MIME-Version: 1.0
In-Reply-To: 
 <CA+OCxozWwq4Hy-=epq2bn5StPVJ0PSt_Ejx0SDBd_Brcmtf63g@mail.gmail.com>
References: 
 <CAKq0gvKgeckkBa0xm6xsrmNvk=Cm6zPP4n1O3CQCvDUvCYCs8w@mail.gmail.com>
	<CABUevEyONmEeqwU4VJgs8vTV3yW3dsNLPiFfPnAKJOCLgYbvYA@mail.gmail.com>
	<CAKq0gvL-s4_Mk0ztGh+yywH5v4Jvnm2Fs2k-gq2wcrW+kfY2xQ@mail.gmail.com>
	<1341692590.1122.1.camel@lenovo01-laptop03.gunduz.org>
	<2476F91B-A1B2-45DA-96EB-8F33C79A0E05@openscg.com>
	<1341781012.3451.0.camel@lenovo01-laptop03.gunduz.org>
	<CA+OCxoxExqHx_ZNRpvmJpVoNCOa9yO4C3HTZ4Ob7e32Wn2+fcQ@mail.gmail.com>
	<CABUevEzm09To=uzW=+F==G98HK2YZNXsXwv+NW-7uOgqGLOxoQ@mail.gmail.com>
	<CA+OCxox1pCaXvOeVmv0gECbXsOqGeXQL-O2QsyWmFS9ZvCkjbg@mail.gmail.com>
	<CABUevEx_7-Xm+z5oc+61TuHzSbu34fWAKiRxAXjGwfCzff=OZA@mail.gmail.com>
	<CA+OCxoyGPVRQ+1tnxGuFS1JACr1QJUchS90qxXHuN_YTUNj8QA@mail.gmail.com>
	<CA+U5nMK86koEcfkBwUWRPqGTT1b8Qjp3hN=pk3to+kqaUoWp=w@mail.gmail.com>
	<CA+OCxoxxW3EOoLpWuTk=GW2Hr-Z+8m0_oN2QUQCMpVss6R+DDw@mail.gmail.com>
	<CA+U5nMKyzv6B7ywGv8BLfwig1wgimp0keo9rKUpaLpnANuiH+w@mail.gmail.com>
	<1341833486.9579.8.camel@lenovo01-laptop03.gunduz.org>
	<CA+U5nMJqmeepcZ1vg24UrHHtKC+zXjgSy-u-peRmJNW2EFJy-A@mail.gmail.com>
	<CA+OCxozWwq4Hy-=epq2bn5StPVJ0PSt_Ejx0SDBd_Brcmtf63g@mail.gmail.com>
Date: Mon, 9 Jul 2012 15:50:22 +0100
Message-ID: 
 <CA+U5nMJK9tqQ8L299nuZw_hrL-4COy1CnWdJAXSrczzNyqfqRg@mail.gmail.com>
Subject: Re: Linux Downloads page change
From: Simon Riggs <simon@2ndQuadrant.com>
To: Dave Page <dpage@pgadmin.org>
Cc: =?ISO-8859-1?Q?Devrim_G=DCND=DCZ?= <devrim@gunduz.org>,
	Magnus Hagander <magnus@hagander.net>, Scott Mead <scottm@openscg.com>,
	"pgsql-www@postgresql.org" <pgsql-www@postgresql.org>
Content-Type: text/plain; charset=ISO-8859-1

On 9 July 2012 13:05, Dave Page <dpage@pgadmin.org> wrote:

> Right - that's more or less what's been discussed and agreed. The
> issue with the installers that Magnus raised, is that at present I
> manually push the canonical GIT repo to git.postgresql.org, and often
> forget to do it until reminded. That was raised in response to my
> comment that the OpenSCG build scripts are not currently public at all
> as far as I could see, and should be if their work is to be listed on
> postgresql.org's primary downloads page.

It's not more or less. What you have said is not the same thing as I
have requested.

If it was done as I suggest, when you forget a step in the process
then the process would fail.

If you build from the public repo then you simply can't forget.


>> Unverifiable binaries are a quality and security risk to the project.
>
> In theory. In practice it seems unlikely anyone would ever take the
> time and energy to build them themselves and actually verify them -
> the effort to do so would be huge (for example, assembling the 9.2
> build machine for the installers and building all the necessary
> dependencies for all the supported platforms etc. has so far taken a
> number of man weeks). To verify the binaries we put out, someone would
> have to build an exact mirror of that environment. That's not to say
> it shouldn't be possible of course. In fact, it wouldn't even be
> possible, as we digitally sign some of the executables to appease
> Windows, and we obviously cannot share that certificate.

I know multiple users (aside from 2ndQuadrant) that re-build their own
binaries as a safety barrier in their release process, so I don't
believe the effort level is that high, nor do I believe people won't
do it. I take your point that it is maybe only 1% of people, but those
are the ones that report all the bugs.

The most important thing is that people can see the ingredients before
they eat the food.

-- 
 Simon Riggs                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services