[OE-core] PRServer's problem

[Richard Purdie]

The bottom line is that the system is setup to be sensitive to changes.
Where we've had cases where we haven't reacted to changes, people have
complained and we've ended up making sure we do react to them. The
patch you reference was one such case where users complained we didn't
react enough.

You can't have things both ways, where it reacts to all changes but
also never reacts to changes which don't have any visible effect on the
end result (how do you know?).

The binary diff tool is likely going to be the only way to ultimately
control a binary package feed and is still the only way I can see of
solving this problem. I'd love some help on making that work. Making
deterministic binaries is a large part in making that tool effectively
ultimate and we had some great work on that in the last release.

To be really clear, OE-Core will not have a different signature policy
on release branches since that differing policy would break user
expectations and also wouldn't get tested apart from on the branch so
we'd have less confidence it was working.

Users are free to set their own policies, the system was designed to do
that. If WindRiver wants to have a much more permissive policy, I'm
more than happy for them to do so.

Cheers,

Richard