[gentoo-dev] [GLEP] Manifest2 format

[gentoo-dev] [GLEP] Manifest2 format

[Marius Mauch]

[-- Attachment #1: Type: text/plain, Size: 387 bytes --]

Hi,

As promised here the GLEP for Manifest2 support:
http://www.gentoo.org/proj/en/glep/glep-0044.html

This will NOT be voted upon the next council meeting on thursday ;)

Marius

-- 
Public Key at http://www.genone.de/info/gpg-key.pub

In the beginning, there was nothing. And God said, 'Let there be
Light.' And there was still nothing, but you could see a bit better.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Francesco Riosa]

Marius Mauch wrote:
> Hi,
> 
> As promised here the GLEP for Manifest2 support:
> http://www.gentoo.org/proj/en/glep/glep-0044.html
> 
> This will NOT be voted upon the next council meeting on thursday ;)
> 
> Marius
> 

Really great that this has reached us, digest-* files are really
annoying from my pov.

Greetings to everyone who make this happen.

-- F.R.
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] [GLEP] Manifest2 format

[Grant Goodyear]

[-- Attachment #1: Type: text/plain, Size: 1061 bytes --]

Marius Mauch wrote: [Tue Dec 06 2005, 10:04:53AM CST]
> As promised here the GLEP for Manifest2 support:
> http://www.gentoo.org/proj/en/glep/glep-0044.html

You know, I'd actually support a rather more abrupt transition,
where we announce that on a particular date all digest files are going
to be removed, thereby breaking any version of portage older than
portage-x.y.z.  Many people would probably miss such a deadline, but
assuming that we also publicize how to download and unpack a portage
rescue tarball then I would think that the actual pain would be minimal.
(Indeed, we could even have a fix-portage.sh script in
/usr/portage/scripts that would do the downloading and unpacking, if we
wanted to be particularly nice.)  Backwards compatibility is nice, but
I'd really rather not see good ideas take a year to fully be implemented
unless absolutely required.

-g2boojum-
-- 
Grant Goodyear	
Gentoo Developer
g2boojum@gentoo.org
http://www.gentoo.org/~g2boojum
GPG Fingerprint: D706 9802 1663 DEF5 81B0  9573 A6DC 7152 E0F6 5B76

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Patrick McLean]

> You know, I'd actually support a rather more abrupt transition,
> where we announce that on a particular date all digest files are going
> to be removed, thereby breaking any version of portage older than
> portage-x.y.z.  Many people would probably miss such a deadline, but
> assuming that we also publicize how to download and unpack a portage
> rescue tarball then I would think that the actual pain would be minimal.
> (Indeed, we could even have a fix-portage.sh script in
> /usr/portage/scripts that would do the downloading and unpacking, if we
> wanted to be particularly nice.)  Backwards compatibility is nice, but
> I'd really rather not see good ideas take a year to fully be implemented
> unless absolutely required.

How about instead of letting people use tarballs, we kill the digests 
for every package except portage and it's deps. That way we will break 
the system and enforce an upgrade, but we will also give them an easy 
upgrade route. (I haven't looked at the GLEP so I don't know about 
manifest compatibility).
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] [GLEP] Manifest2 format

[Ciaran McCreesh]

[-- Attachment #1: Type: text/plain, Size: 387 bytes --]

On Tue, 6 Dec 2005 17:04:53 +0100 Marius Mauch <genone@gentoo.org>
wrote:
| As promised here the GLEP for Manifest2 support:
| http://www.gentoo.org/proj/en/glep/glep-0044.html

Any reason for SRCURI over SRC_URI?

-- 
Ciaran McCreesh : Gentoo Developer (I can kill you with my brain)
Mail            : ciaranm at gentoo.org
Web             : http://dev.gentoo.org/~ciaranm


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Chris Gianelloni]

[-- Attachment #1: Type: text/plain, Size: 507 bytes --]

On Tue, 2005-12-06 at 22:58 +0000, Ciaran McCreesh wrote:
> On Tue, 6 Dec 2005 17:04:53 +0100 Marius Mauch <genone@gentoo.org>
> wrote:
> | As promised here the GLEP for Manifest2 support:
> | http://www.gentoo.org/proj/en/glep/glep-0044.html
> 
> Any reason for SRCURI over SRC_URI?

1 less byte?

Why not just SRC?  Is there a reason why it must have URI when it isn't
one?

