[SM-Discuss] Adding gnupg to every spell
Eric Sandall
eric at sandall.us
Thu Feb 9 16:10:11 EST 2006
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Wed, 8 Feb 2006, Andrew wrote:
> On Wed, Feb 08, 2006 at 08:32:05PM -0600, Jeremy Blosser (emrys) wrote:
<snip>
> I think if we tried to actually explicitly list *all* the depends in
> basesystem, it would become very circular and the ordering wouldn't
> actually any better. So, continuing on this path is really a losing
> proposition the more I think about it.
>
> Right now we dont have a seperate notion of runtime depends vs build
> dependencies. Gnupg, tar, gzip, bzip2 etc are build dependencies in this
> context, we need them installed as per build process, but we dont need
> them after that. On the other hand, things link to glibc, and some other
> core libraries (as well as use the file system tree).
>
> During chroot bootstrapping, the build-depends need to exist on the host
> system, which right now is just assumed. Its actually assumed whenever you
> run a sorcery command. But, the linking dependencies need to build in the
> right order so (ideally) everything can link against their manifestations
> in the chroot. A rebuild isn't really all that different. Once all the
> core libraries are installed, the rest of basesystem can go in mostly
> any order.
>
> So, I think it would best to assume any basesystem *build* dependencies are
> already installed, and only have actual listed depends on 'real'
> depends. Gnupg is a build depends (so, sorry eric, that could probably
> stand to be reverted...), smgl-fhs, glibc, and zlib (maybe some other
> libs) are not, on the other hand.
>
> Those need to be depended on somehow. Either explicitly adding each of
> them to the base spells or using some indirection. Such as a meta-spell
> (as suggested), or using a common file sourced in DEPENDS. The former is
> simpler except it reduces sorcery's visibility into the dependency tree,
> the later might be disagreeable to some.
>
> -Andrew
The way Sorcery does the checking, gnupg is checked with spell_ok, so
even if the host system has it, if the target does not you get
something like this:
# cast gzip
...
Building gzip
hash checking source file gzip-1.3.5.tar.gz...
This spell has an option to check its integrity via spell gnupg for
sha512, you might consider casting it. Abort? [n]
Unpacking source file gzip-1.3.5.tar.gz for spell gzip.
gzip: doesn't have an MD5 sum for the uncompressed gzip-1.3.5.tar.gz.
gnupg is installed on the host, but since Sorcery doesn't think gnupg
is installed, it doesn't use it.
Perhaps Sorcery should check if the gnupg binary is there instead of
using spell_ok?
- -sandalle
- --
Eric Sandall | Source Mage GNU/Linux Developer
eric at sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFD66+1HXt9dKjv3WERAkLRAKDJgproPX+xYbkMy2ae7XRdoNa6AACgghtM
76ayNPNEVXMLkgnFpEk8DP4=
=RdeZ
-----END PGP SIGNATURE-----
More information about the SM-Discuss
mailing list