http://bugzilla.novell.com/show_bug.cgi?id=503276 Adrian Schröter changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.pr |mls@novell.com |ovo.novell.com | -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 User bitdealer@gmail.com added comment http://bugzilla.novell.com/show_bug.cgi?id=503276#c2 --- Comment #2 from Stephan Kleine 2009-05-14 13:54:17 MDT --- Agreed, that might be quite some change (albeit late might be better than never). Anyways, how about we start to do that from Factory / 11.2 on? That way it should be an automatic transition and doesn't confuse anyone. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 User aj@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=503276#c4 Andreas Jaeger changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |mls@novell.com --- Comment #4 from Andreas Jaeger 2009-08-12 06:36:33 MDT --- Can we do this once we switch to 11.2 as separate distribution? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 User bitdealer@gmail.com added comment http://bugzilla.novell.com/show_bug.cgi?id=503276#c6 --- Comment #6 from Stephan Kleine 2009-08-26 09:39:11 MDT --- This has nothing to do with forking of 11.2 because it is the exact same issue with Factory. Simply do it for Factory ASAP and then of course also for all future releases (e.g. 11.2) but don´t do it for already released versions (e.g. 11.1) to avoid the problems Michael explained in #1. For factory it shouldn´t matter because people normally use dup instead of up there anyways which doesn´t block vendor changes. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 User bitdealer@gmail.com added comment http://bugzilla.novell.com/show_bug.cgi?id=503276#c8 Stephan Kleine changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P2 - High Status|RESOLVED |REOPENED Resolution|FIXED | --- Comment #8 from Stephan Kleine 2009-10-05 01:29:59 MDT --- Reopening cause it is still broken. E.g. "trac" from the "devel:tools:scm" repo has as vendor obs://build.opensuse.org/devel:tools which should be obs://build.opensuse.org/devel:tools:scm See rpm -qp --queryformat "%{VENDOR} \n" http://download.opensuse.org/repositories/devel:/tools:/scm/openSUSE_Factory... Another example: "kde3-amarok" from the "KDE:Backports" repo has as vendor obs://build.opensuse.org/KDE instead of obs://build.opensuse.org/KDE:Backports See rpm -qip --queryformat "%{VENDOR} \n" http://download.opensuse.org/repositories/KDE:/Backports/openSUSE_10.3/i586/... My point is that _every_ repository has to have an _unique_ vendor, otherwise one isn't able to specify that a package should come from that _1_ repo and nowhere else which will lead to trouble sooner or later. Proposed resolution: Simply use the _whoole_ repository name as vendor string without cutting the last part of. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 User adrian@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=503276#c10 Adrian Schröter changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | --- Comment #10 from Adrian Schröter 2009-10-18 23:50:04 MDT --- After discussing with bitshuffler on IRC: The problem here might be that it breaks the vendor stickyness concept of zypper. For example when I have home:adrianSuSE with my stable releases and home:adrianSuSE:SVN-SNAPSHOT, the trust should be the same, because it is always me, so it is okay to use just one gpg key. But having one vendor for both projects would lead to the situation that it is not predictable if zypper stays with one of the repos for a package on update. So, I would consider to set the vendor to the building project, but not to the gpg key project. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 User adrian@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=503276#c12 --- Comment #12 from Adrian Schröter 2009-10-19 00:02:24 MDT --- Maybe do it both, first to try to stick to vendor and secondly also to the repo. This would be a straight forward development without becoming incompatible. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 User adrian@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=503276#c14 --- Comment #14 from Adrian Schröter 2009-10-19 00:23:47 MDT --- if my home key is compromised, it is very likely that the other is also (and maybe all of OBS). Keys representing the people (groups), not their current intended work. So, if adrianSuSE from home:adrianSuSE steals your money and installs backdoors on your system, the adrianSuSE from :SVN is doing the same most likely. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 User cmorve69@yahoo.es added comment http://bugzilla.novell.com/show_bug.cgi?id=503276#c16 --- Comment #16 from Cristian Morales Vega 2009-10-19 01:49:30 MDT --- I suppose the repo thing can be done *now* since now there is http://en.opensuse.org/Libzypp/Package_History. But if I have to trust the wiki the repo is identified by the alias. Perhaps bnc#377568 should be fixed first. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 http://bugzilla.novell.com/show_bug.cgi?id=503276#c18 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |suse-beta@cboltz.de --- Comment #18 from Christian Boltz 2009-11-24 23:26:36 CET --- (In reply to comment #17)

I think the gpg key should be the same for sub projects.