-- 
Chris Gianelloni
Release Engineering - Strategic Lead
x86 Architecture Team
Games - Developer
Gentoo Linux

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Olivier Crete]

On Tue, 2005-06-12 at 17:04 +0100, Marius Mauch wrote:
> As promised here the GLEP for Manifest2 support:
> http://www.gentoo.org/proj/en/glep/glep-0044.html

I see nothing about GPG in the GLEP.. Would those manifest files be
signed like the current ones? Would it be possible to have "per-line"
signing, or something like the stacked signing idea that was proposed
last month. If we are going to change the manifest format, might as well
do it properly.


-- 
Olivier Crête
tester@gentoo.org
Gentoo Developer


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] [GLEP] Manifest2 format

[Marius Mauch]

[-- Attachment #1: Type: text/plain, Size: 546 bytes --]

On Tue, 6 Dec 2005 22:58:06 +0000
Ciaran McCreesh <ciaranm@gentoo.org> wrote:

> On Tue, 6 Dec 2005 17:04:53 +0100 Marius Mauch <genone@gentoo.org>
> wrote:
> | As promised here the GLEP for Manifest2 support:
> | http://www.gentoo.org/proj/en/glep/glep-0044.html
> 
> Any reason for SRCURI over SRC_URI?

Personal preference.

Marius

-- 
Public Key at http://www.genone.de/info/gpg-key.pub

In the beginning, there was nothing. And God said, 'Let there be
Light.' And there was still nothing, but you could see a bit better.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 1156 bytes --]

On Tue, Dec 06, 2005 at 06:39:10PM -0500, Olivier Crete wrote:
> On Tue, 2005-06-12 at 17:04 +0100, Marius Mauch wrote:
> > As promised here the GLEP for Manifest2 support:
> > http://www.gentoo.org/proj/en/glep/glep-0044.html
> 
> I see nothing about GPG in the GLEP.. Would those manifest files be
> signed like the current ones? Would it be possible to have "per-line"
> signing, or something like the stacked signing idea that was proposed
> last month. If we are going to change the manifest format, might as well
> do it properly.
Scope:
"It does not expand the scope of it to cover eclasses, profiles or anything else not already covered by the Manifest system, it also doesn't affect the Manifest signing efforts in any way (though the implementations of both might be coupled)."

I'd like to aim for doing the fragment signing in right into Manifest2 from the
start, and I've had discussions with ferringb regarding that. It makes more
sense than refitting the existing Manifest code with the new signing.

-- 
Robin Hugh Johnson
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85

[-- Attachment #2: Type: application/pgp-signature, Size: 241 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Marius Mauch]

[-- Attachment #1: Type: text/plain, Size: 1163 bytes --]

On Tue, 06 Dec 2005 18:39:10 -0500
Olivier Crete <tester@gentoo.org> wrote:

> On Tue, 2005-06-12 at 17:04 +0100, Marius Mauch wrote:
> > As promised here the GLEP for Manifest2 support:
> > http://www.gentoo.org/proj/en/glep/glep-0044.html
> 
> I see nothing about GPG in the GLEP.. Would those manifest files be
> signed like the current ones? Would it be possible to have "per-line"
> signing, or something like the stacked signing idea that was proposed
> last month. If we are going to change the manifest format, might as
> well do it properly.

As stated in the GLEP, gpg is outside the scope of this. As for the
questions, per entry sigs would invert one of the main goals (size
reduction). And so far I haven't seen any sufficient answer to
questions I raised on -core and -portage-dev regarding the
transaction/stacked/fragmented/whatever-you-want-to-call-it Manifest
signing proposed by Robin, so I'm still quite against it.

Marius

-- 
Public Key at http://www.genone.de/info/gpg-key.pub

In the beginning, there was nothing. And God said, 'Let there be
Light.' And there was still nothing, but you could see a bit better.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Jon Portnoy]

On Tue, Dec 06, 2005 at 01:39:03PM -0600, Grant Goodyear wrote:
> Marius Mauch wrote: [Tue Dec 06 2005, 10:04:53AM CST]
> > As promised here the GLEP for Manifest2 support:
> > http://www.gentoo.org/proj/en/glep/glep-0044.html
> 
> You know, I'd actually support a rather more abrupt transition,
> where we announce that on a particular date all digest files are going
> to be removed, thereby breaking any version of portage older than
> portage-x.y.z.  Many people would probably miss such a deadline, but
> assuming that we also publicize how to download and unpack a portage
> rescue tarball then I would think that the actual pain would be minimal.
						^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Haven't been to #gentoo lately have you? :)

-- 
Jon Portnoy
avenj/irc.freenode.net
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] [GLEP] Manifest2 format

[Paul de Vrieze]

[-- Attachment #1: Type: text/plain, Size: 1126 bytes --]

On Wednesday 07 December 2005 04:04, Marius Mauch wrote:
> As stated in the GLEP, gpg is outside the scope of this. As for the
> questions, per entry sigs would invert one of the main goals (size
> reduction). And so far I haven't seen any sufficient answer to
> questions I raised on -core and -portage-dev regarding the
> transaction/stacked/fragmented/whatever-you-want-to-call-it Manifest
> signing proposed by Robin, so I'm still quite against it.

