[SM-Discuss] the update process

Jeremy Blosser jblosser-smgl at firinn.org
Thu Dec 4 11:32:24 EST 2008


On Dec 04, Jaka Kranjc [smgl at lynxlynx.info] wrote:
> On Thursday 04 of December 2008 15:34:17 Vasil Yonkov wrote:
> > reason I actually thought the rsync update will be faster :) Moreover, with
> > rsync method, the authentication failed every time (might be a temporary
> > issue), and with git method, Sorcery was telling me every time "there is no
> > verification method!". Well, I thought git has a built in sha1 checksum
> > functionality. Am I wrong?
> That warning means that *we* don't provide means of verification for the git 
> download. For example, tarballs are GPG signed, but this is impractical for 
> sources coming directly from a SCM.

Well, tags can be signed, and all the stable release tags are signed.  We
could be checking those for stable.  We could theoretically put a signed
tag on test every <x> hours similar to have we create a signed tarball now,
the problem is those tags would spam the repository.  We'd want to do
something like fork a distro repo and only tag in that instead of the
actual development repo.  Which is not a big deal because we'd already need
to have the repo on multiple servers.  I think the plan I was actually
working on at one point was to provide it from bare checkout clones so that
the full devel logs wouldn't be in there either.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-discuss/attachments/20081204/128d3323/attachment.bin 


More information about the SM-Discuss mailing list