Re: [gentoo-dev] [pre-GLEP r1] Gentoo binary package container format

[Roy Bamford <neddyseagoon@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1705 bytes --]

On 2018.11.19 18:35, Michał Górny wrote:
> Hi,
> 
> On Sat, 2018-11-17 at 12:21 +0100, Michał Górny wrote:
> > Here's a pre-GLEP draft based on the earlier discussion on gentoo-
> > portage-dev mailing list.  The specification uses GLEP form as it
> > provides for cleanly specifying the motivation and rationale.
> 
> Changes in -r1: took into account the feedback and restructured
> the motivation into pointing out advantages of the existing format,
> and focusing on the two real issues of non-transparency and OpenPGP
> implementations deficiencies.  Also added a section on why there's no
> explicit version number.
> 
> > Also available via HTTPS:
> > 
> > rst:  https://dev.gentoo.org/~mgorny/tmp/glep-0078.rst
> > html: https://dev.gentoo.org/~mgorny/tmp/glep-0078.html
> > 
> 
[snip]

Team,

Looks good to me. I can manually unpick the binpackage with tar.
Choose, if I will check the signatures or not, then spray files all
over my broken Gentoo with tar in the same way as I do now.    

Implementation detail question. 
It appears that all members must be signed, or none of them since
  
"The archive members support optional OpenPGP signatures. 
The implementations must allow the user to specify whether OpenPGP 
signatures are to be expected in remotely fetched packages."

Or can the user specify that only some elements need to be signed?

Is it a problem if not all elements are signed with the same key?
That could happen if one person makes a  binpackage and someone
else updates the metadata.


> -- 
> Best regards,
> Michał Górny
> 

-- 
Regards,

Roy Bamford
(Neddyseagoon) a member of
elections
gentoo-ops
forum-mods

[-- Attachment #2: Type: application/pgp-signature, Size: 488 bytes --]