Re: [gentoo-project] Call for agenda items - Council meeting on 2022-02-13

[Rich Freeman]

On Wed, Feb 9, 2022 at 6:16 PM Robin H. Johnson <robbat2@g.o> wrote:
>
> Potential families of solutions as I proposed:
> ----------------------------------------------
> 1) make 1:1 upstream distfile to gentoo distfile official and accepted
>    EVEN if a package has tens of thousands of distfiles.
> 1.1) Provide a way to share duplicated Manifest entries between packages
>
> 2) make distfile bundling "official", accepting large growth in mirror usage
> 2.1) This would include tooling to make it easy, repeatable, verifiable etc.
>
> 3) Additional fetch phases, that depend on inputs from src_unpack: this
>    would run things like ecosystem-specific fetch tooling.
>    That tooling would be responsible for the steps I mentioned above,
>    parallel download, verifications, writing to distdir in a way the
>    ecosystem could use

I'm not sure I'd recommend it, but another option would be to have an
additional layer of manifest/URL references.

You put foo.ref in your SRC_URI, and it gets manifested as usual.
foo.ref is a text file with a list of URLs and hashes, which get
fetched and verified.  That could be done by calling a function in a
new extra fetch phase, or by putting it additionally in some variable
that an eclass accepts.

You could instead put foo.ref in some other variable defined by the
EAPI if you want portage to be able to handle it directly in the fetch
phase.  It would be like a special SRC_URI that gets around length
issues and the need to store the manifests in the repo.  That would
lock down the defined behavior in a secure manner and now there is no
extra phase.

Either way though you still get a bazillion small files hosted
somewhere and which need to be fetched, hopefully in an efficient
manner.  It is secure because everything is hashed and tied to the
manifest in the repo, but as a single file.

-- 
Rich