Currently some packages are built and signed manually and then pushed to one of our CI server to be published.
This is not great for multiple reasons:
- this require a lot of manual operations that are not that obvious
- from a supply chain POV building those packages outside of a script and a controlled environment come with risks
- it is hard to know which version contains a fix made in one of the additional packages (especially for Tuleap Enterprise)
The following packages are concerned:
- [X] php-mediawiki-tuleap-123
- [X] mediawiki-math-tuleap
- [X] sha1collisiondetector
- [~] cvs-tuleap/cvs-tuleap-debuginfo
- [~] mailman-tuleap/mailman-tuleap-debuginfo
- [X] viewvc-theme-tuleap