[Bug 569] please gpg-sign repomd.xml files, enable repo_gpgcheck=1 in yum .repo files

[Thorsten Leemhuis]

On 08.04.2010 15:07, Michael Schwendt wrote:
> On Sun,  4 Apr 2010 21:25:51 +0200, RPM wrote:
>> http://bugzilla.rpmfusion.org/show_bug.cgi?id=569
>> --- Comment #10 from Thorsten Leemhuis 2010-04-04 21:25:50 ---
>> (In reply to comment #9)
>>> Is this problem fixed ?
>> I would not call it a problem, more a RFE -- for something that even Fedora
>> sill doesn't do iirc
>> but whatever: seems this is one of the dozens of things in RPM Fusion that
>> really would be nice to fix or improved, without anybody working on it :-((
>> (and most of the other things that need to get improved are way more important
>> IMHO)
> RFEs like this are in need of _somebody_ to make decisions.

I would agree for most RFE's.

But not for this specific RFE: There is (afaics) no real downside for
users. So there is not much to discuss IMHO, it just needs somebody to
do it and work out the details -- and start a privte or public
discussion in case problems emerge where a discussion and a decision is
needed.

But discussing that without knowing that anybody will work further on it
seems like a lot of wasted time for me.

> [...]
> A fundamental problem with RPMFusion is that at the management level there
> is no work-horse to "just do it", i.e. to decide on something and work
> with contributors on feasible solutions.

I partly did that in the past, but as I said multiple times: I don't
want to anymore for now and I'm willing to support individuals or
(preferred better) a group of people that want to take of steering and
"governing" RPM Fusion.

> Where something sucks, it needs
> somebody to say "we want to improve in that area" and to put something
> onto an agenda (or call it "wishlist").

Maybe yes, but in RPM Fusion that IMHO didn't help much until now, as we
are (afaics) to few people. Take the repoclosure scripts for example --
it now years ago was definitely planed to run them after each push and
you even did some groudwork to make it easy for our sysadmins to
integrate (thx again for that), but they never got installed on our
servers (and there were many situations where the lack of automated
repoclosure scripts was discussed on this list, so it was never really
forgotten).

Cu
knurd