Re: [Qemu-devel] [qemu-web PATCH] download: Add instructions for MacPorts

[Daniel P . Berrangé]

On Wed, Apr 04, 2018 at 10:24:48AM -0400, Programmingkid wrote:
> 
> > On Apr 4, 2018, at 7:15 AM, Paolo Bonzini <address@hidden> wrote:
> > 
> > On 02/04/2018 16:13, Programmingkid wrote:
> >> 
> >>> On Apr 2, 2018, at 10:07 AM, address@hidden wrote:
> >>> 
> >>> Message: 2
> >>> Date: Mon, 2 Apr 2018 04:22:52 +0200
> >>> From: Paolo Bonzini <address@hidden>
> >>> To: Rainer M?ller <address@hidden>, address@hidden
> >>> Subject: Re: [Qemu-devel] [qemu-web PATCH] download: Add instructions
> >>>   for MacPorts
> >>> Message-ID: <address@hidden>
> >>> Content-Type: text/plain; charset=utf-8
> >>> 
> >>> On 01/04/2018 18:22, Rainer M?ller wrote:
> >>>> Signed-off-by: Rainer M?ller <address@hidden>
> >>>> ---
> >>>> _download/macos.md | 6 +++++-
> >>>> 1 file changed, 5 insertions(+), 1 deletion(-)
> >>>> 
> >>>> diff --git a/_download/macos.md b/_download/macos.md
> >>>> index dbb312c..06aa811 100644
> >>>> --- a/_download/macos.md
> >>>> +++ b/_download/macos.md
> >>>> @@ -1,6 +1,10 @@
> >>>> -QEMU can be installed from Homebrew:
> >>>> +QEMU can be installed from <strong>Homebrew</strong>:
> >>>> 
> >>>> <pre>brew install qemu</pre>
> >>>> 
> >>>> +QEMU can be installed from <strong>MacPorts</strong>:
> >>>> +
> >>>> +<pre>sudo port install qemu</pre>
> >>>> +
> >>>> QEMU requires Mac OS X 10.5 or later, but it is recommended
> >>>> to use Mac OS X 10.7 or later.
> >>>> 
> >>> 
> >>> Thanks for the patch!  I'm travelling but I will apply it as soon as I 
> >>> can.
> >>> 
> >>> Paolo
> >> 
> >> I was wondering if a link to the Mac OS X host wiki page could be added to 
> >> this page.
> >> It does have prebuilt binaries ready for use.
> >> 
> >> https://wiki.qemu.org/Hosts/Mac
> > 
> > Actually I believe we should remove those links.  I don't think hosting
> > QEMU binaries on mediafire is a good idea.
> > 
> > Paolo
> 
> Why not?

The source/quality of those binaries is completely opaque. We've no idea who
built them, nor what build options were used, nor what/where the corresponding
source is (required for GPL compliance), nor any checksum / signature to
validate the binary isn't compromised since build, etc, etc.

Pointing users to those binaries makes it appear QEMU project is blessing
them, and so any issues with them directly reflect on QEMU's reputation.

If we're going to link to binaries telling users to download them, we need
to be hosting them on qemu.org and have a clearly documented formal process
around building & distributing them.

Since both Homebrew & Macports are providing formal bulds though, it looks
simpler to just entirely delegate the problem to them, as we do for Linux
where we delegate to distro vendors to build & distribute binaries.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|