Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 8047] gpg checking for spells

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 8047] gpg checking for spells
  • Date: Mon, 4 Apr 2005 09:10:41 -0700 (PDT)

http://bugs.sourcemage.org/show_bug.cgi?id=8047





------- Additional Comments From seth AT tautology.org 2005-04-04 09:10 -------
> ## unpack_file takes the SOURCE suffix and figures out if it is supposed
> ## to md5 or gpg check it -- then it does its dirty work and runs unpack
> ## or unpack_gpg depending upon the circumstances.
> ##
> ## nine valid formats: vendor-provided gpg, guru-provided gpg, md5sum
> ## compressed md5sum, sha1sum, sha256sum, sha384sum, sha512sum, ripemd160sum
> ##
> ## SOURCE=blah
> ## SOURCE2=blah.asc
> ## SOURCE_URL=http://blah.com/$SOURCE
> ## SOURCE2_URL=http://blah.com/$SOURCE2
> ## SOURCE_GPG=blah.gpg:$SOURCE2
> ## SOURCE2_GPG=SIGNORE # for auditing purposes
> ##
> ## SOURCE=blah
> ## SOURCE_URL=http://blah.com/$SOURCE
> ## SOURCE_GPG=swoolley.gpg:$SPELL_DIRECTORY/$SOURCE.asc
> ##
> ## SOURCE=blah
> ## SOURCE_URL=http://blah.com/$SOURCE
> ## MD5[0]=d41d8cd98f00b204e9800998ecf8427e
> ##
> ## SOURCE=blah
> ## SOURCE_URL=http://blah.com/$SOURCE
> ## SOURCE_HASH=md5:d41d8cd98f00b204e9800998ecf8427e
> ##
> ## hashes supported: sha1 md5 (more with hashsum installed ;) )

The arbitrary hash support is on the ORIGINAL COMPRESSED tarball on the
SORCERY_HASH format, by the way. It makes the code much cleaner and the OS
has
cached the disk read anyways, so it shouldn't be that much of a performance
hit
(and we really should be doing it the way everybody else does it so it's easy
to
verify).

Also what I mean by sorcery suffix is that you can use:

unpack_file 2
and it will unpack the second source. If you have a vendor-supplied signature
you can just skip past it and go straight to 3 (as SOURCE_GPG already
references
SOURCE2 we just put SOURCE2_GPG=SIGNORE so that my audit scripts know that
yes,
you really intended SOURCE2 to be a signature and didn't accidentally forget
about it.

If the guru supplies the signature file they can just increment the VERSION
field and re-create the signature and put it in the spell directory. All
files
referenced in my code use a new function that searches the spell hierarchy and
lastly SOURCE_CACHE for the correct file, so it should be enough in all but
the
most strange circumstances to simply specify just the filename for either the
.gpg or the .asc file (.sig/.sign works too -- gpg doesn't care).

Any questions? It's in devel sorcery now. If there are no changes I'll
change
gaze checkmd5s to support both new verification types.

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.




Archive powered by MHonArc 2.6.24.

Top of Page