Re: [gentoo-user] Reading the (SSL) traffic with Pale Moon

[Miroslav Rovis]

Very useful! Thanks! 

But only quick notes now.

On 161220-03:00-0500, Walter Dnes wrote:
> On Mon, Dec 19, 2016 at 01:25:19PM +0100, Miroslav Rovis wrote
>
> > And I'm very curious to learn how to install in Air-Gapped, from git,
> > through intermediary action, that is acceptable, but in a verifiable
> > way, as I asked in my other reply email to this message.
>
>   The Pale Moon project is located at...
> https://github.com/MoonchildProductions/Pale-Moon

I see.

And one thing appears to be missing for me. *IIUC* <-- pls. note.

The tags are not verified on the Pale Moon repo above! Do you see that
they are, if you open:
https://github.com/MoonchildProductions/Pale-Moon/tags
?
I don't!

*IIUC* <-- pls. note.

Do you see that my tags are verified, e.g. if you open:

https://github.com/miroR/tshark-hosts-conv/tags
and by clicking on "Verified" link, you should see:

This tag was signed with a verified signature.
@miroR
miroR
Miroslav Rovis
GPG key ID: EA9884884FBAF0AE Learn about signing commits

Or am I again missing something?

And if the tags are not verified, I may do the below, but I still don't
feel right.

I'm used to webrsync-gpg which is obsolete in comparison to git, but
it's so safe, because all the the portage, including distfiles, all is
PGP verifiable!

I leave your instuctions below, since this is really useful, and it's a
possible route for me to take... But...

>   The current release branch is "27.0_Relbranch".  I'm not a programmer,
> and I don't push commits back to the project.  So I don't need the full
> depth and history.  The following command grabs the latest 27.0.x source
> and downloads it to a directory pmsrc/ and only downloads what is needed
> to do a build.
>
> git clone -b 27.0_RelBranch --depth 1 https://github.com/MoonchildProductions/Pale-Moon.git pmsrc
>
>   To save typing, I made a script "getcode".  I merely have to type
> ./getcode 27.0
>
>   The script consists of 2 lines...
>
> #!/bin/bash
> git clone -b "${1}_RelBranch" --depth 1 https://github.com/MoonchildProductions/Pale-Moon.git pmsrc
>
>   Note that this picks up the latest git tag.  You can force a specific
> tag (e.g. 27.0.0 or 27.0.1 or 27.0.2) if you use the appropriate git
> command.  Once the the pmsrc/ subdirectory is populated, you can...
>
> cp -r pmsrc/ <usb_stick>/pmsrc/
>
>    walk over to the air-gapped machine and...
>
> cp -r <usb_stick>/pmsrc/ pmsrc/
>
>    and then do a "-march=native" build on the air-gapped machine.
>
> --
> Walter Dnes <waltdnes@××××××××.org>
> I don't run "desktop environments"; I run useful applications
>

... But also, the time on my hands is an issue. If the Gentoo overlay
prooves easier and quicker, I may go that other way...

And which way I go may also depend on which one I get to verifiably install...

Yes, verifiability is my sine qua non!

I have to say, I had no issues with installing from Gentoo palemoon
overlay, and I may open an issue about verification there, or in main
Pale Moon repo...

E.g. there are never even any tags at all on:

https://github.com/deuiore/palemoon-overlay/tags

If I understand correctly. <-- pls. note.

All this in the wake of my asking Gentoo devs about the verifiability in
git:

Is it safe to switch from webrsync to the git repo now?
http://www.gossamer-threads.com/lists/gentoo/dev/320922

Really thanks a lot.
-- 
Miroslav Rovis
Zagreb, Croatia
http://www.CroatiaFidelis.hr