Public SourceMage Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

On Dec 04, Jaka Kranjc [smgl AT lynxlynx.info] wrote:
> On Thursday 04 of December 2008 15:34:17 Vasil Yonkov wrote:
> > reason I actually thought the rsync update will be faster :) Moreover, 
> > with
> > rsync method, the authentication failed every time (might be a temporary
> > issue), and with git method, Sorcery was telling me every time "there is 
> > no
> > verification method!". Well, I thought git has a built in sha1 checksum
> > functionality. Am I wrong?
> That warning means that *we* don't provide means of verification for the 
> git 
> download. For example, tarballs are GPG signed, but this is impractical for 
> sources coming directly from a SCM.

Well, tags can be signed, and all the stable release tags are signed.  We
could be checking those for stable.  We could theoretically put a signed
tag on test every <x> hours similar to have we create a signed tarball now,
the problem is those tags would spam the repository.  We'd want to do
something like fork a distro repo and only tag in that instead of the
actual development repo.  Which is not a big deal because we'd already need
to have the repo on multiple servers.  I think the plan I was actually
working on at one point was to provide it from bare checkout clones so that
the full devel logs wouldn't be in there either.

Attachment: pgpe6o7cJhXq5.pgp
Description: PGP signature