You want the same key for devel:*? ;-) Well, but I get your point. This could really be useful if implemented as a prjconf option: [x] inherit GPG key to subprojects (not sure if the subprojects need an option "don't use key from parent" ;-) -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 http://bugzilla.novell.com/show_bug.cgi?id=503276#c20 Michael Schröder changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |CLOSED Resolution| |FIXED --- Comment #20 from Michael Schröder 2009-11-25 10:24:51 UTC --- I'm closing this bug as the implementation works as designed. Users who want different vendors for each subproject can do this in their project config. If you want to discuss this feature, please take it to the mailing list. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 http://bugzilla.novell.com/show_bug.cgi?id=503276#c22 --- Comment #22 from Stephan Kleine 2009-11-25 11:07:13 UTC --- And just to prevent any misunderstanding: I couldn't care less about the implementation details. My problem simply is that the current configuration of OBS just begs for trouble. Only if getting rid of the pgp key <-> vendor link means you have to change the implementation then so it be. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 http://bugzilla.novell.com/show_bug.cgi?id=503276#c24 --- Comment #24 from Stephan Kleine 2009-11-25 13:58:58 UTC --- Well, then think about how to solve the following with the current setup of the _public OBS_: Project A:Foo contains Package1 (stable release) and Project A:Bar contains Package1 (svn snapshots, most time broken). Further A:Bar contains Package2 which I want to install as well. So we have the following situation: 1. Project A:Foo and A:Bar share the same key and therefore currently have the same vendor. 2. I want Package1 _only_ from A:Foo since the version in A:Bar is most times broken. 3. I also need to add Project A:Bar since it contains Package2 which I want to install as well. So how am I supposed to force zypp now to get Package1 only from A:Foo and not to constantly switch to the broken versions in A:Bar (which is newer but broken)? I honestly fail to see why it should be taken to the mailing lists and what there is to discuss since it is currently impossible and therefore obviously broken. And no, IMHO, writing people an email to ask them to please use separate vendors is no option since there are too many repos on OBS and the problem can arise out of nowhere as soon as someone adds some package somewhere. Also this problem would not exist if you would simply use unique vendors per repository. So, with all due respect, until you can come up with a solution for the above usecase _on the public OBS_ I dare to say that either the implementation or the configuration currently is broken and needs to be fixed. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=503276 http://bugzilla.novell.com/show_bug.cgi?id=503276#c26 --- Comment #26 from Stephan Kleine 2009-11-25 14:28:36 UTC --- Well, editing the prjconf is no option cause the repos aren't under my control and using repo priorities wont work anymore if there's a package that is in both repos and which I would like to get only from A:Bar. OTOH if you would use unique vendors the problem wouldn't exist in the first place. Seriously, what is your problem with unique vendors per repository? As in why are you arguing that hard that this problem doesn't exist cause imho it is a pretty major one that turns zypp & OBS into a timebomb? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=503276 https://bugzilla.novell.com/show_bug.cgi?id=503276#c28 --- Comment #28 from Michael Schröder 2012-07-02 08:39:18 UTC --- Vendor contains the project used for signing the packages, so if you create a special key in your sub-project, it will be used as vendor instead of the parent. Zypper uses "Vendor". -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.