Re: [gentoo-dev] Re: Gentoo peer-to-peer

[Alexander Gretencord]

On Tuesday 23 July 2002 23:14, Charles Lacour wrote:
> I'm not sure there's any need for USE flags to identify the binary. If two
> different people compile a package to identical binaries, what USE flags
> they had are completely irrelevant. (Someone might compile a package under
> another flavor of Linux, for example, in which case there ARE no USE
> flags.)

Well it's pretty obvious that different USE flags should result in different 
binaries but you need the USE flags so you know what's in the package. If I 
have a -X in my USE flags I surely wouldn't want to install a vim binary 
package that has X support in it.

Should everyone be able to submit binaries ? I surely wouldn't trust them.

> My thought was to build a string describing the package, then run an md5sum
> on that. I was thinking of using that as part of the filename, so we might
> want to create a custom md5sum that would produce a shorter string (6-8
> characters, say).

You do know about hash functions and collisions ?

> Some people have objected (none too violently, as yet) to this as being
> "contrary to the spirit of Gentoo".

Well I'm not against binaries (without --buildpkg gentoo wouldn't be too 
useful for more than a few computers) but I surely wouldn't like to have 
binaries installed from _somebody_. I've chosen gentoo because I can compile 
from source with control over what I build but with good packaging and 
without the need to know how to compile every single package I need. Of 
course that may be different for a lot of people but see first sentence of 
the "About gentoo" page.

"Gentoo Linux is a versatile and fast, completely free Linux distribution for 
x86, PowerPC, Sparc and Sparc64 that's geared towards Linux power users."

That's what they probably mean when they talk about the spirit :)

> I like the idea of using this for source as well as binaries; when I'm
> downloading files from Gnutella and can get 3 or 4 people to download from
> at once, I can max out my ADSL line. From a lot of FTP servers, I get a lot
> less.  It would also let me contribute as as server; I have a fixed IP
> address, but only a 128K uplink. By myself, I'd be a pretty sorry source
> for much of anything. With 8 or 10 people like me, though, I'd be quite
> useful.

Well without proper verification of source and binary packages you will only 
get "normal users" to use that. I can (privately) live with "just trusting 
the official mirrors", but p2p without strong cryptographhic verification for 
anything other than films or music (did I say that ? :)) ?


Alex

-- 
"They that can give up essential liberty to obtain a little temporary safety 
deserve neither liberty nor safety."
Benjamin Franklin