[SM-Discuss] the update process
Jeremy Blosser
jblosser-smgl at firinn.org
Thu Dec 4 11:32:24 EST 2008
On Dec 04, Jaka Kranjc [smgl at lynxlynx.info] wrote:
> On Thursday 04 of December 2008 15:34:17 Vasil Yonkov wrote:
> > reason I actually thought the rsync update will be faster :) Moreover, with
> > rsync method, the authentication failed every time (might be a temporary
> > issue), and with git method, Sorcery was telling me every time "there is no
> > verification method!". Well, I thought git has a built in sha1 checksum
> > functionality. Am I wrong?
> That warning means that *we* don't provide means of verification for the git
> download. For example, tarballs are GPG signed, but this is impractical for
> sources coming directly from a SCM.
Well, tags can be signed, and all the stable release tags are signed. We
could be checking those for stable. We could theoretically put a signed
tag on test every <x> hours similar to have we create a signed tarball now,
the problem is those tags would spam the repository. We'd want to do
something like fork a distro repo and only tag in that instead of the
actual development repo. Which is not a big deal because we'd already need
to have the repo on multiple servers. I think the plan I was actually
working on at one point was to provide it from bare checkout clones so that
the full devel logs wouldn't be in there either.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-discuss/attachments/20081204/128d3323/attachment.bin
More information about the SM-Discuss
mailing list