* [gentoo-dev] [PATCH 5/6] glep-0078: Clarify that Manifest is signed too
@ 2022-09-21 18:16 99% ` Michał Górny
0 siblings, 0 replies; 1+ results
From: Michał Górny @ 2022-09-21 18:16 UTC (permalink / raw
To: gentoo-dev; +Cc: Michał Górny
Signed-off-by: Michał Górny <mgorny@gentoo.org>
---
glep-0078.rst | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/glep-0078.rst b/glep-0078.rst
index a109b7f..ab28aed 100644
--- a/glep-0078.rst
+++ b/glep-0078.rst
@@ -328,7 +328,9 @@ the inner archive contents. This file also provides protection against
signature reuse/replacement attacks if the OpenPGP signatures are used.
The implementation follows the Manifest specifications in GLEP 74
-[#GLEP74]_ and uses the DATA tag for files within the container.
+and uses the ``DATA`` tag for files within the container.
+If the package is using OpenPGP signatures, the Manifest file must also
+include a cleartext OpenPGP signature as defined in GLEP 74 [#GLEP74]_.
The implementation should be able to detect checksum mismatches,
as well as missing, duplicate, or extraneous files within
--
2.37.3
^ permalink raw reply related [relevance 99%]
Results 1-1 of 1 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2022-09-21 18:16 [gentoo-dev] [PATCH 0/6] glep-0078: Clarifications Michał Górny
2022-09-21 18:16 99% ` [gentoo-dev] [PATCH 5/6] glep-0078: Clarify that Manifest is signed too Michał Górny
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox