sm-users AT lists.ibiblio.org
Subject: Sourcemage Users List
List archive
- From: Seth Alan Woolley <seth AT positivism.org>
- To: Thomas Orgis <thomas-forum AT orgis.org>
- Cc: sm-users AT lists.ibiblio.org
- Subject: Re: [SM-Users] first experiences and problems
- Date: Fri, 16 Dec 2005 08:54:51 -0800
On Fri, Dec 16, 2005 at 03:47:56PM +0100, Thomas Orgis wrote:
> Hi Seth!
>
> I agree that a bad package at a download location should not pass
> unnoted. Maybe it should fail at the first time and then ask the user
> at the next cast attempt to choose a different location... That way
> one is annoyed enough to fix the spell but as a user, one can still
> install with the broken spell. Or it should try a different mirror by
> itself but still report (at the end of the whole cast) that there is a
> problem with the spell that should be reported but the spell installed
> successfully. What I want to minimize, is the count of situations
> where you issue a big cast, go to sleep... and see next morning that
> the cast stopped because of an error just some minutes after you left
> the machine.
>
> For that, the most useful thing may be the option to do all
> downloading _and_ validation first (with possibility for user to take
> influence; p.ex. pause the cast and get the file separately or choose
> a different location to try) and then do the compilation
> uninterrrupted and without the possible problem source of network
> tranfsers.
In the past you could summon everything in the queue and run gaze
checkmd5s on the queue. That command is now obsolete, and I'm going to
write a new one based on the new api, probably called "gaze
source-integrity"
I figure that is probably what you want? If so, you don't need to even
look at the code, you can wait for me to write that. ;)
>
> I'll try to look at the code when this continues to urge me...
>
> PS: What I don't really understand is you argument about hashes vs.
> gpg signatures (and why this relates to what I said, anyway). Wouldn't
> an out-of-sync mirror pass the hash check, too if the source and hash
> are kept together? Of course I agree that a hash is inferior in that
> it doesn't preven malicious modification of the source (and simple
> updating of the hash that is kept together with the soruce).
Hashes when used by us are stored in the spell: that provides the "out
of sync"-ness but it also provides for less of an ability to break into
the author's server and allow it to be verified by our spell; they'd
have to break into our system as well and change our own hash.
>
>
> Thomas.
> _______________________________________________
> SM-Users mailing list
> SM-Users AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-users
>
--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Key id 63C1E02F = E07A FB0E 5925 CE4A 6526 2AD5 1782 FEC2 63C1 E02F
Attachment:
pgpOmd3jBnjvU.pgp
Description: PGP signature
-
Re: [SM-Users] first experiences and problems
, (continued)
-
Re: [SM-Users] first experiences and problems,
Eric Sandall, 12/03/2005
-
Re: [SM-Users] first experiences and problems,
Thomas Orgis, 12/09/2005
-
Re: [SM-Users] first experiences and problems,
Eric Sandall, 12/09/2005
-
Re: [SM-Users] first experiences and problems,
Thomas Orgis, 12/09/2005
- Re: [SM-Users] first experiences and problems, Seth Alan Woolley, 12/10/2005
- Re: [SM-Users] first experiences and problems, Thomas Orgis, 12/10/2005
- Re: [SM-Users] first experiences and problems, Seth Alan Woolley, 12/10/2005
- Re: [SM-Users] first experiences and problems, Thomas Orgis, 12/11/2005
- Re: [SM-Users] first experiences and problems, Seth Alan Woolley, 12/14/2005
- Re: [SM-Users] first experiences and problems, Thomas Orgis, 12/16/2005
- Re: [SM-Users] first experiences and problems, Seth Alan Woolley, 12/16/2005
-
Re: [SM-Users] first experiences and problems,
Thomas Orgis, 12/09/2005
-
Re: [SM-Users] first experiences and problems,
Eric Sandall, 12/09/2005
-
Re: [SM-Users] first experiences and problems,
Thomas Orgis, 12/09/2005
-
Re: [SM-Users] first experiences and problems,
Eric Sandall, 12/03/2005
-
Re: [SM-Users] first experiences and problems,
Thomas Orgis, 12/02/2005
- Re: [SM-Users] first experiences and problems, Jason Flatt, 12/03/2005
Archive powered by MHonArc 2.6.24.