openstack team mailing list archive

[Thomas Goirand <thomas@xxxxxxxxxx>]

On 08/25/2011 05:00 AM, Monty Taylor wrote:
> - PPAs do not allow me to upload packages to be built for wheezy or
> squeeze nor host them.
> - We need to provide a set of packages that someone who is basing their
> environment on squeeze can be assured will work.
> - We will be maintaining backported dependency packages from now until
> the cows come home.

As I wrote, I did that already, and I'd be very happy to continue doing
so in a more official channel. If you want a simple script for
maintaining a Debian repo AND a yum repo, here's what we use internally:

http://git.gplhost.com/gitweb/?p=mgmt-scripts.git;a=blob;f=scripts/scan_archive;h=db7647732b989b35ae7d8a48c80a48ecf67e4612;hb=c61a4daf9c7795d9f328e1d0d51dd76d45295c38

If someone wants to use one of the packaged alternatives, that's fine
too, but this involves more work.

For the RPM repository, the issue is that *packages* have to be signed,
not the Release file. What we do here is that we have a build machine
that holds the packages to be uploaded, then we use this script that
uses rsync over ssh to sign the packages:

http://git.gplhost.com/gitweb/?p=mgmt-scripts.git;a=blob;f=scripts/yum-pull-sign-createrepo;h=398465beeeec98a123b938e8600019b4a4210c00;hb=c61a4daf9c7795d9f328e1d0d51dd76d45295c38

It's a bit hackish, but it works, and we found it safer to have a
virtual machine just for signing packages with nothing else installed.

> If you (or I) do a one-off backport, we then upload a source package and
> then, often, don't shove the code anywhere. That's because a lot of the
> time it's easiest just to do dget, hack version, debuild -S, dput.

Outch! Bad habit. Better do:

git checkout upstream-squeeze-backport
git cherry-pick -x <sha256-sum>
git push
git-buildpackage <branch-definitions>
cd ..
dput *.changes

IMHO, that's not much more work, and at least, you're keeping a track of
what you're doing. It should always be done this way, in an idea world.

Cheers,

Thomas