Re: [gentoo-dev] [GLEP78] Updating specification

[Ulrich Mueller]

>>>>> On Mon, 13 Sep 2021, Sheng Yu wrote:

> -The archive contains a number of files, stored in a single directory
> -whose name should match the basename of the package file.  However,
> -the implementation must be able to process an archive where
> -the directory name is mismatched.  There should be no explicit archive
> -member entry for the directory.
> +The archive contains a number of files.  All package-related files
> +should be stored in a single directory whose name matches the CPV of
> +the package file.  However, the implementation must be able to process
> +an archive where the directory name is mismatched.  There should be no
> +explicit archive member entry for the directory.

I wonder about CPV here. That's ${CATEGORY}/${P} and contains a slash,
so it cannot be the name of a directory. Also, what about the package
revision?

> +6. The package manifest data file ``Manifest`` (required).
> +
> +7. A signature for the package Manifest file ``Manifest.sig``
> +   (optional).

Given that the outer archive is uncompressed tar, every file will be
zero-padded to a full block which adds some amount of bloat. So, could
the signature be inlined in the Manifest file? That's also what GLEP 74
specifies.

Also, IIRC one of the goals of the format was to allow partial download
of metadata. That will only work if the Manifest file will be the first
file in the archive (or at least appear before the image archive).

> +The implementation follows the Manifest specifications in GLEP 74
> +[#GLEP74]_ and uses the DATA tag for files within the archive.

AFAICS, GLEP 74 specifies an OpenPGP cleartext signature in the file
itself, not a detached signature.

Ulrich