GNU bug report logs - #17625
details of package signing mechanism

Previous Next

Full log

View this message in rfc822 format

From: Stefan Monnier <monnier <at> iro.umontreal.ca>
To: Daiki Ueno <ueno <at> gnu.org>
Cc: 17625 <at> debbugs.gnu.org
Subject: bug#17625: 24.4.50; All installed packages marked "unsigned", no archive listed
Date: Thu, 26 Jun 2014 15:51:25 -0400

SM> Whereas the feature you're discussing seems to be to indicate which
SM> candidates for installation have a signature available for checking
SM> (this is not implemented, AFAICT).
> Is there a plan to implement the latter feature and can I help? I recall
> some discussions months ago but no definite plan.

I see 3 behaviors for it:
- Mention at package-installation time that there's no signature to check,
  maybe with a prompt to confirm the user really wants to go ahead.
  This is more or less the route taken by APT, AFAIK (at least, seen
  from the user's point of view).
- Keep track of which archives have signatures and which don't (e.g. by
  assuming that if `archive-contents' has a sig, then the packages also
  have sigs).  Then somehow display this info in the package list.
- Check each and every package to see if it has a sig.  This implies
  a lot more network communication, AFAICT, so I think it's not
  a good idea.

The first behavior OTOH should be very easy to implement.


        Stefan

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.