Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] the update process

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Jeremy Blosser <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] the update process
  • Date: Fri, 5 Dec 2008 10:12:28 -0600

On Dec 05, Martin Spitzbarth [m.spitzbarth AT gmx.de] wrote:
> On Thu, December 4, 2008 16:32, Jeremy Blosser wrote:
> > On Dec 04, Jaka Kranjc [smgl AT lynxlynx.info] wrote:
> > Well, tags can be signed, and all the stable release tags are signed. We
> > could be checking those for stable. We could theoretically put a signed
> > tag on test every <x> hours similar to have we create a signed tarball
> > now,
> > the problem is those tags would spam the repository. We'd want to do
> > something like fork a distro repo and only tag in that instead of the
> > actual development repo. Which is not a big deal because we'd already
> > need
> > to have the repo on multiple servers. I think the plan I was actually
> > working on at one point was to provide it from bare checkout clones so
> > that
> > the full devel logs wouldn't be in there either.
>
> I actually like the idea of a stripped down git repository/bare checkouts
> for updating. Signing the commits is not that big a deal because every
> commit already is a complete hash over the project and its history. That
> means that we don't have to put the signatures into the repository, all we
> have to do is publish a signed message that states the current stable
> commit hash.

A tag is a pointer to a commit id. A signed tag is just a signature
referencing a particular commit. Storing it in the repo keeps it all
together and easily accessible.

Attachment: pgphnMaiPRfK7.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page