Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

Thanks for your hard work on this Seth, this should enable us to adapt
more quickly when we need to migrate to new verification procedures.

All spells except those with custom PRE_BUILDS that do their own unpacking
can start being converted now. Previous versions of sorcery will just
use MD5 like normal.

-Andrew

On Mon, Apr 04, 2005 at 10:03:03AM -0700, Seth Alan Woolley wrote:
> Long Subject: spell gnupg authentication (vendor or guru-supplied) and 
> arbitrary hash support (and hashsum spell providing high-bit hashes) in 
> devel sorcery and devel/test grimoire.
> 
> Here's the meat of the change:
> http://perforce.smee.org:8080/@@//sgl/sorcery/devel/var/lib/sorcery/modules/libgrimoire?ac=19&rev1=15&rev2=16
> 
> Here's the bug and description of the major changes:
> http://bugs.sourcemage.org/show_bug.cgi?id=8047#c6
> 
> It is fully backwards compatible (in theory).  The major changes are 
> that you will eventually be using an unpack_file() call in PRE_BUILD 
> (when it's in sorcery stable for a while) to do *custom unpacking*.  
> regular unpack() is being deprecated.
> 
> If you're *not* doing custom unpacking, the default_pre_build is sane 
> enough to figure out what you want to do from just some DETAILS edits.
> 
> As usual if you are doing more than one SOURCE that needs to be checked 
> (or more than two SOURCEs in the case of a vendor-supplied gpg 
> signature), you'll need to do some PRE_BUILD overriding to add in 
> unpack_file for the other SOURCEs.  unpack_file takes one argument: the 
> suffix of SOURCE of the source you wish to check '' '2' '3' '4', ..., 
> 'n'.  It figures the rest out on its own.
> 
> If you're done testing the test branch and feel like checking it out you 
> can try the devel branch and cast hashsum (which hasn't been tested to 
> build on more than x86).  If you want to convert over to gpg signatures 
> now, you can, but you have to leave the MD5[n] variables in for stable 
> sorcery.  
> 
> Please also remember if you are using SOURCE_HASH (which is not 
> preferred; SOURCE_GPG will be preferred), I'm using the *compressed* 
> tarball, not the uncompressed tarball.  Since we removed FUZZ support a 
> while ago checking on the uncompressed tarball is superfluous, 
> complicated, and not much of a performance boost on a modern linux 
> kernel.
> 
> Any comments?  Leave them here or at the bug.
> 
> If it proves to be stable I'll add checking support to gaze checkmd5s 
> for the new API.
> 
> Now hopefully I can move on to QA work soon as I plan.
> 
> Seth
> 
> -- 
> Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
> Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737  F2FF 7A3F 6D3C 00BA 3AF3
> http://smgl.positivism.org:11371/pks/lookup?op=get&search=0x00BA3AF3
> Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org



> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss


-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    | acedit at armory.com        |
|Sorcery Team Lead                         | ftp://t.armory.com/         |
--------------------------------------------------------------------------

Attachment: pgpwPgF7xv_iE.pgp
Description: PGP signature