<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 3 April 2017 at 10:53, Choong, Yin Thong <span dir="ltr"><<a href="mailto:yin.thong.choong@intel.com" target="_blank">yin.thong.choong@intel.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-674909240707529295WordSection1">
<p class="MsoNormal"><a name="m_-674909240707529295__MailEndCompose"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">Hi,<u></u><u></u></span></a></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(31,73,125)">The link seem like create by an individual, no a company or group. Therefore, we decide to drop this link and go for <a href="http://yoctoproject.org/mirror" target="_blank">yoctoproject.org/mirror</a>.</span></p></div></div></blockquote><div><br></div><div>This is true, there's not that much in the repo itself to create trust. The major show of trust is here though: <a href="http://pkgs.fedoraproject.org/cgit/rpms/logrotate.git/commit/?id=9cb55142e51b82085d6c3136448c1f441454e351">http://pkgs.fedoraproject.org/cgit/rpms/logrotate.git/commit/?id=9cb55142e51b82085d6c3136448c1f441454e351</a></div><div>Fedora/Red Hat themselves changed to use this repo when the fedorahosted repos were EOL'd (see also Red Hat folks working on the github issues in January).</div><div><br></div><div>If the release tarballs have been re-generated and the hashes no longer match, I'd still prefer modifying the recipe to use github (after manually diffing to make sure they are the same source release of course) but I can understand a differing viewpoint in this case.</div><div><br></div><div><div>It would be good to mention the issue in the commit message, whichever way this is solved.</div><div><br></div></div><div>Thanks,<br></div><div> Jussi</div><div><br></div><div><br></div></div></div></div>