Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] the update process

sm-discuss AT

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Martin Spitzbarth" <m.spitzbarth AT>
  • To: sm-discuss AT
  • Subject: Re: [SM-Discuss] the update process
  • Date: Fri, 5 Dec 2008 10:31:21 -0000 (UTC)

On Thu, December 4, 2008 16:32, Jeremy Blosser wrote:
> On Dec 04, Jaka Kranjc [smgl AT] wrote:
> Well, tags can be signed, and all the stable release tags are signed. We
> could be checking those for stable. We could theoretically put a signed
> tag on test every <x> hours similar to have we create a signed tarball
> now,
> the problem is those tags would spam the repository. We'd want to do
> something like fork a distro repo and only tag in that instead of the
> actual development repo. Which is not a big deal because we'd already
> need
> to have the repo on multiple servers. I think the plan I was actually
> working on at one point was to provide it from bare checkout clones so
> that
> the full devel logs wouldn't be in there either.

I actually like the idea of a stripped down git repository/bare checkouts
for updating. Signing the commits is not that big a deal because every
commit already is a complete hash over the project and its history. That
means that we don't have to put the signatures into the repository, all we
have to do is publish a signed message that states the current stable
commit hash.

I guess it would be overkill to use DNS TXT records for that, but now that
there is a discussion I can as well mention it.

Sorry for the missing gpg signature and everything else that might be
screwed with this mail. I am using squirrelmail for the first time and
don't have access to my linux machine until later today.

Archive powered by MHonArc 2.6.24.

Top of Page