Per entry sigs make no sense in the current design. All ebuilds can touch 
all files, and so the complete manifest should be verified. This means 
that the whole manifest should be signed.

Having said that, I would like to argue that this GLEP be implemented only 
together with gpg signing the manifest. Doing otherwise would require 
another change in the manifest format in a short time. If the manifest 
format has optional signing that would also be ok. Just align the 
requirements and make manifest2 and the gpg signing of it compatible.

Paul

-- 
Paul de Vrieze
Gentoo Developer
Mail: pauldv@gentoo.org
Homepage: http://www.devrieze.net

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Marius Mauch]

[-- Attachment #1: Type: text/plain, Size: 1470 bytes --]

On Wed, 7 Dec 2005 16:15:49 +0100
Paul de Vrieze <pauldv@gentoo.org> wrote:

> On Wednesday 07 December 2005 04:04, Marius Mauch wrote:
> > As stated in the GLEP, gpg is outside the scope of this. As for the
> > questions, per entry sigs would invert one of the main goals (size
> > reduction). And so far I haven't seen any sufficient answer to
> > questions I raised on -core and -portage-dev regarding the
> > transaction/stacked/fragmented/whatever-you-want-to-call-it Manifest
> > signing proposed by Robin, so I'm still quite against it.
> 
> Per entry sigs make no sense in the current design. All ebuilds can
> touch all files, and so the complete manifest should be verified.
> This means that the whole manifest should be signed.
> 
> Having said that, I would like to argue that this GLEP be implemented
> only together with gpg signing the manifest. Doing otherwise would
> require another change in the manifest format in a short time. If the
> manifest format has optional signing that would also be ok. Just
> align the requirements and make manifest2 and the gpg signing of it
> compatible.

Signing is already implemented and independent of the Manifest
format. It's just not yet mandatory due to the missing key policy.

Marius

-- 
Public Key at http://www.genone.de/info/gpg-key.pub

In the beginning, there was nothing. And God said, 'Let there be
Light.' And there was still nothing, but you could see a bit better.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Daniel]

[-- Attachment #1: Type: text/plain, Size: 233 bytes --]

> As promised here the GLEP for Manifest2 support:
> http://www.gentoo.org/proj/en/glep/glep-0044.html

I like it - well done Marius.

-- 
Daniel Black <dragonheart@gentoo.org>
Gentoo Crypto/PPC/dev-embedded/Forensics/NetMon

[-- Attachment #2: Type: application/pgp-signature, Size: 190 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Marius Mauch]

[-- Attachment #1: Type: text/plain, Size: 708 bytes --]

On Tue, 6 Dec 2005 17:04:53 +0100
Marius Mauch <genone@gentoo.org> wrote:

> Hi,
> 
> As promised here the GLEP for Manifest2 support:
> http://www.gentoo.org/proj/en/glep/glep-0044.html
> 
> This will NOT be voted upon the next council meeting on thursday ;)

Ok, made a few minor corrections, mainly s/SRCURI/DISTFILE/ so people
don't get confused about the underscore (and as someone pointed out
those entries aren't uris anyway).

I'd like to get this voted upon the next meeting.

Marius

-- 
Public Key at http://www.genone.de/info/gpg-key.pub

In the beginning, there was nothing. And God said, 'Let there be
Light.' And there was still nothing, but you could see a bit better.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] [GLEP] Manifest2 format

[Marius Mauch]

[-- Attachment #1: Type: text/plain, Size: 816 bytes --]

On Mon, 23 Jan 2006 11:27:56 +0100
Marius Mauch <genone@gentoo.org> wrote:

> On Tue, 6 Dec 2005 17:04:53 +0100
> Marius Mauch <genone@gentoo.org> wrote:
> 
> > Hi,
> > 
> > As promised here the GLEP for Manifest2 support:
> > http://www.gentoo.org/proj/en/glep/glep-0044.html
> > 
> > This will NOT be voted upon the next council meeting on thursday ;)
> 
> Ok, made a few minor corrections, mainly s/SRCURI/DISTFILE/ so people
> don't get confused about the underscore (and as someone pointed out
> those entries aren't uris anyway).

Ok, updated once more incorporating recent feedback.

Marius

-- 
Public Key at http://www.genone.de/info/gpg-key.pub

In the beginning, there was nothing. And God said, 'Let there be
Light.' And there was still nothing, but you could see a bit better.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]