Hi Troy,thanks for your fast reply.

Regarding static mirror vs mirrorlist:

When I configured my system the SL mirror seemed slow to me, so using
mirrorlist could make things faster for some users which could be an
advantage. Coming to the fear of not getting the latest updates: It
should be possible to query the mirrors if they sync regulary (does
centos do that?). If not, they could be taken out of the mirror list.
But IMO the question is if it makes sense to create such an
infrastructure having considered the current amount of users is not that
huge (taken from the statistics at sl.org).

Ah and I have one last question to the gpgchecks. While it makes sense
to me having them disabled if it is not possible to sign a certain
package, why are they disabled for ATRPMs and DAG in the officiel
yum-conf RPMs? I have enabled them manually and I do not run into any
problems but have improved security :-)

Martin

Am Mittwoch, den 22.04.2009, 16:50 -0500 schrieb Troy Dawson:
> Hi,
> I'll answer the qestion inline
> 
> Martin Jürgens wrote:
> > Hi,
> > 
> > sadly I was not able to use the bug tracker so I will use this list to
> > address the issues / questions that I have in mind after using
> > Scientific Linux for some time.
> > 
> > The first thing I noticed is that there is something wrong with the
> > sl-debuginfo repository. yum repolist says the following:
> > 
> > sl-debuginfo         Scientific Linux 5 debuginfo rpm's       enabled :
> > 72
> > 
> > But having looked at
> > ftp://ftp.scientificlinux.org/linux/scientific/5x/archive/debuginfo/
> > there seem to be much more packages in that repo than 72. Is there something
> > wrong with the repodata?
> > 
> 
> That is an oversight.  I'll fix the script and tomorrow when tomorrows 
> errata go out, it should be fixed.
> 
> > The second thing is that both gpgcheck and the
> > usage of mirrors is deactivated by default in yum.repos.d. I'd be interested
> > in knowing why that is, also because the gpgcheck can vastly improve
> > security.
> > 
> 
> gpgcheck
> I would love to turn that on.  The problem is that we still cannot sign 
> jdk.  Well, we've gotten it down to we cannot sign the x86_64 version. 
> So we're getting close, and as soon as we can, we will.
> 
> Using mirrors vs mirrorlist
> Last time I checked, people still preferred having a static over using 
> the mirrorlist.  Majority of our users have a local mirror, and so 
> change that anyway.  As for the rest, we haven't asked for a year or 
> two.  Last time we asked, I believe the problem people had was not 
> knowing if the mirror they were getting was being updated fast enough. 
> And at that time, I think fastestmirror wasn't as good as it is nowdays.
> But we could certainly ask again.
> 
> What do people think, should we switch to using the mirrorlist as the 
> default?  Or should we stick with how we currently have things?
> 
> Troy