Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:77704
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <de33d80f16d5777b8883f3ca72dfa653@archlinux.de>
References: <0cb6f4a2d771155c6cad865f945e98e6@archlinux.de>
	<m34g2apbuvh79jed2jqbojq2ru3fjlpn49@4ax.com>
	<CAMUwpuQSHsbtuUGouk9rYWoNPp2wU5ktH9Dbg+q_HY5yLSDEPw@mail.gmail.com>
	<h4fi2ap2n5r3lbvb59oldibatouaov8731@4ax.com>
	<46ABAB22-F304-4BC3-A3AE-02DE462565D2@lerdorf.com>
	<1412003052.13103.30.camel@kuechenschabe>
	<de33d80f16d5777b8883f3ca72dfa653@archlinux.de>
Date: Mon, 29 Sep 2014 19:02:26 +0200
Message-ID: <CAEZPtU6nYPf0yEZaEtADPX=JKFLyP5pQGoUUMxzjeLo1Ca2e3w@mail.gmail.com>
To: Pierre Schmitz <pierre@archlinux.de>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: What happened to the 5.6.1 release?
From: pierre.php@gmail.com (Pierre Joye)

On Mon, Sep 29, 2014 at 6:35 PM, Pierre Schmitz <pierre@archlinux.de> wrote=
:
> Am 29.09.2014 17:04, schrieb Johannes Schl=C3=BCter:
>>
>> On Mon, 2014-09-29 at 06:35 -0700, Rasmus Lerdorf wrote:
>>>
>>> >> Actually, some php.net machines have been compromised and prevent us
>>> >> from releasing 5.6.1.
>>
>> [...]
>> Q: Is the git repo affected?
>> A: No. The infected box is a different one. git's cryptographic commit
>> identifiers and distributed antature along with out automatic mirroring
>> to github serve as further mitigation for potential issues.
>
>
> This sounds like it wont be that bad of an idea to build directly from a =
git
> tag if you know how. Together with signed tags this should be more
> trustworthy imho. I don't see a huge downside here.
>
> I wonder if one could replace that release server with a simple vagrant
> setup or similar so the RM can actually create release archives on his ow=
n.

Not using vagrant but this is how it is done now. That box was used
until a couple of years ago due to some bison (or ac) issues, to be
sure that the src releases work on any supported systems.

Cheers,
--=20
Pierre

@pierrejoye | http://www.libgd.org