[gentoo-security] Re: Package signing and distribution

[Peter Simons]

Heiko Wundram writes:

 > I am currently working on a system which does exactly
 > this signing process with an addon library I've written
 > myself (so, no need for gpg, just Python + module).

I _think_ that a very similar system does exist already:

  http://www.venge.net/monotone/

I can't be certain, but from your description it sounds
quite familiar. In fact, I had thought about recommending
Monotone as a means for distributing the Portage tree
instead of using CVS/rsync, but I think also that such a
fundamental change would take ages to get organized.

However, if a distribution / versioning scheme like that
would be used by Gentoo, it would be really nice, IMHO.

Peter


--
gentoo-security@g.o mailing list