From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.54) id 1Ek16u-0000GG-81 for garchives@archives.gentoo.org; Wed, 07 Dec 2005 15:21:36 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.13.5/8.13.5) with SMTP id jB7FJU6U007481; Wed, 7 Dec 2005 15:19:30 GMT Received: from callisto.cs.kun.nl (callisto.cs.kun.nl [131.174.33.75]) by robin.gentoo.org (8.13.5/8.13.5) with ESMTP id jB7FFp5G013278 for ; Wed, 7 Dec 2005 15:15:51 GMT Received: from localhost (localhost [127.0.0.1]) by callisto.cs.kun.nl (Postfix) with ESMTP id E616F2E8213 for ; Wed, 7 Dec 2005 16:15:55 +0100 (CET) From: Paul de Vrieze To: gentoo-dev@lists.gentoo.org Subject: Re: [gentoo-dev] [GLEP] Manifest2 format Date: Wed, 7 Dec 2005 16:15:49 +0100 User-Agent: KMail/1.9 References: <20051206170453.6ab10367@sven.genone.homeip.net> <1133912350.3733.17.camel@cocagne.max-t.internal> <20051207040453.06f507ef@sven.genone.homeip.net> In-Reply-To: <20051207040453.06f507ef@sven.genone.homeip.net> X-Face: #Lb+'V@sGJ;ptgo5}V"W+5OCoo{LZv;bh,s,`WKLi/J)ed1_$0;6X<=?utf-8?q?700LVV/=3BLqPhiDP=5E=0A=09=27f=5Dfnv?=@%6M8\'HR1t=aFx;ePfp{ZQoBe+e)JOQ8T5*(_;mHY+cltLGq<;@$Y,=?utf-8?q?O=5C=24=0A=09Tm=23G6M?=,g![Q62J{na*S9d;R[^8pc%u\aiLqU@`kJtYl"^6pxdW Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart6935332.GGmRsnhXHT"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200512071615.55448.pauldv@gentoo.org> X-Archives-Salt: 0c050ac4-9f36-4192-bf77-06ccc6eb4a3f X-Archives-Hash: 039ae899e941b4b1f519070233b8e0a5 --nextPart6935332.GGmRsnhXHT Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Wednesday 07 December 2005 04:04, Marius Mauch wrote: > As stated in the GLEP, gpg is outside the scope of this. As for the > questions, per entry sigs would invert one of the main goals (size > reduction). And so far I haven't seen any sufficient answer to > questions I raised on -core and -portage-dev regarding the > transaction/stacked/fragmented/whatever-you-want-to-call-it Manifest > signing proposed by Robin, so I'm still quite against it. Per entry sigs make no sense in the current design. All ebuilds can touch=20 all files, and so the complete manifest should be verified. This means=20 that the whole manifest should be signed. Having said that, I would like to argue that this GLEP be implemented only= =20 together with gpg signing the manifest. Doing otherwise would require=20 another change in the manifest format in a short time. If the manifest=20 format has optional signing that would also be ok. Just align the=20 requirements and make manifest2 and the gpg signing of it compatible. Paul =2D-=20 Paul de Vrieze Gentoo Developer Mail: pauldv@gentoo.org Homepage: http://www.devrieze.net --nextPart6935332.GGmRsnhXHT Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2-ecc0.1.6 (GNU/Linux) iD8DBQBDlvyrbKx5DBjWFdsRAv+DAJ9pxZ1DGhNNsW4tJoiPwDpbLy8DQACgrSq+ 88AQRn5QjcxVefhWsHMsEQk= =F+e5 -----END PGP SIGNATURE----- --nextPart6935332.GGmRsnhXHT-- -- gentoo-dev@gentoo.org mailing list