Re: [gentoo-dev] [pre-GLEP r1] Gentoo binary package container format

["Michał Górny" <mgorny@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1721 bytes --]

On Mon, 2018-11-19 at 19:21 +0000, Roy Bamford wrote:
> On 2018.11.19 18:35, Michał Górny wrote:
> > Hi,
> > 
> > On Sat, 2018-11-17 at 12:21 +0100, Michał Górny wrote:
> > > Here's a pre-GLEP draft based on the earlier discussion on gentoo-
> > > portage-dev mailing list.  The specification uses GLEP form as it
> > > provides for cleanly specifying the motivation and rationale.
> > 
> > Changes in -r1: took into account the feedback and restructured
> > the motivation into pointing out advantages of the existing format,
> > and focusing on the two real issues of non-transparency and OpenPGP
> > implementations deficiencies.  Also added a section on why there's no
> > explicit version number.
> > 
> > > Also available via HTTPS:
> > > 
> > > rst:  https://dev.gentoo.org/~mgorny/tmp/glep-0078.rst
> > > html: https://dev.gentoo.org/~mgorny/tmp/glep-0078.html
> > > 
> 
> [snip]
> 
> Team,
> 
> Looks good to me. I can manually unpick the binpackage with tar.
> Choose, if I will check the signatures or not, then spray files all
> over my broken Gentoo with tar in the same way as I do now.    
> 
> Implementation detail question. 
> It appears that all members must be signed, or none of them since
>   
> "The archive members support optional OpenPGP signatures. 
> The implementations must allow the user to specify whether OpenPGP 
> signatures are to be expected in remotely fetched packages."
> 
> Or can the user specify that only some elements need to be signed?

This is really out of scope.  The only purpose of this paragraph is to
explain that '(optional)' doesn't mean you can safely ignore the lack of
this file.

-- 
Best regards,
Michał Górny

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 963 bytes --]