[gentoo-dev] Re: Gentoo peer-to-peer

[Charles Lacour]

(Apologies for starting a new thread instead of replying to the existing one, but I'm
working from the digest.)

I had a similar idea to this a few weeks ago; here are some thoughts I came up with on it.

As far as binary packages go,

I'm not sure there's any need for USE flags to identify the binary. If two different people
compile a package to identical binaries, what USE flags they had are completely irrelevant.
(Someone might compile a package under another flavor of Linux, for example, in which
case there ARE no USE flags.)

My thought was to build a string describing the package, then run an md5sum on that. I was
thinking of using that as part of the filename, so we might want to create a custom md5sum
that would produce a shorter string (6-8 characters, say).

As a first pass, here's what I'd put in the string. I am FAR from an expert on compiling things,
dependencies, binary compatibility and so forth, so I expect this will need to be modified. I
would suggest everyone post the last string they saw, then their own version, and the reasons
for the modifications. Hopefully we'll have some deletions (like USE flags) as well as additions.

<architecture compiled for> <gcc version> <glibc-version> \
CFLAGS=$CFLAGS CCFLAGS=$CCFLAGS LDFLAGS=$LDFLAGS

The filename would be <package name>-<package version>.<md5sum of string>

I think it would be a good idea to also create an md5sum of a tar of the package, after all patches
have been applied, and configuration has been done,  but before any other action has been taken,
and make that a 3rd node of the name. (That should be of the tar before compression, by the way.)

That would make the full filename

<package name>-<package version>.<md5sum of string>.<md5sum of tar>

This serves two functions: it identifies the other half of the variables in what might affect the final
binary produced (the first half being the stuff in the first identifier string), and it provides a fairly
easy way to verify the binary.  One can create a tar of a source directory and run and md5sum on
it much faster (in most cases) than one can compile it. One could then compare the md5sum from
that to the md5sum in the filename, and if they match, be reasonably confident this isn't spoofed,
especially if there are multiple copies of it out there.



Some people have objected (none too violently, as yet) to this as being "contrary to the spirit of
Gentoo".

When I meet the spirit of Gentoo, I'll be sure to ask it what it thinks, and then decide whether
I wish to be contrary to it.

In the meantime, I'd say the best way to handle this is to give all such people (and anybody else
who wants it, for that matter) permission not to use this, any time they like.

I'm against giving them permission to forbid anyone who wants to explore this idea from doing so,
as giving someone else permission to forbid me from doing things has generally proven to be 
a bad idea. I mean, look at the last time we did it - we got governments.


I like the idea of using this for source as well as binaries; when I'm downloading files from
Gnutella and can get 3 or 4 people to download from at once, I can max out my ADSL line.
>From a lot of FTP servers, I get a lot less.  It would also let me contribute as as server; I have
a fixed IP address, but only a 128K uplink. By myself, I'd be a pretty sorry source for much of
anything. With 8 or 10 people like me, though, I'd be quite useful.