Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] the update process

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Jeremy Blosser <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] the update process
  • Date: Thu, 4 Dec 2008 10:32:24 -0600

On Dec 04, Jaka Kranjc [smgl AT lynxlynx.info] wrote:
> On Thursday 04 of December 2008 15:34:17 Vasil Yonkov wrote:
> > reason I actually thought the rsync update will be faster :) Moreover,
> > with
> > rsync method, the authentication failed every time (might be a temporary
> > issue), and with git method, Sorcery was telling me every time "there is
> > no
> > verification method!". Well, I thought git has a built in sha1 checksum
> > functionality. Am I wrong?
> That warning means that *we* don't provide means of verification for the
> git
> download. For example, tarballs are GPG signed, but this is impractical for
> sources coming directly from a SCM.

Well, tags can be signed, and all the stable release tags are signed. We
could be checking those for stable. We could theoretically put a signed
tag on test every <x> hours similar to have we create a signed tarball now,
the problem is those tags would spam the repository. We'd want to do
something like fork a distro repo and only tag in that instead of the
actual development repo. Which is not a big deal because we'd already need
to have the repo on multiple servers. I think the plan I was actually
working on at one point was to provide it from bare checkout clones so that
the full devel logs wouldn't be in there either.

Attachment: pgpe6o7cJhXq5.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page