Skip to Content.
Sympa Menu

sm-users - Re: [SM-Users] first experiences and problems

sm-users AT lists.ibiblio.org

Subject: Sourcemage Users List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: Thomas Orgis <thomas-forum AT orgis.org>
  • Cc: sm-users AT lists.ibiblio.org
  • Subject: Re: [SM-Users] first experiences and problems
  • Date: Fri, 16 Dec 2005 08:54:51 -0800

On Fri, Dec 16, 2005 at 03:47:56PM +0100, Thomas Orgis wrote:
> Hi Seth!
>
> I agree that a bad package at a download location should not pass
> unnoted. Maybe it should fail at the first time and then ask the user
> at the next cast attempt to choose a different location... That way
> one is annoyed enough to fix the spell but as a user, one can still
> install with the broken spell. Or it should try a different mirror by
> itself but still report (at the end of the whole cast) that there is a
> problem with the spell that should be reported but the spell installed
> successfully. What I want to minimize, is the count of situations
> where you issue a big cast, go to sleep... and see next morning that
> the cast stopped because of an error just some minutes after you left
> the machine.
>
> For that, the most useful thing may be the option to do all
> downloading _and_ validation first (with possibility for user to take
> influence; p.ex. pause the cast and get the file separately or choose
> a different location to try) and then do the compilation
> uninterrrupted and without the possible problem source of network
> tranfsers.

In the past you could summon everything in the queue and run gaze
checkmd5s on the queue. That command is now obsolete, and I'm going to
write a new one based on the new api, probably called "gaze
source-integrity"

I figure that is probably what you want? If so, you don't need to even
look at the code, you can wait for me to write that. ;)

>
> I'll try to look at the code when this continues to urge me...
>
> PS: What I don't really understand is you argument about hashes vs.
> gpg signatures (and why this relates to what I said, anyway). Wouldn't
> an out-of-sync mirror pass the hash check, too if the source and hash
> are kept together? Of course I agree that a hash is inferior in that
> it doesn't preven malicious modification of the source (and simple
> updating of the hash that is kept together with the soruce).

Hashes when used by us are stored in the spell: that provides the "out
of sync"-ness but it also provides for less of an ability to break into
the author's server and allow it to be verified by our spell; they'd
have to break into our system as well and change our own hash.

>
>
> Thomas.
> _______________________________________________
> SM-Users mailing list
> SM-Users AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-users
>

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Key id 63C1E02F = E07A FB0E 5925 CE4A 6526 2AD5 1782 FEC2 63C1 E02F

Attachment: pgpOmd3jBnjvU.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page