On Wed, May 31, 2023 at 07:32:09PM +0200, Vitaly Zaitsev via devel wrote:
> On 31/05/2023 19:24, Daniel P. Berrangé wrote:
> > Can you point to the specific guideline that this violates ? I know we've
> > always expected that apps are built from pristine upstream source, but I'm
> > not finding the specific guideline that describes this right now.
>
> This:
>
> > All program binaries and program libraries included in Fedora packages
> > must be built from the source code that is included in the source
> > package.
>
> Source:
>
> https://docs.fedoraproject.org/en-US/packaging-guidelines/what-can-be-packaged/#prebuilt-binaries-or-libraries
So the important think there is the justification for why this policy
exists:
[quote]
This is a requirement for the following reasons:
Security: Pre-packaged program binaries and program libraries not built
from the source code could contain parts that are malicious, dangerous, or just
broken. Also, these are functionally impossible to patch.
Compiler Flags: Pre-packaged program binaries and program libraries not
built from the source code were probably not compiled with standard Fedora
compiler flags for security and optimization.
[/quote]
The proposal still satisfies the "Security" reasons. The also still
satisfies the "Compiler Flags" reason, albeit by using flags from an
earlier Fedora release. In any case, packages can already opt-out of
Fedora compiler flags at any time they wish.
Overall I'd say the JDK proposal still meets the spirit of the stated
guidelines and would be reasonable for FPC to approve as an exception.
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
