Re: Deskbar Applet, NewStuffManager, 2.16, Installing New Plug-Ins, AutoUpdate, etc.

["Nigel Tao" <nigel tao gnome gmail com>]

On 8/1/06, Vincent Untz <vuntz gnome org> wrote:
> Would waiting for the 2.18 release cycle be an issue for desbkar?

I don't think that there's any issues, but we'll discuss this on
deskbar-applet-list.  If we do punt to 2.18, will we just rebadge the
latest 2.14 as 2.16.0?  Leave d-a 2.14 as 2.14, but as part of 2.16?
And should we backport as little as possible [1] from HEAD?

[1] Well, apart from unbreak-the-build things like the patch to play
nice with evolution-data-server 2.16.


On 8/2/06, Shaun McCance <shaunm gnome org> wrote:
> With an automated listy-clicky thing, you don't get to see
> explicit files, and you have no way of checking against a
> checksum or a digital signature.

Yeah, an example: suppose there's a hypothetical
intended-for-use-for-five-years distro that shipped this listy-clicky
thing (without some means of verification).  One day, years down the
track, some user goes through the GUI, and picks up the master list
from http://raphael.slinckx.net/deskbar/repository/deskbar-repository.xml
[1], which links to
http://some.web.site/my-awesome-deskbar-extension.tar.bz2.  This code
looked good at the time it was added to the master list, but in the
mean time, the domain registration for some.web.site expired and a
villian has picked it up, and now serves up evil spyware versions of
the extension to our poor user.  Bad.

[1] Really, if NewStuffManager is to be part of GNOME, a stable
version of NewStuffManager should only point to a master list hosted
somewhere under gnome.org, I reckon.