Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Thu, Apr 28, 2005 at 06:27:28PM +0200, Ondra Tomecka wrote:
> On Thu, 28 Apr 2005, Eric Sandall wrote:
> 
> > Quoting "David Michael Leo Brown Jr." <dmlb2000 AT excite.com>:
> > > Many times, either in the process of helping get smgl users up to pure 
> > > 64bit
> > > systems with x86-64 or trying to sort out compile errors with 
> > > basesystem, I
> > > have
> > > had to offer my cache files to help fix their machines.
> > >
> > > Many times problems with basesystem can cascade into greater problems 
> > > that
> > > cause
> > > the system to be completely unusable.  The fact that we allow users to 
> > > do
> > > this is
> > > one of the things I love about sourcemage.  However, I think we should 
> > > offer
> > > a way
> > > for users to get at least their basesystem back from cache files without
> > > having to
> > > either find the cd or download and burn the cd.  Also, the cd doesn't 
> > > always
> > > come with the latest versions of spells, in some instances this would 
> > > force
> > > users to
> > > reinstall the basesystem from the cd just to get something workable (ie 
> > > glibc
> > > being out of date on the cd vs. the one they might have installed).
> > >
> > > I would like to see ppc, x86-64, sparc, i386 and i686 cache files on the
> > > mirror.
> > > I suggest both i386 and i686 because of the number of people that have 
> > > i686
> > > or
> > > greater machines.
> > >
> > > I will offer my x86-64 basesystem spells for the mirror if they are 
> > > needed,
> > > however my other machines compile for pentium[34] so they won't do.
> > 
> > I like this idea. We can put the tarballs under
> > http://download.sourcemage.org/cache/<architecture>/ (e.g.
> > http://download.sourcemage.org/cache/i386/). I'd like to request 
> > volunteers to
> > build these caches and that all spells for this have all optional 
> > dependencies
> > off (so that we have just the bare-minimum needed and don't require 
> > people to
> > install extra packages for a quickfix).
> > 
> > Luckily Sorcery has this feature called install_root[0] that will allow 
> > anyone
> > to do this without having to rebuild their system. :) Just set it up to 
> > use
> > /opt/smgl for INSTALL_ROOT and STATE_ROOT and you're set.
> > 
> > One problem I due see with this, however, is that we'd have to keep these
> > binaries up-to-date. That may not be fun.
> > 
> > Required architectures:
> > x86: i386, i686
> > x86-64: x86-64, x86-32
> > ppc: g3, g4
> > 
> > Anyone see problems with that list? We may have to drop i386 and do i486 
> > as i386
> > cannot do glibc+NPTL.
> > 
> 
> There should probably also some distinction for higher cpu-specific 
> optimization flags, as spells compiled with -msse2 may not work on 
> pentium3 cpu, but both of them are marked as i686. Or do you think it 
> would be better to compile spells specifically without those higher-level 
> optimizations for this tarball cache?
> 
> And don't forget that this has potential for a huge security hole, when 
> some malicious user contributes tarball with modified binary. How are we 
> supposed to detect such a thing, or prevent it at all? Not that I think 
> such tarball cache is bad idea, it would save me quite a lot of time 
> sometimes, but still this security concern is a big one.

Agreed on both points.  I think it's simpler if I just publish what I'll 
have worked on with prometheus.  This is also an opportunity to test out 
resurrection now that it's becoming quite usable.

Seth

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737  F2FF 7A3F 6D3C 00BA 3AF3
Quality Assurance Team Leader; Security Team Member, Leader Emeritus
Linux so advanced, it may as well be magic http://www.sourcemage.org
Elected Coordinating Committee Member, Secretary, and Finances Chair
Pacific Green Party of Oregon - Peace - http://www.pacificgreens.org

Attachment: pgp7IpPqq4anu.pgp
Description: PGP signature