Repository navigation
Replies: 1 comment 2 replies
|
We have had very few requests for RPMs, maybe 5-10 people asking for it in the many years we've been doing Keycloak. As such we simply can't prioritise it. In terms of community maintained RPMs that's a nice idea, but question is how do you trust such community maintained RPMs? I'm sure you have the best intentions here, but at the same time those RPMs could be compromised at some point. For this reason we simply can't support the maintenance of these, because at the same time we would be officially blessing the RPMs and sending a message to the wider community that we trust them, while at the same time we have no way of actually validating that. |
|
Note that I am referring to "FedoraProject" not only a copr project. These are reviewed by the Fedora team so you cannot inject random code. Also the build instructions for the spec files are very straightforward to read (here is an example), so they can be easily vetted. Of course if there wasn't ever a RPM, nobody is asking, but as soon as it is available people will use it. It's also notable that with keycloak's recent change from xml configuration to the I would say having it maintained in a distro package it is much easier to automatically patch vulnerabilities as they do For the keycloak upstream we only need a bit of support:
|
|
Note that the commercial version of Keycloak (Red Hat Single Sign On) has RPMs. The sources for that are available, but I think they are not easy to rebuild (at least with my limited packaging knowledge). Personally, I'm looking for an update to Ipsilon, which was in EL7 and had very nice integration with FreeIPA. I was considering installing Keycloak on K8S, because the Keycloak operator looks like the way to get updates easily, and the plans for the operator are very enticing. However, as I was researching this, I rechecked Ipsilon again. Ipsilon seems to be well-supported on Fedora, but I'd rather deploy it in EL... and someone is working on packaging it for EPEL 8. So now I'm leaning towards Ipsilon. It's pretty nice because it installs and updates as an RPM, and it autoconfigures for FreeIPA. If I can get OpenID going... well, I'd prefer EL9, but EL8 will still be good until 2029. |
Uh oh!
There was an error while loading. Please reload this page.
I will copy the issue #17066 because it was closed without proper discussion.
@stianst can you elaborate on why RPMs are out of scope, and if the team can support the maintenance of the package by adding a simple webhook to copr?
All reactions