Public SourceMage Discussion List

[Ondra Tomecka <otom7630 AT lucy.troja.mff.cuni.cz>]

On Thu, 28 Apr 2005, Eric Sandall wrote:

> Quoting "David Michael Leo Brown Jr." <dmlb2000 AT excite.com>:
> > Many times, either in the process of helping get smgl users up to pure 
> > 64bit
> > systems with x86-64 or trying to sort out compile errors with basesystem, 
> > I
> > have
> > had to offer my cache files to help fix their machines.
> >
> > Many times problems with basesystem can cascade into greater problems that
> > cause
> > the system to be completely unusable.  The fact that we allow users to do
> > this is
> > one of the things I love about sourcemage.  However, I think we should 
> > offer
> > a way
> > for users to get at least their basesystem back from cache files without
> > having to
> > either find the cd or download and burn the cd.  Also, the cd doesn't 
> > always
> > come with the latest versions of spells, in some instances this would 
> > force
> > users to
> > reinstall the basesystem from the cd just to get something workable (ie 
> > glibc
> > being out of date on the cd vs. the one they might have installed).
> >
> > I would like to see ppc, x86-64, sparc, i386 and i686 cache files on the
> > mirror.
> > I suggest both i386 and i686 because of the number of people that have 
> > i686
> > or
> > greater machines.
> >
> > I will offer my x86-64 basesystem spells for the mirror if they are 
> > needed,
> > however my other machines compile for pentium[34] so they won't do.
> 
> I like this idea. We can put the tarballs under
> http://download.sourcemage.org/cache/<architecture>/ (e.g.
> http://download.sourcemage.org/cache/i386/). I'd like to request volunteers 
> to
> build these caches and that all spells for this have all optional 
> dependencies
> off (so that we have just the bare-minimum needed and don't require people 
> to
> install extra packages for a quickfix).
> 
> Luckily Sorcery has this feature called install_root[0] that will allow 
> anyone
> to do this without having to rebuild their system. :) Just set it up to use
> /opt/smgl for INSTALL_ROOT and STATE_ROOT and you're set.
> 
> One problem I due see with this, however, is that we'd have to keep these
> binaries up-to-date. That may not be fun.
> 
> Required architectures:
> x86: i386, i686
> x86-64: x86-64, x86-32
> ppc: g3, g4
> 
> Anyone see problems with that list? We may have to drop i386 and do i486 as 
> i386
> cannot do glibc+NPTL.
> 

There should probably also some distinction for higher cpu-specific 
optimization flags, as spells compiled with -msse2 may not work on 
pentium3 cpu, but both of them are marked as i686. Or do you think it 
would be better to compile spells specifically without those higher-level 
optimizations for this tarball cache?

And don't forget that this has potential for a huge security hole, when 
some malicious user contributes tarball with modified binary. How are we 
supposed to detect such a thing, or prevent it at all? Not that I think 
such tarball cache is bad idea, it would save me quite a lot of time 
sometimes, but still this security concern is a big one.

Andy