Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Jul 28, Jason Flatt [jflatt AT sourcemage.org] wrote:
> On Tuesday, July 26, 2005 12:09 pm, David Brown wrote:
> > On 7/26/05, Robin Cook <rcook AT wyrms.net> wrote:
> > > How would spell with multiple source files be handled?
> > >
> > > CuZnDragon
> > > Robin Cook
> > >
> > Well I probably should add a dummy second source to the example
> > but it would look something like this
> >
> > SOURCE=gcc-core-$VERSION.tar.bz2
> > SOURCE2=gcc-$SPELL-$VERSION.tar.bz2
> >
> > I don't know if gcc has a public key or not but if you signed it...
> >
> > SOURCE_GPG="gurus.gpg:${SOURCE}.sig"
> > SOURCE2_GPG="gurus.gpg:${SOURCE2}.sig"
> >
> > The n in SOURCEn and the SOURCEn_GPG are the same parallel
> >
> > - David Brown
> 
> I'm a little confused between your comments here and the Web page.  
> According 
> to the Web page, in the area titled "Where the files go":
> 
> '3.  The signature file: Specify this file using a SOURCE2 and SOURCE2_URL 
> pointing at the vendor supplied signature if it exists...'
> 
> And in your Changes in DETAILS section, you have:
> 
> 'Definition: SOURCEn_GPG="<public-keyring-file>:<signature-file>"'
> 
> and latter on in the example of a gpg'd DETAILS, you have
> 
> 'SOURCE2=${SOURCE}.asc',
> 'SOURCE2_URL=${SOURCE_URL}.asc', and
> 'SOURCE_GPG="linux-wlan.gpg:${SOURCE}.asc"'
> 
> Correct me if I'm wrong, but I'm reading that as the SOURCE2 and 
> SOURCE2_URL 
> fields are referencing the signature file, which seems to contradict your 
> statements above regarding multiple sources.  It seems to me, that either 
> your example DETAILS is wrong (and the previous text regarding SOURCE2 and 
> SOURCE2_URL) and needs to be corrected, or that multiple sources are going 
> to 
> be dealt with differently.

Every file you want downloaded needs to have a SOURCEn, a SOURCEn_URL, and
a SOURCEn_GPG field in DETAILS.  Some of those SOURCEs may be signatures,
in which case their SOURCEn_GPG field will be "signature", and they will
themselves be referenced in the SOURCEn_GPG fields of other SOURCEs.  GPG
checking is just done in a way that it works using most of the existing
sorcery SOURCE mechanisms.  Does that make it any clearer?  Both of the
examples he gives are possible.  There's nothing special about SOURCE2
except that in the bottom case it was the next available SOURCEn.  In the
top case you're not downloading the signatures, they're coming bundled with
the spell, so they local references.  If you needed to download them there
though you'd likely use SOURCE3 and SOURCE4 for the sigs to download since
those are the next available SOURCEn numbers.

Attachment: pgp_X4wrR01l0.pgp
Description: PGP signature