On Thu, Sep 10, 2009 at 05:08:42PM -0500, Shawn Walker wrote:
> >The current IPS notion of publisher is unfortunately _local_. Manifest
> >signing will necessarily change that. But that's not enough to solve
> >the problems with the current publisher metaphor. The distinctions
> >between streams/repositories published by the same publisher needs to be
> >encoded in metadata, not in the repository URLs. But please see bug
> >#10213.
>
> It's already encoded in metadata, look at
> http://pkg.opensolaris.org/dev/publisher/0 (with wget) for an example.
>
> The client just doesn't leverage this metadata yet.
The fact that the notion of publisher that the UIs deal with is local
makes it difficult to use such metadata. The UIs themselves need to
change, not just client code.
My vision, if you'll allow me, is this:
- Publishers are defined by files installed by packages. Those files
include: the display name of the publisher (and localizations?), the
name of the publisher as it should appear in its certificates,
any trust anchors needed for manifest signature verification, and a
list of zero or more repository URLs serving the publisher's streams.
These should be delivered by special purpose actions. See next item.
- Users don't define publishers.
To add publishers a user enters/pastes the URL to a pkg that defines
the publisher. The user is asked if they want to trust contents from
that publisher. If that pkg's manifest is not signed with by a
trusted publisher then the user is asked an ssh-style leap-of-faith
question (i.e., the user is shown the publisher's certificate/key
fingerprint). This is why I suggest special actions to define
publishers: so that IPS knows to prompt the user (which IPS wouldn't
do for plain file actions).
- Repositories and mirrors are referenced by URL and can be added to a
local list manually as well as delivered by packages.
- Metadata defines streams, lists mirrors, ...
- /release, /dev, ... become named streams.
- Users pick a named stream to image-update to or to install
specific pkgs from.
Nico
--
_______________________________________________
pkg-discuss mailing list
[email protected]
http://mail.opensolaris.org/mailman/listinfo/pkg-discuss
