Dnia 2013-06-22, o godz. 17:02:56
""Paweł Hajdan, Jr."" <phajdan.jr@gentoo.org> napisał(a):

> On 6/20/13 2:16 AM, Michał Górny wrote:
> > Doing test signatures won't cover all failures.
> 
> Do you know an example? The only one I'm aware of is when a test
> signature is made very close to the expiration date, and then the real
> signature would be done after it.

Well, Michael explained one in the other branch of this thread quite
thoroughly. Other than that, there can be random runtime errors
and race conditions.

I'd say it's as good as using stat() to check whether a file exists
before opening it. But thinking of it, I've got another idea...

How about opening 'gpg -s' in a subprocess before first commit
and feeding the Manifest afterwards? As far as I can see, gpg asks for
the password instantly, so likely most of the bases will be covered
already, and we're be doing a single signature only.

-- 
Best regards,
Michał Górny