FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > ArchLinux > ArchLinux Development

 
 
LinkBack Thread Tools
 
Old 04-01-2011, 07:54 PM
Rémy Oudompheng
 
Default Add signature files to update/move/remove targets

On 2011/4/1 Pierre Schmitz <pierre@archlinux.de> wrote:
> On Fri, 1 Apr 2011 00:54:57 +0200, Rémy Oudompheng wrote:
>> Signature files are optional and the previous behaviour
>> is unchanged when signatures files do not exist.
>>
>> Signed-off-by: Rémy Oudompheng <remy@archlinux.org>
>> ---
>> This patch was already posted with very slight differences
>> on the mailing-list by Allan. It needed several changes to
>> fit the current state of dbscripts. I hope this one will
>> allow to move forward.
>>
>> Still nothing in the test suite: we would need to run
>> gpg after the extra-*-build invocation and extra checks
>> for the presence/absence of signature files in the repos.
>
> I am a little confused by this patch. If I get the current repo-add
> code right, gpg signatures will be base64 encoded and added to the db
> files. So there should be no need to provide .sig files for every single
> package.
>

Then I'm also confused by our current handling of signatures.
Do we have decided anything about that?
Why did Allan suggest this patch?
How can repo-add put signatures in db files if signatures are not
available in the package pool? (we probably don't want to extract the
signature and copy it when moving packages between repos)

In my current understanding:
* package pool holds packages and their signature files, and serves as
the basis for generating databases
* repo directories ($repo/os/$arch) contain symlinks to packages,
databases which are generated by repo-add, and the signature file for
the database.

--
Rémy.
 
Old 04-01-2011, 07:58 PM
Pierre Schmitz
 
Default Add signature files to update/move/remove targets

On Fri, 1 Apr 2011 21:54:30 +0200, Rémy Oudompheng wrote:
> On 2011/4/1 Pierre Schmitz <pierre@archlinux.de> wrote:
>> On Fri, 1 Apr 2011 00:54:57 +0200, Rémy Oudompheng wrote:
>>> Signature files are optional and the previous behaviour
>>> is unchanged when signatures files do not exist.
>>>
>>> Signed-off-by: Rémy Oudompheng <remy@archlinux.org>
>>> ---
>>> This patch was already posted with very slight differences
>>> on the mailing-list by Allan. It needed several changes to
>>> fit the current state of dbscripts. I hope this one will
>>> allow to move forward.
>>>
>>> Still nothing in the test suite: we would need to run
>>> gpg after the extra-*-build invocation and extra checks
>>> for the presence/absence of signature files in the repos.
>>
>> I am a little confused by this patch. If I get the current repo-add
>> code right, gpg signatures will be base64 encoded and added to the db
>> files. So there should be no need to provide .sig files for every single
>> package.
>>
>
> Then I'm also confused by our current handling of signatures.
> Do we have decided anything about that?
> Why did Allan suggest this patch?
> How can repo-add put signatures in db files if signatures are not
> available in the package pool? (we probably don't want to extract the
> signature and copy it when moving packages between repos)

I think it will work this way:
* you upload the package and its separate signature into your staging
dir
* repo-add will add the pacakge's meta data and signature into the
database file

> In my current understanding:
> * package pool holds packages and their signature files, and serves as
> the basis for generating databases
> * repo directories ($repo/os/$arch) contain symlinks to packages,
> databases which are generated by repo-add, and the signature file for
> the database.

The package's signatures are kept within the db file. The only separate
.sig file that will be visible in the repos is the one for the db file
itself.

--
Pierre Schmitz, https://users.archlinux.de/~pierre
 
Old 04-01-2011, 08:05 PM
Rémy Oudompheng
 
Default Add signature files to update/move/remove targets

On 2011/4/1 Pierre Schmitz <pierre@archlinux.de> wrote:
> On Fri, 1 Apr 2011 21:54:30 +0200, Rémy Oudompheng wrote:
>> Then I'm also confused by our current handling of signatures.
>> Do we have decided anything about that?
>> Why did Allan suggest this patch?
>> How can repo-add put signatures in db files if signatures are not
>> available in the package pool? (we probably don't want to extract the
>> signature and copy it when moving packages between repos)
>
> I think it will work this way:
> * you upload the package and its separate signature into your staging
> dir
> * repo-add will add the pacakge's meta data and signature into the
> database file

In the current setting (arch_repo_add) in db-functions, repo-add is
run from the repo directory ($repo/os/$arch) and would not have access
to the signature files. A progress would be to run it from the package
pool, so that we don't have to link signature files to repo folders.

But not having the signature files in the package pool would make it
problematic to use db-move correctly, since signatures would have been
deleted from $HOME/staging directories in the meanwhile.

--
Rémy.
 
