Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Spell GPG Checking Book Page

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Spell GPG Checking Book Page
  • Date: Thu, 28 Jul 2005 10:33:13 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 28 Jul 2005, Jeremy Blosser (emrys) wrote:
On Jul 28, Jason Flatt [jflatt AT sourcemage.org] wrote:
On Thursday, July 28, 2005 07:07 am, Jeremy Blosser (emrys) wrote:
Every file you want downloaded needs to have a SOURCEn, a SOURCEn_URL, and
a SOURCEn_GPG field in DETAILS. Some of those SOURCEs may be signatures,
in which case their SOURCEn_GPG field will be "signature", and they will
themselves be referenced in the SOURCEn_GPG fields of other SOURCEs. GPG
checking is just done in a way that it works using most of the existing
sorcery SOURCE mechanisms. Does that make it any clearer? Both of the
examples he gives are possible. There's nothing special about SOURCE2
except that in the bottom case it was the next available SOURCEn. In the
top case you're not downloading the signatures, they're coming bundled with
the spell, so they local references. If you needed to download them there
though you'd likely use SOURCE3 and SOURCE4 for the sigs to download since
those are the next available SOURCEn numbers.

Yes, thank you, that does clarify the issue for me. I guess I was also
confusing the idea about vendor supplied and guru supplied signatures, which
probably didn't help matters. :^)

I was a bit intimidated walking into learning how spell GPG checking works,
even though I know a fair bit about GPG usage/theory/etc., just because the
nature of the examples I was looking at made it look like there were things
to figure out. I found that the implementation is actually quite simple.
If people are working on wrapping their head around this, the best advice I
can give would be: don't make it too hard. The sorcery implementation is
really quite simple. For vendor sigs just add another SOURCE like you
would for anything else and then use it in the SOURCEn_GPG line. If the
vendor doesn't supply a sig it just means it's yet another time you're
providing an extra source with the spell files, like a patch. The
variables aren't magical, and the only really new one is SOURCEn_GPG, which
has just one legal and pretty straightforward usage.

If no GPG SOURCEn is needed, then SOURCE_GPG works (at least in the
three spells I've written with GPG verification) instead of using
SOURCEn_GPG.

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFC6RbdHXt9dKjv3WERArN8AJ9bCNI+Nl0EskcwBtu64U3Yn3L6hQCeLxs4
miXJTjZNQwqeqbduoFqvxjM=
=cl9n
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page