On Sat, Jul 25, 2020 at 9:07 AM Storm Dragon via aur-general <[email protected]> wrote: > > Howdy, > > The recent AUR migration got me to wondering how difficult it would be to set > up the AUR as a p2p model with something like bit torrent. I am not at this > point even suggesting that it be implemented, I am more just curious about > the challenges of such a thing. > > Thinking about it, there would have to be some kind of security process in > place to make sure PKGBUILDs were not modified and retrieved from only one > source. Maybe a way to mark certain machines as trusted, and/or setting a > minimum of distributers that must agree on the validity of the PKGBUILD in > question. > > I am by no means an expert on this stuff but if something like this were > done, and if it worked, it could even be expanded to community packages as > well, meaning that any machine with a cache could also serve as a mirror for > those packages. So, is something like this feasible? > > Thanks, > Storm > > -- > ⛈ > Accessible low cost computers for everyone! https://stormux.org > Get my public PGP key: gpg --recv-key 43DDC193 > The great thing about Object Oriented code is that it can make small, simple > problems look like large, complex ones. > "I've seen the tempest in darkest nights I've faced the eyes of Thor" > Stormwarrior - Heading Northe
Using P2P for repository packages (like core, extra, community etc.) seems like a good idea. For the AUR, it means that there need to be trusted machines building AUR packages and generating hashes for them, basically the same amount of work as just making a new repository containing all the packages in the AUR.
