2QUQCMpVss6R+DDw@mail.gmail.com>
	<CA+U5nMKyzv6B7ywGv8BLfwig1wgimp0keo9rKUpaLpnANuiH+w@mail.gmail.com>
	<1341833486.9579.8.camel@lenovo01-laptop03.gunduz.org>
	<CA+U5nMJqmeepcZ1vg24UrHHtKC+zXjgSy-u-peRmJNW2EFJy-A@mail.gmail.com>
Content-Type: multipart/signed; micalg="pgp-sha1";
	protocol="application/pgp-signature";
	boundary="=-eKEc0nC1N35GjJyWQTcZ"
Date: Mon, 09 Jul 2012 15:10:15 +0300
Mime-Version: 1.0


--=-eKEc0nC1N35GjJyWQTcZ
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi

On Mon, 2012-07-09 at 12:41 +0100, Simon Riggs wrote:

> IMHO we should only list binaries on the postgresql.org website if
> they are derived from build information that is owned by the PGDG, or
> at very least publicly available at the time of the build and likely
> to remain so afterwards.

I agree with this.

> That process should be automatic as far as possible, to minimise
> error, since the number of users of those binaries is now very large.

*Community RPMs* are more or less automated: There are some steps that
has to be done manually: Updating spec files, signing RPMs, performing
QA and then pushing to the repositories. Currently, when we build an
RPM, it passes through 3 separate tubes until it reaches final position.
We do the QA on first two tubes, since the last rsync is just a mirror
of the staging repository.

> Unverifiable binaries are a quality and security risk to the project.

Agreed -- and that is what me, Dave, etc., also think.

Regards,
--=20
Devrim G=C3=9CND=C3=9CZ
Principal Systems Engineer @ EnterpriseDB: http://www.enterprisedb.com
PostgreSQL Dan=C4=B1=C5=9Fman=C4=B1/Consultant, Red Hat Certified Engineer
Community: devrim~PostgreSQL.org, devrim.gunduz~linux.org.tr
http://www.gunduz.org  Twitter: http://twitter.com/devrimgunduz


--=-eKEc0nC1N35GjJyWQTcZ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEABECAAYFAk/6yiUACgkQtl86P3SPfQ5Y1ACfWGvNgxtWIxAR+yAlHf3WDaS4
Sd0An3QCewFkxsYyQQ6QaHevOm+APQdO
=z3mi
-----END PGP SIGNATURE-----

--=-eKEc0nC1N35GjJyWQTcZ--