[OE-core] PRServer's problem

[Robert Yang]

On 05/19/2016 05:45 PM, Richard Purdie wrote:
>
> The bottom line is that the system is setup to be sensitive to changes.
> Where we've had cases where we haven't reacted to changes, people have
> complained and we've ended up making sure we do react to them. The
> patch you reference was one such case where users complained we didn't
> react enough.
>
> You can't have things both ways, where it reacts to all changes but
> also never reacts to changes which don't have any visible effect on the
> end result (how do you know?).
>
> The binary diff tool is likely going to be the only way to ultimately
> control a binary package feed and is still the only way I can see of
> solving this problem. I'd love some help on making that work. Making
> deterministic binaries is a large part in making that tool effectively
> ultimate and we had some great work on that in the last release.
>
> To be really clear, OE-Core will not have a different signature policy
> on release branches since that differing policy would break user
> expectations and also wouldn't get tested apart from on the branch so
> we'd have less confidence it was working.

Yes, I agree with this, I just used stable release as an example (big
changes won't happen on a stable release).

>
> Users are free to set their own policies, the system was designed to do
> that. If WindRiver wants to have a much more permissive policy, I'm
> more than happy for them to do so.

Thanks, frankly speaking, not only WindRiver wants this. After cloud
computing and virtualization gets hot, more and more users want to
customize their own images (for saving disk space, memory and security
reason), oe/yocto is very good at customizing images, so more and
more people try to use it to build their own distros, where live
upgrades becomes very important.

// Robert

>
> Cheers,
>
> Richard
>