1 |
On 2018.11.19 18:35, Michał Górny wrote: |
2 |
> Hi, |
3 |
> |
4 |
> On Sat, 2018-11-17 at 12:21 +0100, Michał Górny wrote: |
5 |
> > Here's a pre-GLEP draft based on the earlier discussion on gentoo- |
6 |
> > portage-dev mailing list. The specification uses GLEP form as it |
7 |
> > provides for cleanly specifying the motivation and rationale. |
8 |
> |
9 |
> Changes in -r1: took into account the feedback and restructured |
10 |
> the motivation into pointing out advantages of the existing format, |
11 |
> and focusing on the two real issues of non-transparency and OpenPGP |
12 |
> implementations deficiencies. Also added a section on why there's no |
13 |
> explicit version number. |
14 |
> |
15 |
> > Also available via HTTPS: |
16 |
> > |
17 |
> > rst: https://dev.gentoo.org/~mgorny/tmp/glep-0078.rst |
18 |
> > html: https://dev.gentoo.org/~mgorny/tmp/glep-0078.html |
19 |
> > |
20 |
> |
21 |
[snip] |
22 |
|
23 |
Team, |
24 |
|
25 |
Looks good to me. I can manually unpick the binpackage with tar. |
26 |
Choose, if I will check the signatures or not, then spray files all |
27 |
over my broken Gentoo with tar in the same way as I do now. |
28 |
|
29 |
Implementation detail question. |
30 |
It appears that all members must be signed, or none of them since |
31 |
|
32 |
"The archive members support optional OpenPGP signatures. |
33 |
The implementations must allow the user to specify whether OpenPGP |
34 |
signatures are to be expected in remotely fetched packages." |
35 |
|
36 |
Or can the user specify that only some elements need to be signed? |
37 |
|
38 |
Is it a problem if not all elements are signed with the same key? |
39 |
That could happen if one person makes a binpackage and someone |
40 |
else updates the metadata. |
41 |
|
42 |
|
43 |
> -- |
44 |
> Best regards, |
45 |
> Michał Górny |
46 |
> |
47 |
|
48 |
-- |
49 |
Regards, |
50 |
|
51 |
Roy Bamford |
52 |
(Neddyseagoon) a member of |
53 |
elections |
54 |
gentoo-ops |
55 |
forum-mods |