search

fedora-ci / rpminspect-runner

Container image for the rpminspect pipeline
Apache License 2.0
2 stars 9 forks source link

Don't update annobin #119

Closed ckelleyRH closed 6 months ago

ckelleyRH commented 6 months ago

I am a bit confused about why this is set up as it is. The code says:

we don't want to touch packages when the base image is Rawhide...

Why is this? If we're after stability, why aren't we using the F40 image?

If we want bleeding-edge but only when we say so, would it be better to use the F40 image and pull annocheck from COPR like we do for some other rpminspect-ish packages?

I'm not sure what the reasoning is behind this, so the MR currently just updates annobin to the latest version which will solve the problem I'm looking at. If we want to do something different then sure, I just would like to understand it :smile:

msrb commented 6 months ago

IIRC, we are on Rawhide because some of the rpminspect dependencies (libabigail, annocheck, ...?) did not always receive updates in the stable Fedora releases (only Rawhide), or they did receive the latest update, but with some significant delay. However, this was also back in the days when all these tools were relatively new, buggy, and the release cadence was much higher. We also did not have our rpminspect COPR back then :)

Why do we even need this today? Isn't simple image rebuild enough to pull in the latest annocheck?

msrb commented 6 months ago

I think that, ideally, the packages in the image should be frozen as much as possible -- to avoid random breakages. The only exception is probably the data package. People kind of expect that if they make a change in the data package, that the change will be propagated to production immediately.

ckelleyRH commented 6 months ago

Why do we even need this today? Isn't simple image rebuild enough to pull in the latest annocheck?

I checked a bit deeper based on what you said and yes, this is indeed redundant. This update is identical to the one in dockerfile.rhel. It also won't fix the issue, because the package comes from OSCI COPR and we don't have the version being asked for. The data packages come from David's COPR directly rather than us pulling it in, which is fine if we always want the latest data packages.

I updated the MR to strip this code so we never put it back in, as we don't want packages other than the data packages updating on the fly.

I will rebuild annobin in the COPR to fix the issue, thanks @msrb !