Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Spell GPG Checking Book Page

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Spell GPG Checking Book Page
  • Date: Thu, 28 Jul 2005 08:12:08 -0700

On Thu, Jul 28, 2005 at 09:52:57AM -0500, Jeremy Blosser (emrys) wrote:
> On Jul 28, Jason Flatt [jflatt AT sourcemage.org] wrote:
> > On Thursday, July 28, 2005 07:07 am, Jeremy Blosser (emrys) wrote:
> > > Every file you want downloaded needs to have a SOURCEn, a SOURCEn_URL,
> > > and
> > > a SOURCEn_GPG field in DETAILS. Some of those SOURCEs may be
> > > signatures,
> > > in which case their SOURCEn_GPG field will be "signature", and they will
> > > themselves be referenced in the SOURCEn_GPG fields of other SOURCEs.
> > > GPG
> > > checking is just done in a way that it works using most of the existing
> > > sorcery SOURCE mechanisms. Does that make it any clearer? Both of the
> > > examples he gives are possible. There's nothing special about SOURCE2
> > > except that in the bottom case it was the next available SOURCEn. In
> > > the
> > > top case you're not downloading the signatures, they're coming bundled
> > > with
> > > the spell, so they local references. If you needed to download them
> > > there
> > > though you'd likely use SOURCE3 and SOURCE4 for the sigs to download
> > > since
> > > those are the next available SOURCEn numbers.
> >
> > Yes, thank you, that does clarify the issue for me. I guess I was also
> > confusing the idea about vendor supplied and guru supplied signatures,
> > which
> > probably didn't help matters. :^)
>
> I was a bit intimidated walking into learning how spell GPG checking works,
> even though I know a fair bit about GPG usage/theory/etc., just because the
> nature of the examples I was looking at made it look like there were things
> to figure out. I found that the implementation is actually quite simple.
> If people are working on wrapping their head around this, the best advice I
> can give would be: don't make it too hard. The sorcery implementation is
> really quite simple. For vendor sigs just add another SOURCE like you
> would for anything else and then use it in the SOURCEn_GPG line. If the
> vendor doesn't supply a sig it just means it's yet another time you're
> providing an extra source with the spell files, like a patch. The
> variables aren't magical, and the only really new one is SOURCEn_GPG, which
> has just one legal and pretty straightforward usage.

Thanks for the feedback and discussion, would it be possible to include
some of this additional explaination in the document?

-Andrew


--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | acedit at armory.com |
|Sorcery Team Lead | ftp://t.armory.com/ |
--------------------------------------------------------------------------




Archive powered by MHonArc 2.6.24.

Top of Page