On Thu, Mar 06, 2008 at 02:58:34PM +0100, Bernhard R. Link wrote: > * Marc Haber <[EMAIL PROTECTED]> [080306 13:02]: > > Thus, there is a need to offline > > sign the Release file after reprepro has created the file. > > > > I'd like the mechanism to work like the -r option of the debsign > > command (which is invoked on the system holding the key, copies the > > file to be signed from the remote host that created the Release file, > > locally signs it and then copies the signed file back). > > As long as reprepro runs on the host the files are stored and thus not > the keys, i guess it would need to be some helper or a script, as the > action to sign and propably enter passphrases should be kept on another > host.
Yes, preferably invoked on the host holding the key. > As it is just taking the Release file and sign them, that itself is not > that complicated, though the question is how to properly integrate that. Would a temporary solution for me be to accept the repository being inconsistent for a short time, telling reprepro not to sign the Release and to transfer and sign the files oneself? Which gnupg command line is needed to create a proper signature? > Currently reprepro first writes alls changed dist/ files to files named > .new and renames them all together in a final run (so that the archive > always looks good to someone apt-get updating, as long as that does > not happen in the short time the rename is happening). > > I guess there are two options: > > reprepro could create a Release.new file as usual, then wait for > something to happen (which reminds me that I still wanted to reimplement > calling an arbitrary sign command which got lost with the sign > implementation using libgpgme) assuming this creates the Release.gpg.new > and when this is finished move them all to their places. > > or reprepro could create the .new files, write somewhere which > files to handle, and let the helper do the missing steps. > > I guess I will go for the first option, as that is only one things > (a generic sign hook) to be implemented and the rest scriptable... I would prefer having an option to have reprepro stop after the .new files were written (while the old files are still in place), and to have a new reprepro command to finish the work after the .new files were signed by some magic process. Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 3221 2323190 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
