Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

On Thu, Aug 18, 2005 at 04:46:42PM +0200, Flavien Bridault wrote:
> Hi all,
> 
> Now that I become to understand the GPG checking process for spells, I
> noticed, if I understood well ;-), that you have to include a keyring in
> the spell when using a vendor key. That means, referring to a real
> example, that there is a kernel.gpg keyring in the udev spell and the
> same kernel.gpg keyring in the linux spell. 
> Is it not a big problem in the design ? For me, anything redundant is
> bad, and as I heard on IRC "Yes we should resolve that later", I rather
> like to point out this now, in order to avoid later mass changes of
> spells using GPG checking.
> 
> If I'm right (that's finally the question), I will obviously post a
> bug. ;-)
> 

You can keep the key in the spell directory, parent section, or the base
grimoire directory. The code will look in each location in that order
for the file listed in $SOURCE_GPG.

Guru signed spells, for example, use the common gurus.gpg file at the
base of the grimoire. No extra work is needed for the code to find
it there.

In the kernel.gpg case, since the udev spell is in the disk section, and
the linux spell is in the kernel section, we'd just have the kernel.gpg
key in the grimoire base (or move the udev spell, and put the key in
the kernel section).

-Andrew


-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    | acedit at armory.com        |
|Sorcery Team Lead                         | ftp://t.armory.com/         |
--------------------------------------------------------------------------

Attachment: pgpprxTrZV65V.pgp
Description: PGP signature