Re: [Gnu-arch-users] Arch Roadmap Draft (the anticipated part 3)

[John Meinel]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Peter Conrad wrote:

| Hi,
|
| On Mon, Jul 05, 2004 at 09:33:32PM -0400, James Blackwell wrote:
|
|>1. if necessary, register the submitted archive
|>2. get the stated changeset
|>2. generate a diff report from the changeset
|>3. record the patchlogs
|>4. get the development head (ex. address@hidden/tla--devo)
|>5. apply the changeset against the development head
|>6. attempt to compile the now modified dev. head and record results
|>7. perform make test and record results
|
|
| steps 6 and 7, when run automated and unattended, will allow the execution
| of arbitrary code on the "merge tracker" machine. IMO patches *must* be
| reviewed by a human before they're compiled.
|
| Bye,
|       Peter

Well, if you validate your submissions first, meaning you only allow
people with a proper gpg signature or that sort of thing, then it
shouldn't be as much of a problem.

It also might be possible to run "make test" in a chroot environment. Is
there any reason why everything after "apply the changeset" couldn't be
walled off from the rest of the world?

But I agree, you probably should do something about it. But it would be
really nice to have it as automated as possible so you can know what's
going to happen when you want to merge.

Also, I think this is comparing to the CVS model, where anyone checks in
anything anyway, and then when a developer comes along to "make test" it
could hose all of their systems.

John
=:->


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Cygwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFA6sd3JdeBCYSNAAMRAhSIAJ9mKOTtuALx+yPaA6EQATtLkHmAuQCgoTN1
Ha9KRlLS/ZgBi6k15DOs0uY=
=dKnN
-----END PGP SIGNATURE-----