1 |
-----BEGIN PGP SIGNED MESSAGE----- |
2 |
Hash: SHA1 |
3 |
|
4 |
Ok, it has been brought to my attention that conveniantly the parsing of the |
5 |
current Manifest file only looks at lines starting with MD5, so option (a) is |
6 |
indeed possible after all. It basically replaces option (b) but without the |
7 |
problem of increasing the number of files in portage in the short term. |
8 |
This now looks like the easiest solution to implement but still their is the |
9 |
ease of parsing argument for the seperate signatures. |
10 |
|
11 |
Puggy |
12 |
|
13 |
On Sunday 07 December 2003 9:01 pm, Douglas Russell wrote: |
14 |
> ok. basically I'm trying to get a jump on the rest of portage to allow us |
15 |
> (through repoman) to get the tree populated with signed Manifests ready for |
16 |
> when portage is able to use them. |
17 |
> |
18 |
> Their are several choices available for where the sigs will be, and various |
19 |
> advantages and disadvantages. I'm basically waiting to implement one of |
20 |
> these until a decision is made. It will then be ready in short order and |
21 |
> ready to use as soon as carpaski applies the patch against portage and |
22 |
> commits it, etc. |
23 |
> |
24 |
> Choices: |
25 |
> |
26 |
> a) Signing inline in current Manifest file. |
27 |
> |
28 |
> Advantages |
29 |
> 1) Low filestorage overhead in the short and long term |
30 |
> |
31 |
> Disadvantages |
32 |
> 1) Current versions of portage will be unable to parse these files |
33 |
> 2) More difficult to parse and post than a seperate signature. |
34 |
> |
35 |
> Overall |
36 |
> Basically (a) is an impossibility as it would require everyone to upgrade |
37 |
> portage before introuducing signing. |
38 |
> |
39 |
> |
40 |
> b) Signing inline in a new Manifest.asc file |
41 |
> |
42 |
> Advantages |
43 |
> 1) Gets around the problem of old/new portage as old portage will continue |
44 |
> to use the Manifest files and new portage will use the new signed |
45 |
> Manifest.asc files as soon as that "new" portage exists. The old Manifests |
46 |
> can be phased out after a time. |
47 |
> 2) Increase in number of files in portage tree is only in the short term |
48 |
> |
49 |
> Disadvantages |
50 |
> 1) Increase in number of files in portage tree in the short term. |
51 |
> 2) More difficult to parse and post than a seperate signature. |
52 |
> |
53 |
> Overall |
54 |
> Possible, can be implemented now, best implementation from a portage tree |
55 |
> size point of view. |
56 |
> |
57 |
> c) Detached Signing in a Manifest.asc file |
58 |
> |
59 |
> Advantages |
60 |
> 1) Gets around the problem of old/new portage as old portage will continue |
61 |
> to use the Manifest files and new portage will use the new signed |
62 |
> Manifest.asc in conjunction with the old Manifest files as soon as that |
63 |
> portage exists. 2) Easy to parse and post, especially for uses such as |
64 |
> grabbing the sigs for posting on packages.gentoo.org |
65 |
> |
66 |
> Disadvantages |
67 |
> 1) Increase in number of files in portage tree in short and long term |
68 |
> |
69 |
> Overall |
70 |
> Possible, can be implemented now, best implementation from a usability |
71 |
> point of view |
72 |
> |
73 |
> ____________________________ |
74 |
> |
75 |
> Swift responses would be appreciated as I want to get this into repoman as |
76 |
> soon as possible so that at the very least, wary users can manually check |
77 |
> their Manifests signatures if they are worried. This will also enable the |
78 |
> rest of portage to use the signatures as soon as it is ready to use them. |
79 |
> |
80 |
> Apologies for cross-posting this to -core but I thought everyone should be |
81 |
> aware of this issue seeing as it has been brought to all our attentions of |
82 |
> late. Please continue the discussion on gentoo-portage-dev@g.o list. |
83 |
> |
84 |
> Puggy |
85 |
-----BEGIN PGP SIGNATURE----- |
86 |
Version: GnuPG v1.2.3 (GNU/Linux) |
87 |
|
88 |
iD8DBQE/06FPXYnvgFdTojMRAqZXAJ9WZtxtUjSTB8GF19SAmHX/G2UeEQCfYXSY |
89 |
64boL8x1e5cZCc9GtuSaHgk= |
90 |
=mynT |
91 |
-----END PGP SIGNATURE----- |
92 |
|
93 |
|
94 |
-- |
95 |
gentoo-portage-dev@g.o mailing list |