| 1 |
On 24-08-2011 09:20:00 +0000, Robin H. Johnson wrote: |
| 2 |
> On Wed, Aug 24, 2011 at 11:01:07AM +0200, Fabian Groffen wrote: |
| 3 |
> [snip] |
| 4 |
> > I would like to put an additional issue on the table which I encountered |
| 5 |
> > while implementing fully from CVS generated ChangeLogs for the Prefix |
| 6 |
> > rsync tree. |
| 7 |
> [snip] |
| 8 |
> And all of this is impacted by how we do thin manifests and commit |
| 9 |
> signing. |
| 10 |
|
| 11 |
Obviously. |
| 12 |
|
| 13 |
> Thin manifests are those that contain ONLY entries for files not covered |
| 14 |
> by another (direct or indirect) hash in the VCS. Git's use of SHA1 |
| 15 |
> allows a conversion from Git+thin Manifest to classical Manifest2. |
| 16 |
|
| 17 |
How does this work with generating the other hashes? |
| 18 |
|
| 19 |
> Commit signing has a few implications/side-effects: |
| 20 |
> - commits are signed so Manifests are NOT signed anymore. |
| 21 |
|
| 22 |
I assume this is ok, and has no effect in terms of guarantees one makes |
| 23 |
about the content. |
| 24 |
|
| 25 |
> - During the conversion to classical Manifest2, we need to create |
| 26 |
> automated signatures (see the tree-signing GLEPs for MetaManifest). |
| 27 |
> - As a side advantage of the automated Manifests/signatures, we can use |
| 28 |
> the Manifest2 changes proposed in the tree-signing GLEPs to cover ALL |
| 29 |
> of the profiles and eclasses. |
| 30 |
> |
| 31 |
> I'm going to be away Thursday till Monday, so the lack of any further |
| 32 |
> impact from me doesn't mean I don't have an opinion, rather just that |
| 33 |
> I'm away from the Internet. |
| 34 |
|
| 35 |
Your input is much appreciated (if not authoritive). I hope you'll |
| 36 |
catch up on this discussion after you return. |
| 37 |
|
| 38 |
|
| 39 |
-- |
| 40 |
Fabian Groffen |
| 41 |
Gentoo on a different level |
Archives