On Tue, Nov 22, 2005 at 04:32:47PM -0600, kfogel@collab.net wrote:
> mark benedetto king <mbk@lowlatency.com> writes:
> > On Tue, Nov 22, 2005 at 04:12:52PM -0600, kfogel@collab.net wrote:
> > > mark benedetto king <mbk@lowlatency.com> writes:
> > > > Should we independently export and verify that the release tarball
> > > > is a true copy of the tag before signing?
> > >
> > > I actually diff it against the release branch and make sure (with
> > > Emacs' help, esp M-x delete-non-matching-lines) that all differences
> > > are expected and innocuous. I suppose I could diff against the tag
> > > too.
> >
> > Right, a branch WC is more likely to be handy, and your process serves
> > the same purpose. Perhaps we should make this an explicit step,
> > though, so that signers understand what their signature should entail.
>
> Again, I think: let's just recommend it, and tell people to always
> state in their signature post exactly what testing/verification they
> did. (I didn't state the tree comparison step in my sig mail because
> I haven't actually done it yet, though I will later tonight.)
>
> IOW, a signature should mean "I certify that the following things are
> true about this tarball: X, Y, Z." It's up to the poster what X, Y,
> and Z are, and it's up to us as a community whether the union of
> everyone's different Xs, Ys, and Zs satisfies the requirements for a
> release.
>
I think that's a fine policy. Shouldn't it be documented somewhere,
perhaps as part of this patch?
--ben
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Wed Nov 23 02:01:55 2005