Gentoo Archives: gentoo-dev

From: Ian Stakenvicius <axs@g.o>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] [RFC] Make manifest signatures mandatory for repoman commit
Date: Wed, 15 Apr 2015 13:44:20
Message-Id: 552E6B29.6030706@gentoo.org
In Reply to: Re: [gentoo-dev] [RFC] Make manifest signatures mandatory for repoman commit by Ian Stakenvicius
1 -----BEGIN PGP SIGNED MESSAGE-----
2 Hash: SHA256
3
4 On 15/04/15 09:40 AM, Ian Stakenvicius wrote:
5 > On 15/04/15 05:49 AM, Ulrich Mueller wrote:
6 >>>>>>> On Wed, 15 Apr 2015, Micha³ Górny wrote:
7 >
8 >>> This is problem with the CVS two-commit procedure. The only
9 >>> solution is to stop using CVS keywords which people don't want
10 >>> to do because THEY ARE SO VERY USEFUL.
11 >
12 >>> Or make repoman do first commit without Manifest, so instead of
13 >>> unsigned Manifest you'd have Manifest failure.
14 >
15 >> But that's what it does. It commits all other files, then it
16 >> signs the Manifest and commits that.
17 >
18 >> However, if signing fails it will commit an unsigned Manifest.
19 >> Which I think is a misfeature. If I have FEATURES=sign then I
20 >> want to commit a signed Manifest. If there are problems, repoman
21 >> should error out but not do some other action that I've not asked
22 >> for.
23 >
24 >> Ulrich
25 >
26 >
27 > Couldn't repoman sign a copy of the Manifest first (even if it's
28 > staged in temporary space somewhere), then either do it all in one
29 > commit or do the same two-stage commit it does now?? At least
30 > that would allow it to catch gpg errors and abort.
31
32 Nevermind, I follow the issue with the keywords now...
33
34 -----BEGIN PGP SIGNATURE-----
35 Version: GnuPG v2
36
37 iF4EAREIAAYFAlUuaykACgkQ2ugaI38ACPDWEQD/TX233xLS5CKkaikTSPEBaaNO
38 ouaMvTubvt4LB+Vjdg0BALUgQD6be9hoj/c5IeFVED5X6WnLdlAbNnOLoUdn6kX0
39 =IreG
40 -----END PGP SIGNATURE-----