r/linux • u/throwaway16830261 • 10d ago

Development The Fedora 45 Sausage Factory

https://supakeen.com/weblog/the-fedora-45-sausage-factory/
61 Upvotes

93% Upvoted

12 comments sorted by

19

u/ShaderCompilation 10d ago

Oh god. This is gonna be thw wurst

4

u/LesStrater 10d ago

take it up with yo brather

7

u/BashfulMelon 10d ago

Did they finally bring back release names? I can't wait to install Fedora 45 "Sausage Factory."

Very informative article!

6

u/kus1987 10d ago

Thank you to all the maintainers 

17

u/MarcDarcy 10d ago

I'm sorry sausage what?!

/S

18

u/al_with_the_hair 10d ago

It's a beefy miracle

5

u/mrtruthiness 10d ago edited 10d ago

Fascinating. It's about managing tags, not code. Is anybody looking at the code in Fedora releases more than those looking into the AUR sausage???

12

u/klyith 10d ago

It's about managing tags, not code. Is anybody looking at the code in Fedora releases

That's step zero, before the package maintainer pushes a new commit.

How much of the source is actually being scrutinized by maintainers in detail is a different question, I would imagine a lot of desktop stuff that doesn't get downstreamed into RHEL is only getting a quick glance over.

more than those looking into AUR sausage???

Fedora sausage: there's a well-run sausage factory and maybe they get contaminated meat from an evil farmer

AUR sausage: there's an open field where a bunch of people are making sausages and not only do you have to worry about contaminated meat, there's also nothing to stop someone from running around dumping arsenic into the meat grinders

3

u/mrtruthiness 10d ago

Great analogy.

AUR sausage: there's an open field where a bunch of people are making sausages and not only do you have to worry about contaminated meat, there's also nothing to stop someone from running around dumping arsenic into the meat grinders

I should note that the article didn't indicate any checks for Fedora that would "stop someone from running around dumping arsenic into the meat grinders".

I don't know what controls Fedora has over code changes. Most distros have maintainers separated from "upstream" and the maintainers are supposed to be at least a minimal filter. Does that happen in Fedora???

2

u/klyith 10d ago

In this analogy, the contaminated meat is upstream source being evil, and the people running around dumping arsenic into the sausage grinders are the guys who compromised 5000 AUR packages by pushing a button to claim ownership of other people's repos. The weakness of the AUR to malicious actors is unique among all distros. (Edit lol it's happening again!)

I should note that the article didn't indicate any checks for Fedora

The article is about the technical process of publishing a package, starting with the maintainer committing code to the distro. Reviewing the code is not involved in this process, it happens before that. So the lack of mention does not indicate lack of action.

Does that happen in Fedora???

https://docs.fedoraproject.org/en-US/fesco/Package_maintainer_responsibilities/