7:55 p.m.
On Sat, Dec 17, 2016 at 2:54 AM, Ralf Corsepius <rc040203(a)freenet.de> wrote:
A package, which downloads/side-loads stuff from sources out of
Fedora and
operates outside of rpm's control is not acceptable in Fedora (and should
not be acceptable in RPMFusion, as well).
Then why does Fedora package pip, npm, etc, which only exist do to
precisely this? I'm not sure this is quite as cut-and-dry as you're making
it sound here.
Ben Rosser
12:05 a.m.
New subject: RPMFusion or Fedora?
I think Ralf refers to the rules for games and emulators simply because this is a game
application.
However, IMHO the answer here really depends the type of the database downloaded from the
server. If it's indeed something which can be compared to a game (as opposed to the
game engine) Ralf's reasoning certainly applies. OTOH, if the database is more like a
identity I don't see the problem packaging this in Fedora proper.
Overall, this seems complicated enough to raise questions from some people. Given this,
I'd recommend that you try to first package it in regular Fedora Because of the
discussion here you should make sure that you get a legal review in that context (raise
the legal review flag). This is the way to get a final decision. If it goes into fedora
all is fine. If not, it's still fine because then (and only then) you can move it to
rpmfusion, re-using the review and hopefully the reviewer if she is happy with that.
Cheers!
--alec
6:25 a.m.
New subject: RPMFusion or Fedora?
On Sun, 2016-12-18 at 00:05 +0000, Alec Leamas wrote:
> I think Ralf refers to the rules for games and emulators simply
> because this is a game application.
>
> However, IMHO the answer here really depends the type of the
> database downloaded from the server. If it's indeed something which
> can be compared to a game (as opposed to the game engine) Ralf's
> reasoning certainly applies. OTOH, if the database is more like a
> identity I don't see the problem packaging this in Fedora proper.
That's an interesting way to look at it. The software (Cockatrice) is
the "engine" that allows a person to play a game (Magic: The
Gathering). Though they claim to support a number of different card
games, I can't find much evidence to back that up.
The site hosting the database claims the following:
The JSON files contains data that is Copyright © Wizards of the Coast
- All Rights Reserved
> Overall, this seems complicated enough to raise questions from
some
> people. Given this, I'd recommend that you try to first package it
in
> regular Fedora Because of the discussion here you should make sure
> that you get a legal review in that context (raise the legal review
> flag). This is the way to get a final decision. If it goes into
> fedora all is fine. If not, it's still fine because then (and only
> then) you can move it to rpmfusion, re-using the review and
hopefully
> the reviewer if she is happy with that.
>
> Cheers!
>
> --alec
I think this is probably a decent approach. Thanks for the suggestions
everyone.
7:32 a.m.
New subject: RPMFusion or Fedora?
On 12/18/2016 01:05 AM, Alec Leamas wrote:
I think Ralf refers to the rules for games and emulators simply
because this is a game application.
Not quite. I am primarily looking at this from the angle of "distro
integrity" and "system security".
That said, I consider any package
- "calling home" to be violating "data privacy"
- "downloading something" to a security risk.
- installing something outside of rpm's control to be non-maintainable.
However, IMHO the answer here really depends the type of the
database downloaded from the server.
I don't know anything about this game, but my gut feeling is the risk
such a game implies should be considered inacceptable.
Can you exclude these game files can be abused for viruses, troyans and
other backdoor? Can you exclude these servers doesn't spy at you or
collect personalized data? I don't think anybody can.
Anyway, in Fedora, we in general mandate "call homes" to be removed and
mandate packages to be "self-contained".
Ralf
2926
days inactive
2931
days old
rpmfusion-developers@lists.rpmfusion.org
3 comments
4 participants
participants (4)
-
Alec Leamas -
Ben Rosser -
Link Dupont -
Ralf Corsepius