1 |
On Mon, 2018-11-19 at 19:21 +0000, Roy Bamford wrote: |
2 |
> On 2018.11.19 18:35, Michał Górny wrote: |
3 |
> > Hi, |
4 |
> > |
5 |
> > On Sat, 2018-11-17 at 12:21 +0100, Michał Górny wrote: |
6 |
> > > Here's a pre-GLEP draft based on the earlier discussion on gentoo- |
7 |
> > > portage-dev mailing list. The specification uses GLEP form as it |
8 |
> > > provides for cleanly specifying the motivation and rationale. |
9 |
> > |
10 |
> > Changes in -r1: took into account the feedback and restructured |
11 |
> > the motivation into pointing out advantages of the existing format, |
12 |
> > and focusing on the two real issues of non-transparency and OpenPGP |
13 |
> > implementations deficiencies. Also added a section on why there's no |
14 |
> > explicit version number. |
15 |
> > |
16 |
> > > Also available via HTTPS: |
17 |
> > > |
18 |
> > > rst: https://dev.gentoo.org/~mgorny/tmp/glep-0078.rst |
19 |
> > > html: https://dev.gentoo.org/~mgorny/tmp/glep-0078.html |
20 |
> > > |
21 |
> |
22 |
> [snip] |
23 |
> |
24 |
> Team, |
25 |
> |
26 |
> Looks good to me. I can manually unpick the binpackage with tar. |
27 |
> Choose, if I will check the signatures or not, then spray files all |
28 |
> over my broken Gentoo with tar in the same way as I do now. |
29 |
> |
30 |
> Implementation detail question. |
31 |
> It appears that all members must be signed, or none of them since |
32 |
> |
33 |
> "The archive members support optional OpenPGP signatures. |
34 |
> The implementations must allow the user to specify whether OpenPGP |
35 |
> signatures are to be expected in remotely fetched packages." |
36 |
> |
37 |
> Or can the user specify that only some elements need to be signed? |
38 |
|
39 |
This is really out of scope. The only purpose of this paragraph is to |
40 |
explain that '(optional)' doesn't mean you can safely ignore the lack of |
41 |
this file. |
42 |
|
43 |
-- |
44 |
Best regards, |
45 |
Michał Górny |