Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Spell GPG Checking Book Page

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Spell GPG Checking Book Page
  • Date: Thu, 28 Jul 2005 09:52:57 -0500

On Jul 28, Jason Flatt [jflatt AT sourcemage.org] wrote:
> On Thursday, July 28, 2005 07:07 am, Jeremy Blosser (emrys) wrote:
> > Every file you want downloaded needs to have a SOURCEn, a SOURCEn_URL, and
> > a SOURCEn_GPG field in DETAILS. Some of those SOURCEs may be signatures,
> > in which case their SOURCEn_GPG field will be "signature", and they will
> > themselves be referenced in the SOURCEn_GPG fields of other SOURCEs. GPG
> > checking is just done in a way that it works using most of the existing
> > sorcery SOURCE mechanisms. Does that make it any clearer? Both of the
> > examples he gives are possible. There's nothing special about SOURCE2
> > except that in the bottom case it was the next available SOURCEn. In the
> > top case you're not downloading the signatures, they're coming bundled
> > with
> > the spell, so they local references. If you needed to download them there
> > though you'd likely use SOURCE3 and SOURCE4 for the sigs to download since
> > those are the next available SOURCEn numbers.
>
> Yes, thank you, that does clarify the issue for me. I guess I was also
> confusing the idea about vendor supplied and guru supplied signatures,
> which
> probably didn't help matters. :^)

I was a bit intimidated walking into learning how spell GPG checking works,
even though I know a fair bit about GPG usage/theory/etc., just because the
nature of the examples I was looking at made it look like there were things
to figure out. I found that the implementation is actually quite simple.
If people are working on wrapping their head around this, the best advice I
can give would be: don't make it too hard. The sorcery implementation is
really quite simple. For vendor sigs just add another SOURCE like you
would for anything else and then use it in the SOURCEn_GPG line. If the
vendor doesn't supply a sig it just means it's yet another time you're
providing an extra source with the spell files, like a patch. The
variables aren't magical, and the only really new one is SOURCEn_GPG, which
has just one legal and pretty straightforward usage.

Attachment: pgpndljXZfFwV.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page