On Wed, 7 Dec 2005 16:15:49 +0100 Paul de Vrieze <[EMAIL PROTECTED]> wrote:
> On Wednesday 07 December 2005 04:04, Marius Mauch wrote: > > As stated in the GLEP, gpg is outside the scope of this. As for the > > questions, per entry sigs would invert one of the main goals (size > > reduction). And so far I haven't seen any sufficient answer to > > questions I raised on -core and -portage-dev regarding the > > transaction/stacked/fragmented/whatever-you-want-to-call-it Manifest > > signing proposed by Robin, so I'm still quite against it. > > Per entry sigs make no sense in the current design. All ebuilds can > touch all files, and so the complete manifest should be verified. > This means that the whole manifest should be signed. > > Having said that, I would like to argue that this GLEP be implemented > only together with gpg signing the manifest. Doing otherwise would > require another change in the manifest format in a short time. If the > manifest format has optional signing that would also be ok. Just > align the requirements and make manifest2 and the gpg signing of it > compatible. Signing is already implemented and independent of the Manifest format. It's just not yet mandatory due to the missing key policy. Marius -- Public Key at http://www.genone.de/info/gpg-key.pub In the beginning, there was nothing. And God said, 'Let there be Light.' And there was still nothing, but you could see a bit better.
signature.asc
Description: PGP signature
