On Mon, 2021-09-13 at 12:08 +0200, Ulrich Mueller wrote:
> > > > > > On Mon, 13 Sep 2021, Sheng Yu wrote:
>
> > -The archive contains a number of files, stored in a single
> > directory
> > -whose name should match the basename of the package file. However,
> > -the implementation must be able to process an archive where
> > -the directory name is mismatched. There should be no explicit
> > archive
> > -member entry for the directory.
> > +The archive contains a number of files. All package-related files
> > +should be stored in a single directory whose name matches the CPV
> > of
> > +the package file. However, the implementation must be able to
> > process
> > +an archive where the directory name is mismatched. There should be
> > no
> > +explicit archive member entry for the directory.
>
> I wonder about CPV here. That's ${CATEGORY}/${P} and contains a slash,
> so it cannot be the name of a directory. Also, what about the package
> revision?
Please restore the previous wording. The GLEP deliberately did not
enforce a specific filename because it's about internal format.
>
> > +6. The package manifest data file ``Manifest`` (required).
> > +
> > +7. A signature for the package Manifest file ``Manifest.sig``
> > + (optional).
>
> Given that the outer archive is uncompressed tar, every file will be
> zero-padded to a full block which adds some amount of bloat. So, could
> the signature be inlined in the Manifest file? That's also what GLEP
> 74
> specifies.
Using inline signature in Manifest makes sense.
>
> Also, IIRC one of the goals of the format was to allow partial
> download
> of metadata. That will only work if the Manifest file will be the
> first
> file in the archive (or at least appear before the image archive).
I disagree. This is solved by having detached metadata signature -- you
can do a partial fetch and verify the metadata directly.
On the other hand, putting Manifest first would make it impossible to
create the archive from data stream without using temporary files,
effectively doubling the needed free space. Well, technically you could
just reserve space and write Manifest later but that would strongly
depend on the size of PGP signature and that's not something I'd feel
comfortable relying on.
--
Best regards,
Michał Górny
