Mailing-List: contact infrastructure-dev-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: infrastructure-dev@apache.org
Received-SPF: pass (nike.apache.org: local policy)
Date: Tue, 26 Mar 2013 13:49:38 +0200
From: Daniel Shahaf <d.s@daniel.shahaf.name>
To: =?iso-8859-1?Q?J=FCrgen?= Schmidt <jogischmidt@gmail.com>
Cc: infrastructure-dev@apache.org
Subject: Re: Official code signing certificate
Message-ID: <20130326114938.GF2647@tarsus.local2>
References: <20130321120932.GA3496@lp-shahaf.local>
 <514AFDE8.2000000@gmail.com>
 <20130321130639.GA3607@lp-shahaf.local>
 <CAP-ksoin7mvcSHMfHyDuMq+73Dfp2k2qTHwkoRG_sVBcTYa9_A@mail.gmail.com>
 <20130321221814.GB16395@tarsus.local2>
 <CAP-ksogp8rABcXv2wg3cUqbTUu4imK-3w4kP-qzy20Dv_GBr0Q@mail.gmail.com>
 <20130322165713.GJ3216@lp-shahaf.local>
 <CAP-ksojSQd4p+UyrJNL98giX1hpJ=MYCdtHG5DiLB4DDGUSvYw@mail.gmail.com>
 <20130325225606.GH3015@lp-shahaf.local>
 <51516D29.2040408@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <51516D29.2040408@gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)

J�rgen Schmidt wrote on Tue, Mar 26, 2013 at 10:40:57 +0100:
> On 3/25/13 11:56 PM, Daniel Shahaf wrote:
> > Well that works but it has more moving parts: the artifacts need to
> > encode the path@rev they were built from and then the build process has
> > to extract those.  Also the build process uses a new working copy so
> > it'll rebuild everything from scratch: that (a) takes longer,
> > (b) subjects you to the risk of upgraded system dependencies (libc, gcc,
> > etc.) used in the new build.
> 
> the baseline of the dedicated build machines should be maintained
> carefully. We for example build on special Linux systems to ensure that
> our binaries are worked on as many as possible Linux distros.
> 

Well I'm not sure how possible that is.  We do need to do OS upgrades
sometimes, and if sufficiently many projects use the facility we'll
almost always have one within the "built, but not built-with-cert"
window yet.

IOW I don't like the idea of projects being a blocking factor for doing
OS upgrades.  That will never work.

Can one of the buildmasters weigh in here?

> We in AOO retrieve already the svn revision during the build process and
> put this information in the about dialog for reference. And we retrieve
> "Last Changed Rev: *******" in our AOO related tree to avoid confusion.
> 

You should use svnversion output, 'Last Changed Rev' won't deal with
three different conditions that svnversion does deal with.  (_if_
svnversion output =~ /^\d+\n?$/, you can then use the 'Last Changed Rev'
if you prefer that.)

> > 
> > Can you write this all down somewhere?  A wiki page maybe, or a *.txt
> > file under (a new dir under)
> > https://svn.apache.org/repos/infra/infrastructure/trunk/projects/
> > (world-readable subtree).
> 
> everybody is free to extend additional information on the already
> started wiki page http://wiki.apache.org/general/ASFCodeSigning
> 
> I don't think we need a further one

+1

Amended request: add the agreed-upon details from this thread to that
page.

> By the way this page is not new and was proposed weeks ago to collect
> requirements and general information.  One reason why I have restarted
> the discussion in this thread.