On Sat, Mar 10, 2018 at 10:29:14AM +0100, Marius Bakke wrote:
> Efraim Flashner <efraim@flashner.co.il> writes:
> 
> > * gnu/packages/gnupg.scm (jetring): New variable.
> 
> [...]
> 
> > +    (build-system gnu-build-system)
> > +    (arguments
> > +     '(#:phases
> > +       (modify-phases %standard-phases
> > +         (delete 'configure) ; no configure script
> > +         (replace 'install
> > +           (lambda* (#:key outputs #:allow-other-keys)
> > +             (let* ((out (assoc-ref outputs "out"))
> > +                    (man (string-append out "/share/man")))
> > +               (for-each (lambda (file)
> > +                           (install-file file (string-append out "/bin/")))
> > +                         '("jetring-accept" "jetring-apply" "jetring-build"
> > +                           "jetring-checksum" "jetring-diff" "jetring-explode"
> > +                           "jetring-gen" "jetring-review" "jetring-signindex"))
> > +               (for-each (lambda (file)
> > +                           (install-file file (string-append man "/man1/")))
> > +                         (find-files "." ".*\\.1$"))
> > +               (install-file "jetring.7" (string-append man "/man7/"))
> > +               #t))))
> > +       #:tests? #f)) ; no test phase
> > +    (native-inputs `(("gnupg" ,gnupg)))
> 
> What is GnuPG used for here?  I would assume it was a "normal" input.
> 

It's used in jetring-build, and assumably in other scripts. It would
probably be best to wrap jetring with gnupg.

> > +    (inputs `(("perl" ,perl)))
> > +    (home-page "https://joeyh.name/code/jetring/")
> > +    (synopsis "Gpg keyring maintenance using changesets")
> 
> s/Gpg/GnuPG/
> 
> > +    (description
> > +     "Jetring is a collection of tools that allow for gpg keyrings to be
> > +maintained using changesets.  It was developed with the Debian keyring in mind,
> > +and aims to solve the problem that a gpg keyring is a binary blob that's hard
> > +for multiple people to collaboratively edit.
> 
> \n
> 
> > +With jetring, changesets can be submitted, reviewed to see exactly what they
> > +will do, applied, and used to build a keyring.  The origin of every change made
> > +to the keyring is available for auditing, and gpg signatures can be used to
> > +further secure things.")
> 
> s/to further secure things/for integrity guarantees/ (IMO)
> 
> It would be good with an explanation of what a changeset is or how it
> works, but LGTM either way.



-- 
Efraim Flashner   <efraim@flashner.co.il>   אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted