From: "Michał Górny" <mgorny@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Cc: "Michał Górny" <mgorny@gentoo.org>
Subject: [gentoo-dev] [PATCH 5/6] glep-0078: Clarify that Manifest is signed too
Date: Wed, 21 Sep 2022 20:16:50 +0200 [thread overview]
Message-ID: <20220921181651.39370-6-mgorny@gentoo.org> (raw)
In-Reply-To: <20220921181651.39370-1-mgorny@gentoo.org>
Signed-off-by: Michał Górny <mgorny@gentoo.org>
---
glep-0078.rst | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/glep-0078.rst b/glep-0078.rst
index a109b7f..ab28aed 100644
--- a/glep-0078.rst
+++ b/glep-0078.rst
@@ -328,7 +328,9 @@ the inner archive contents. This file also provides protection against
signature reuse/replacement attacks if the OpenPGP signatures are used.
The implementation follows the Manifest specifications in GLEP 74
-[#GLEP74]_ and uses the DATA tag for files within the container.
+and uses the ``DATA`` tag for files within the container.
+If the package is using OpenPGP signatures, the Manifest file must also
+include a cleartext OpenPGP signature as defined in GLEP 74 [#GLEP74]_.
The implementation should be able to detect checksum mismatches,
as well as missing, duplicate, or extraneous files within
--
2.37.3
next prev parent reply other threads:[~2022-09-21 18:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-21 18:16 [gentoo-dev] [PATCH 0/6] glep-0078: Clarifications Michał Górny
2022-09-21 18:16 ` [gentoo-dev] [PATCH 1/6] glep-0078: Replace "basename" with non-ambiguous explanation Michał Górny
2022-09-22 6:07 ` Ulrich Mueller
2022-09-21 18:16 ` [gentoo-dev] [PATCH 2/6] glep-0078: Link tar format to the respective standards Michał Górny
2022-09-21 18:16 ` [gentoo-dev] [PATCH 3/6] glep-0078: Link compressed file formats to GLEP 74 Michał Górny
2022-09-21 18:16 ` [gentoo-dev] [PATCH 4/6] glep-0078: Link OpenPGP to RFC 4880 Michał Górny
2022-09-21 18:16 ` Michał Górny [this message]
2022-09-21 18:16 ` [gentoo-dev] [PATCH 6/6] glep-0078: Clarify that Manifest must be present for signed binpkg Michał Górny
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220921181651.39370-6-mgorny@gentoo.org \
--to=mgorny@gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox