Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Adding gnupg to every spell

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: SM Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] Adding gnupg to every spell
  • Date: Thu, 9 Feb 2006 13:10:11 -0800 (PST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 8 Feb 2006, Andrew wrote:
On Wed, Feb 08, 2006 at 08:32:05PM -0600, Jeremy Blosser (emrys) wrote:
<snip>
I think if we tried to actually explicitly list *all* the depends in
basesystem, it would become very circular and the ordering wouldn't
actually any better. So, continuing on this path is really a losing
proposition the more I think about it.

Right now we dont have a seperate notion of runtime depends vs build
dependencies. Gnupg, tar, gzip, bzip2 etc are build dependencies in this
context, we need them installed as per build process, but we dont need
them after that. On the other hand, things link to glibc, and some other
core libraries (as well as use the file system tree).

During chroot bootstrapping, the build-depends need to exist on the host
system, which right now is just assumed. Its actually assumed whenever you
run a sorcery command. But, the linking dependencies need to build in the
right order so (ideally) everything can link against their manifestations
in the chroot. A rebuild isn't really all that different. Once all the
core libraries are installed, the rest of basesystem can go in mostly
any order.

So, I think it would best to assume any basesystem *build* dependencies are
already installed, and only have actual listed depends on 'real'
depends. Gnupg is a build depends (so, sorry eric, that could probably
stand to be reverted...), smgl-fhs, glibc, and zlib (maybe some other
libs) are not, on the other hand.

Those need to be depended on somehow. Either explicitly adding each of
them to the base spells or using some indirection. Such as a meta-spell
(as suggested), or using a common file sourced in DEPENDS. The former is
simpler except it reduces sorcery's visibility into the dependency tree,
the later might be disagreeable to some.

-Andrew

The way Sorcery does the checking, gnupg is checked with spell_ok, so
even if the host system has it, if the target does not you get
something like this:
# cast gzip
...
Building gzip
hash checking source file gzip-1.3.5.tar.gz...
This spell has an option to check its integrity via spell gnupg for
sha512, you might consider casting it. Abort? [n]
Unpacking source file gzip-1.3.5.tar.gz for spell gzip.
gzip: doesn't have an MD5 sum for the uncompressed gzip-1.3.5.tar.gz.

gnupg is installed on the host, but since Sorcery doesn't think gnupg
is installed, it doesn't use it.

Perhaps Sorcery should check if the gnupg binary is there instead of
using spell_ok?

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFD66+1HXt9dKjv3WERAkLRAKDJgproPX+xYbkMy2ae7XRdoNa6AACgghtM
76ayNPNEVXMLkgnFpEk8DP4=
=RdeZ
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page