On 24-08-2011 09:20:00 +0000, Robin H. Johnson wrote:
> On Wed, Aug 24, 2011 at 11:01:07AM +0200, Fabian Groffen wrote:
> [snip]
> > I would like to put an additional issue on the table which I encountered
> > while implementing fully from CVS generated ChangeLogs for the Prefix
> > rsync tree.
> [snip]
> And all of this is impacted by how we do thin manifests and commit
> signing. 

Obviously.

> Thin manifests are those that contain ONLY entries for files not covered
> by another (direct or indirect) hash in the VCS. Git's use of SHA1
> allows a conversion from Git+thin Manifest to classical Manifest2.

How does this work with generating the other hashes?

> Commit signing has a few implications/side-effects:
> - commits are signed so Manifests are NOT signed anymore.

I assume this is ok, and has no effect in terms of guarantees one makes
about the content.

> - During the conversion to classical Manifest2, we need to create
>   automated signatures (see the tree-signing GLEPs for MetaManifest).
> - As a side advantage of the automated Manifests/signatures, we can use
>   the Manifest2 changes proposed in the tree-signing GLEPs to cover ALL
>   of the profiles and eclasses.
>
> I'm going to be away Thursday till Monday, so the lack of any further
> impact from me doesn't mean I don't have an opinion, rather just that
> I'm away from the Internet.

Your input is much appreciated (if not authoritive).  I hope you'll
catch up on this discussion after you return.


-- 
Fabian Groffen
Gentoo on a different level