Re: [gentoo-dev] [RFC] Make manifest signatures mandatory for repoman commit

[Jason Zaman]

On Wed, Apr 15, 2015 at 12:27:08PM +0300, Andrew Savchenko wrote:
> On Wed, 15 Apr 2015 11:06:22 +0200 Michał Górny wrote:
> > Dnia 2015-04-15, o godz. 11:59:12
> > Andrew Savchenko <bircoph@g.o> napisał(a):
> >
> > > Hi,
> > >
> > > why manifest signatures are still optional for repoman?
> > >
> > > Repoman signatures are currently optional and this creates nasty
> > > consequences: if signing errors occurs, repoman still proceeds :/
> > >
> > > I just had a phone call during repoman commit and was not able to
> > > type my password. Due to gpg-agent timeout repoman completed commit
> > > without a signature :( Should signatures be mandatory, repoman will
> > > bail out on such conditions and devs can recommit again safely.
> >
> > This is problem with the CVS two-commit procedure. The only solution is
> > to stop using CVS keywords which people don't want to do because THEY
> > ARE SO VERY USEFUL.
> >
> > Or make repoman do first commit without Manifest, so instead of
> > unsigned Manifest you'd have Manifest failure.
>
> Is there any way to commit manifest first, then the rest of the
> files? Of course there may be a network failure in-between, but
> this should easily fixable with one more repoman commit run.

no. the problem is that all the files change when they are committed.
the $ Header: xxxxx $ line has the commit time and stuff. so the two
phase first commits all the ebuilds and everything then when the lines
are fixed it re-makes the manifest and commits.

I dont think it can be fixed without getting rid of the $Header$ line.
I'd be all for it, those lines seem like more trouble than its worth to me.

-- Jason