From: mricon at kernel.org (Konstantin Ryabitsev)
Subject: RFC: snapshot tarball information in refs/notes/snapshots
Date: Tue, 20 Mar 2018 17:23:36 -0400 [thread overview]
Message-ID: <20180320212336.GA19694@work> (raw)
Hi, all:
I'd like to propose a feature in CGit that would allow providing
additional information within the repository to better create the
tarball, when snapshot downloads are enabled.
Let's take for example:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
I would like the "Download" column to also list detached PGP signatures
for each of the listed tarballs, taking the necessary information from
refs/notes/snapshots. Let's say the following note is associated with
the v3.16.56 tag:
---8<---
$ git notes --ref snapshots show v3.16.56
meta-version: 1.0
archive-prefix: linux-3.16.56/
archive-format: tar
-----BEGIN PGP SIGNATURE-----
Comment: This signature is for the .tar version of the archive
iHUEABYIAB0WIQR2vl2yUnHhSB5njDW2xBzjVmSZbAUCWrF3LQAKCRC2xBzjVmSZ
bLKiAQDWqg0B2DVA8QxGGqx3/5Ymkj4qKhqNT806+lkbfSFcfgEA3ZJonPCcL14Q
BAYrSkxzKXcI8NBPcq8torN+JibwAQo=
=IXM5
-----END PGP SIGNATURE-----
---8<---
CGit could then use the information in this note to know that:
1. the archive needs to be created with --prefix linux-3.16.56/ instead
of guessing the prefix based on the repo and tag names
2. it needs to create and offer a link to download signature.asc (or
linux-3.16.56.tar.asc), which should contain all lines including and
following '-----BEGIN PGP SIGNATURE'
I think adding this feature would be very straightforward and won't
require a lot of work, while offering end-users a way to verify
downloaded snapshots.
What do you think?
Best,
--
Konstantin Ryabitsev
Director, IT Infrastructure Security
The Linux Foundation
next reply other threads:[~2018-03-20 21:23 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-20 21:23 mricon [this message]
2018-03-21 12:38 ` Jason
2018-03-21 14:03 ` mricon
2018-03-30 11:53 ` john
2018-03-30 15:38 ` konstantin
2018-03-30 16:38 ` john
2018-03-30 17:44 ` konstantin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180320212336.GA19694@work \
--to=cgit@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).