| 1 |
-----BEGIN PGP SIGNED MESSAGE----- |
| 2 |
Hash: SHA1 |
| 3 |
|
| 4 |
ok. basically I'm trying to get a jump on the rest of portage to allow us |
| 5 |
(through repoman) to get the tree populated with signed Manifests ready for |
| 6 |
when portage is able to use them. |
| 7 |
|
| 8 |
Their are several choices available for where the sigs will be, and various |
| 9 |
advantages and disadvantages. I'm basically waiting to implement one of these |
| 10 |
until a decision is made. It will then be ready in short order and ready to |
| 11 |
use as soon as carpaski applies the patch against portage and commits it, |
| 12 |
etc. |
| 13 |
|
| 14 |
Choices: |
| 15 |
|
| 16 |
a) Signing inline in current Manifest file. |
| 17 |
|
| 18 |
Advantages |
| 19 |
1) Low filestorage overhead in the short and long term |
| 20 |
|
| 21 |
Disadvantages |
| 22 |
1) Current versions of portage will be unable to parse these files |
| 23 |
2) More difficult to parse and post than a seperate signature. |
| 24 |
|
| 25 |
Overall |
| 26 |
Basically (a) is an impossibility as it would require everyone to upgrade |
| 27 |
portage before introuducing signing. |
| 28 |
|
| 29 |
|
| 30 |
b) Signing inline in a new Manifest.asc file |
| 31 |
|
| 32 |
Advantages |
| 33 |
1) Gets around the problem of old/new portage as old portage will continue to |
| 34 |
use the Manifest files and new portage will use the new signed Manifest.asc |
| 35 |
files as soon as that "new" portage exists. The old Manifests can be phased |
| 36 |
out after a time. |
| 37 |
2) Increase in number of files in portage tree is only in the short term |
| 38 |
|
| 39 |
Disadvantages |
| 40 |
1) Increase in number of files in portage tree in the short term. |
| 41 |
2) More difficult to parse and post than a seperate signature. |
| 42 |
|
| 43 |
Overall |
| 44 |
Possible, can be implemented now, best implementation from a portage tree size |
| 45 |
point of view. |
| 46 |
|
| 47 |
c) Detached Signing in a Manifest.asc file |
| 48 |
|
| 49 |
Advantages |
| 50 |
1) Gets around the problem of old/new portage as old portage will continue to |
| 51 |
use the Manifest files and new portage will use the new signed Manifest.asc |
| 52 |
in conjunction with the old Manifest files as soon as that portage exists. |
| 53 |
2) Easy to parse and post, especially for uses such as grabbing the sigs for |
| 54 |
posting on packages.gentoo.org |
| 55 |
|
| 56 |
Disadvantages |
| 57 |
1) Increase in number of files in portage tree in short and long term |
| 58 |
|
| 59 |
Overall |
| 60 |
Possible, can be implemented now, best implementation from a usability point |
| 61 |
of view |
| 62 |
|
| 63 |
____________________________ |
| 64 |
|
| 65 |
Swift responses would be appreciated as I want to get this into repoman as |
| 66 |
soon as possible so that at the very least, wary users can manually check |
| 67 |
their Manifests signatures if they are worried. This will also enable the |
| 68 |
rest of portage to use the signatures as soon as it is ready to use them. |
| 69 |
|
| 70 |
Apologies for cross-posting this to -core but I thought everyone should be |
| 71 |
aware of this issue seeing as it has been brought to all our attentions of |
| 72 |
late. Please continue the discussion on gentoo-portage-dev@g.o list. |
| 73 |
|
| 74 |
Puggy |
| 75 |
-----BEGIN PGP SIGNATURE----- |
| 76 |
Version: GnuPG v1.2.3 (GNU/Linux) |
| 77 |
|
| 78 |
iD8DBQE/05UTXYnvgFdTojMRAggGAKCY65KRWeYmTABNbkuUwXOIkcGgqACbBQ/K |
| 79 |
8WIcisb+VwYmyEMEQrQts0o= |
| 80 |
=cbed |
| 81 |
-----END PGP SIGNATURE----- |
| 82 |
|
| 83 |
|
| 84 |
-- |
| 85 |
gentoo-portage-dev@g.o mailing list |
Archives