On Jul 22, 2010, at 4:49 PM, Charlie Brady wrote: > > You apparently know exactly what they do, via some combination of > intuition, personal experience and gossip collected at conferences. But > that doesn't make it an open process, and doesn't make it well known. > Well that also doesn't make it a closed process (other than I haven't bothered to implant an http intracranially). In fact you asked a question and I tried to provide some reasonable answers. But what -- in fact -- are you asking for? You want which of the following: a) instant release of @redhat.com "security" releases through CentOS? b) a documented process flow for what is involved with a "security" release c) a reliable ETA for CentOS security xies d) the ability to participate in CentOS testing e) more community involvement in CentOS f) a whole different distro management team, or even a whole different distro g) something else ... ? >>>> There's nothing stopping anyone from grabbing the sausages in the >>>> "security release", building, installing, testing, and reporting >>>> "worksforme" to assist in expediting a "security release". >>> >>> I'm not sure how that would help. We already know that Red Hat have built >>> and presumably tested these packages. If I say that I've built and tested >>> them, does that churn them through the CentOS process any quicker? Does >>> it add any assurance to the packages *as built by CentOS*? >> >> And again there's the assumption that there's nothing to do because the >> release process is just cookie cutter gear turning. > > There's no such assumption. My assertion is that me building something on > my dev system does nothing to accellerate the production of binaries by > CentOS. > Apologies for not carefully reading. My guesstimate (fwiw) is that assistance rebuilding packages, with credible (as in at least summarize what you did) WORKSFORME, particularly on odd-ball corener cases like z390 and or ppc, will not only help expedite a CentOS security release, but also earn you (at a bare minimum) a thank you! from CentOS developers. I'm quite sure that someone will correct any detail that I have mis-guessed (based solely on my personaly/private/closed experiences). >> The reality is quite different in my experience (but second-hand, I've >> never personally experienced the CentOS "security" release process). > > The key questions, Jeff, are whether the process can be improved, and if > so, how? Statements about how complex the process is or might be don't > help. Neither do suggestions that we all go home and do it ourselves. I hardly said "Go home and do it yourself" by any stretch of the imagination. All processes can be improved. You started this thread by claiming not to know the process. Figger the CentOS process, and you will know how it can be improved. And the process (generally) for "security" releases is not that hard to learn. The CentOS process is no different. 73 de Jeff