Re: [gentoo-portage-dev] Plan for initial integration of gemato with portage

[Alec Warner]

On Wed, Jan 24, 2018 at 2:58 PM, Michał Górny <mgorny@g.o> wrote:

> W dniu śro, 24.01.2018 o godzinie 12∶54 -0500, użytkownik Alec Warner
> napisał:
> > On Wed, Jan 24, 2018 at 3:56 AM, Michał Górny <mgorny@g.o> wrote:
> >
> > > Hi, everyone.
> > >
> > > Since the initial review of my patch lost focus, and lacked sufficient
> > > context, here's the plan that I'd like to follow in order to initially
> > > integrate gemato with portage and give our users secure checkouts by
> > > default.
> > >
> > > 1. Add postsync hook to Portage git. Eventually, it will be replaced by
> > > direct Portage support.
> > >
> > > 2. Add IUSE=+rsync-verify to portage-9999 that controls installing the
> > > hook. This will give users the ability to easily disable it without
> jumping
> > > through cross package hoops.
> > >
> >
> > I think it makes sense to avoid installing the hook through this means
> > (e.g. I don't want it, so I set USE=-rsync-verify)
> >
> > I think its a bit trickier to control the hook's behavior. For instance:
> >
> > 1) I install portage[rsync-verify]. This installs the hook.
> > 2) I end up not liking the hook, I install portage[-rsync-verify]
> > 3) Does the hook get config-protected here?
>
> Keeping config-protected files applies only if the file were modified.
> In this case it just gets unmerged. I've just verified that.
>
> > > 3. Submit a news item for review that will explain how to initially
> verify
> > > the keys on existing installations.
> > >
> > > The news item would be published when the hook hits a release.
> > >
> > > What do you think? If you agree, then I'll start writing the news item.
> > >
> >
> > The other part of the user story I don't understand is what actions
> should
> > users take when verification legit fails?
> >
> > 1) file a bug?
> > 2) re-sync their tree?
> > 3) something else?
>
> I'd say one re-sync would be reasonable in case it could have been some
> rsync glitch. Beyond that, it would definitely be worth reporting...
> except the user will probably hit another mirror.
>

This sgtm.

If the number of reports is high we can build more complex reporting
infrastructure (e.g. to locate bad mirrors.)

-A


>
> --
> Best regards,
> Michał Górny
>
>
>