Re: [avr-libc-dev] savannah audit

[Theodore A. Roth]

On Fri, 26 Dec 2003, Daniel wrote:

> Can I float a question/suggestion to try and ease this audit process
> (if it ever happens again)
> 
> Taking into account that I (and probably others) have all email's
> sent to avr-libc-dev stored locally dating back to 29 Aug 2002
> (uncompressed only 8.5M)
> 
> Would it be a good idea to require all applied diff's to also be sent
> to the mailing list? (labeled/signed as applied by * )
> 
> and/or have a regular script that generates diff's and email's to the list.
> 
> Just my 2 cents worth to raise the ideas.

Thanks for bringing this up.

I've already considered setting up a new mailing for just this purpose.  
Just haven't had the opportunity to bring it up. ;-) I was thinking about
making it a publicly readable list, but only those with commit access could
post to it. I guess it should be publicly subscribable so that it can be 
mirrored by anyone interested. Of course the archives would always be 
publicly available.

There would probably need to be some ground rules for posting the patches. 
I'd personally like to see the following:

  * Subject should obviously state the basics of what the patch does.
  * The ChangeLog entry should be in the body of the message.
  * The diff should be either a plain text or gzipped file posted as an 
    attachment to the message. If this is done, then archiver on savannah 
    will make the attachment downloadable as a link. This is really nice 
    since it allows for downloading of the patch without loosing the 
    original formating. Posting diffs in the body of the message is prone to 
    the formatting whims of the individual's email client.
  * Attach a pgp signature or an md5sum for the patch. This should enable us 
    to be certain that the patch has not been modified since being posted. 
    Having a pgp signature is probably preferrable.

How does that sound?

I'm not going to move on this yet, since we still don't know what the
savannah folks are going to do. Since they have said that we will need to
pgp sign any cvs commits, they may already have something in mind that will 
negate the need for the proposed mailing list.

Ted Roth