Another argument for the mirrorlist is that if the SL-servers run out of
power or are broken people can still update / install SL.

Martin

Am Donnerstag, den 23.04.2009, 00:13 +0200 schrieb Martin Jürgens:
> Hi Troy,thanks for your fast reply.
> 
> Regarding static mirror vs mirrorlist:
> 
> When I configured my system the SL mirror seemed slow to me, so using
> mirrorlist could make things faster for some users which could be an
> advantage. Coming to the fear of not getting the latest updates: It
> should be possible to query the mirrors if they sync regulary (does
> centos do that?). If not, they could be taken out of the mirror list.
> But IMO the question is if it makes sense to create such an
> infrastructure having considered the current amount of users is not that
> huge (taken from the statistics at sl.org).
> 
> Ah and I have one last question to the gpgchecks. While it makes sense
> to me having them disabled if it is not possible to sign a certain
> package, why are they disabled for ATRPMs and DAG in the officiel
> yum-conf RPMs? I have enabled them manually and I do not run into any
> problems but have improved security :-)
> 
> Martin
> 
> Am Mittwoch, den 22.04.2009, 16:50 -0500 schrieb Troy Dawson:
> > Hi,
> > I'll answer the qestion inline
> > 
> > Martin Jürgens wrote:
> > > Hi,
> > > 
> > > sadly I was not able to use the bug tracker so I will use this list to
> > > address the issues / questions that I have in mind after using
> > > Scientific Linux for some time.
> > > 
> > > The first thing I noticed is that there is something wrong with the
> > > sl-debuginfo repository. yum repolist says the following:
> > > 
> > > sl-debuginfo         Scientific Linux 5 debuginfo rpm's       enabled :
> > > 72
> > > 
> > > But having looked at
> > > ftp://ftp.scientificlinux.org/linux/scientific/5x/archive/debuginfo/
> > > there seem to be much more packages in that repo than 72. Is there something
> > > wrong with the repodata?
> > > 
> > 
> > That is an oversight.  I'll fix the script and tomorrow when tomorrows 
> > errata go out, it should be fixed.
> > 
> > > The second thing is that both gpgcheck and the
> > > usage of mirrors is deactivated by default in yum.repos.d. I'd be interested
> > > in knowing why that is, also because the gpgcheck can vastly improve
> > > security.
> > > 
> > 
> > gpgcheck
> > I would love to turn that on.  The problem is that we still cannot sign 
> > jdk.  Well, we've gotten it down to we cannot sign the x86_64 version. 
> > So we're getting close, and as soon as we can, we will.
> > 
> > Using mirrors vs mirrorlist
> > Last time I checked, people still preferred having a static over using 
> > the mirrorlist.  Majority of our users have a local mirror, and so 
> > change that anyway.  As for the rest, we haven't asked for a year or 
> > two.  Last time we asked, I believe the problem people had was not 
> > knowing if the mirror they were getting was being updated fast enough. 
> > And at that time, I think fastestmirror wasn't as good as it is nowdays.
> > But we could certainly ask again.
> > 
> > What do people think, should we switch to using the mirrorlist as the 
> > default?  Or should we stick with how we currently have things?
> > 
> > Troy