Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Wed, Nov 24, 2004 at 09:10:50AM -0800, Andrew wrote:
> On Wed, Nov 24, 2004 at 09:01:04AM -0800, Seth Alan Woolley wrote:
> > On Wed, Nov 24, 2004 at 08:19:37AM -0800, Andrew wrote:
> > > On Wed, Nov 24, 2004 at 11:34:19AM +0100, Eric D. Schabell M.Sc. wrote:
> > > > On Wednesday 24 November 2004 10:45, neuron wrote:
> > > > > > The tarball is broken, it will damage your installed sorcery.
> > > > >
> > > > Too bad we don't have SORCERY_MIRRORS anymore, might have gotten a 
> > > > good copy 
> > > > from somewhere else....
> > > > 
> > > Haha very funny, take your flames and bitter feelings elsewhere. Besides
> > > what if it was broken on the perforce server? Everything would be 
> > > broken.
> > > 
> > > In anycase i updated a known good copy on the server SINCE I CAN, and
> > > if we had mirrors I couldnt unless I have an acocunt there! Please 
> > > re-read
> > > previous discussions on why we dont have sorcery mirrors. Unless your
> > > willing to setup round-robin dns for it, its not happening.
> > 
> > I can have round-robin DNS setup in a couple minutes.
> > 
> > I also thought sorcery update used the libdownload code which respected 
> > our mirroring logic so RRDNS wasn't needed.
> > 
> > In fact, R'ingTFS, it looks like it uses dl_source() in 
> > update_sorcery_scripts() at the beginning of libsorcery.
> > 
> 
> If dl_source is still in your version of sorcery you must be pretty out
> of date.

True, I looked at an older version of sorcery so it must have been 
updated since then.

> 
> In anycase Id need at least some sort of access to all mirrors via ssh
> keys so I could update new stuff, and possibly fix other problems, like
> broken or compromised tarballs. Id rather not have to depend on someone
> else to fix problems for me, it'd be nice also to be able to adjust the
> rr mirrors your dns knows about easily, not that you're every really
> not online. 

Getting you direct access to the RR tables is pretty simple.

> Also we really ought to have the update scripts run from
> cron do at least some basic tarball sanity checking (does it unpack,
> does install install to cmd line argument (install /tmp/test-install/).
> Of course, also, we'd need another hostname to point at for sorcery
> since currently we just use the downloads.sourcemage.org and round robin
> dns'ing that would imply that sorcery mirrors would be full mirrors.

True, we can have sorcery.downloads.sourcemage.org RR'd.

> 
> And it'd also be nice to have the tarballs gpg signed so its harder to
> compromise them...(and more obvious when they're broken)

Yes, the task I set myself to over thanksgiving, however it won't give 
us much help as far as broken on the server in the devel version, as the 
pgp signing process doesn't check to see if the tarball is sane (we'd 
have to do what you propose above anyways).

I plan on having two pgp keys, one for devel/test versions, one for 
stable releases.  The developer one can be cronned, the stable release 
one can be confirmed and passphrased for higher security.

Seth

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgphmWhpLr7xd.pgp
Description: PGP signature