Old 04-01-2011, 08:10 PM
Dan McGee
 
Default Add signature files to update/move/remove targets

On Fri, Apr 1, 2011 at 2:58 PM, Pierre Schmitz <pierre@archlinux.de> wrote:
> On Fri, 1 Apr 2011 21:54:30 +0200, Rémy Oudompheng wrote:
>> On 2011/4/1 Pierre Schmitz <pierre@archlinux.de> wrote:
>>> On Fri, 1 Apr 2011 00:54:57 +0200, Rémy Oudompheng wrote:
>>>> Signature files are optional and the previous behaviour
>>>> is unchanged when signatures files do not exist.
>>>>
>>>> Signed-off-by: Rémy Oudompheng <remy@archlinux.org>
>>>> ---
>>>> This patch was already posted with very slight differences
>>>> on the mailing-list by Allan. It needed several changes to
>>>> fit the current state of dbscripts. I hope this one will
>>>> allow to move forward.
>>>>
>>>> Still nothing in the test suite: we would need to run
>>>> gpg after the extra-*-build invocation and extra checks
>>>> for the presence/absence of signature files in the repos.
>>>
>>> I am a little confused by this patch. If I get the current repo-add
>>> code right, gpg signatures will be base64 encoded and added to the db
>>> files. So there should be no need to provide .sig files for every single
>>> package.
>>>
>>
>> Then I'm also confused by our current handling of signatures.
>> Do we have decided anything about that?
>> Why did Allan suggest this patch?
>> How can repo-add put signatures in db files if signatures are not
>> available in the package pool? (we probably don't want to extract the
>> signature and copy it when moving packages between repos)
>
> I think it will work this way:
> * you upload the package and its separate signature into your staging
> dir
> * repo-add will add the pacakge's meta data and signature into the
> database file
>
>> In my current understanding:
>> * package pool holds packages and their signature files, and serves as
>> the basis for generating databases
>> * repo directories ($repo/os/$arch) contain symlinks to packages,
>> databases which are generated by repo-add, and the signature file for
>> the database.
>
> The package's signatures are kept within the db file. The only separate
> .sig file that will be visible in the repos is the one for the db file
> itself.

No, that is not the intention. We put them in the database as well so
you do not have to download each and every .sig file individually, but
they have always been intended to be freely available and sitting
there as well. It would be quite silly to hide these files away if we
have them.

For that matter, repo-add doesn't add them *unless* they are sitting
next to the package.

-Dan
 
Old 04-01-2011, 08:45 PM
Pierre Schmitz
 
Default Add signature files to update/move/remove targets

On Fri, 1 Apr 2011 15:10:36 -0500, Dan McGee wrote:
> On Fri, Apr 1, 2011 at 2:58 PM, Pierre Schmitz <pierre@archlinux.de> wrote:
>> On Fri, 1 Apr 2011 21:54:30 +0200, Rémy Oudompheng wrote:
>>> In my current understanding:
>>> * package pool holds packages and their signature files, and serves as
>>> the basis for generating databases
>>> * repo directories ($repo/os/$arch) contain symlinks to packages,
>>> databases which are generated by repo-add, and the signature file for
>>> the database.
>>
>> The package's signatures are kept within the db file. The only separate
>> .sig file that will be visible in the repos is the one for the db file
>> itself.
>
> No, that is not the intention. We put them in the database as well so
> you do not have to download each and every .sig file individually, but
> they have always been intended to be freely available and sitting
> there as well. It would be quite silly to hide these files away if we
> have them.
>
> For that matter, repo-add doesn't add them *unless* they are sitting
> next to the package.

Thanks for clarifying.

Back to the patch: I'll need to have more check for the .sig files and
at least a simple test case will be needed.

--
Pierre Schmitz, https://users.archlinux.de/~pierre
 
Old 04-01-2011, 09:52 PM
Allan McRae
 
Default Add signature files to update/move/remove targets

On 02/04/11 06:45, Pierre Schmitz wrote:

On Fri, 1 Apr 2011 15:10:36 -0500, Dan McGee wrote:

On Fri, Apr 1, 2011 at 2:58 PM, Pierre Schmitz<pierre@archlinux.de> wrote:

On Fri, 1 Apr 2011 21:54:30 +0200, Rémy Oudompheng wrote:

In my current understanding:
* package pool holds packages and their signature files, and serves as
the basis for generating databases
* repo directories ($repo/os/$arch) contain symlinks to packages,
databases which are generated by repo-add, and the signature file for
the database.


The package's signatures are kept within the db file. The only separate
.sig file that will be visible in the repos is the one for the db file
itself.


No, that is not the intention. We put them in the database as well so
you do not have to download each and every .sig file individually, but
they have always been intended to be freely available and sitting
there as well. It would be quite silly to hide these files away if we
have them.

For that matter, repo-add doesn't add them *unless* they are sitting
next to the package.


Thanks for clarifying.

Back to the patch: I'll need to have more check for the .sig files and
at least a simple test case will be needed.



Just to add another reason to keep the .sig file beside the package,
pacman -U http://package/from/mirror.pkg.tar.gz will try and download
the signature file and verify it too.


Allan
 
Old 04-02-2011, 11:24 AM
Pierre Schmitz
 
Default Add signature files to update/move/remove targets

On Fri, 1 Apr 2011 00:54:57 +0200, Rémy Oudompheng wrote:
> Signature files are optional and the previous behaviour
> is unchanged when signatures files do not exist.
>
> Signed-off-by: Rémy Oudompheng <remy@archlinux.org>
> ---
> This patch was already posted with very slight differences
> on the mailing-list by Allan. It needed several changes to
> fit the current state of dbscripts. I hope this one will
> allow to move forward.
>
> Still nothing in the test suite: we would need to run
> gpg after the extra-*-build invocation and extra checks
> for the presence/absence of signature files in the repos.

I have added a simple test and pushed this patch. There is also a new
config var called REQUIRE_SIGNATURE which wont accept new packages if a
.sig file is not available. See
http://projects.archlinux.org/dbscripts.git/commit/?id=1ce0c6368d0908e25f9bd1bb8183b5f29053fac8

--
Pierre Schmitz, https://users.archlinux.de/~pierre
 

Thread Tools




All times are GMT. The time now is 11:06 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright ©2007 - 2008, www.linux-archive.org