Gentoo Archives: gentoo-dev

From: Rich Freeman <rich0@g.o>
To: gentoo-dev <gentoo-dev@l.g.o>
Subject: Re: [gentoo-dev] rfc: why are we still distributing the portage tree via rsync?
Date: Tue, 03 Jul 2018 16:51:37
1 On Tue, Jul 3, 2018 at 12:41 PM Kristian Fiskerstrand <k_f@g.o> wrote:
2 >
3 > I would expect as much. But my primary argument would be key management related, it is simply impossible to present a raw copy of our repo to end-users and have them verify each commit
4 >
6 While related, I think that the question of distribution is still a
7 fair one. We can still check an infra key on the head commit with git
8 distribution. Granted, if we want to go further than that then the
9 implementation will vary between git vs rsync distribution because the
10 signed git metadata is only available easily in git.
12 --
13 Rich