Russ Allbery <rra@debian.org> writes: > Marco d'Itri <md@Linux.IT> writes: >> rra@debian.org wrote: > >>> My understanding is that the problem with this design from their >>> perspective is that it requires a fat client on the uploader's system, >>> and whole point of tag2upload is to stop requiring a fat client on the >>> uploader's system. In particular, it requires all the code to >>> reconstruct the source package from a Git tree be installed locally, >>> which is basically a full dgit implementation. > >> Does it? What if both the tag2upload client and server implemented >> instead some very simple serialization and canonicalization algorithm >> over the source package? > > The serialization isn't the problem, constructing the source package is. > Once you have a source package, there are lots of things you can do, but > the problem is precisely that going from a Git tree to a source package is > non-trivial and involves a whole bunch of Debian-specific code. We seem to be very focused on how one might reproduce the source package, to make sure that it can be bit-for-bit generated from the signed tag, which is clearly a hard thing to do. Do we actually need to do that at all? Would it not be sufficient to check that the resulting source package is a reasonable representation of the content pointed at by the signed tag. Given that we already have the source package at the point when we need to do this check, that really ought to be a lot easier than building the source package in the first place. If we had a tool that did that check, such that you could feed it a source package and a tag, and it would tell you if the source package was correctly generated from the tag, would that be enough to satisfy the FTP masters? If so, is there anything that makes it difficult to create such a tool? (my naive perception is that it's a lot easier to untar a tarball, and check that the contents match a git checkout than it is to make sure that git-archive is reproducible, and that this situation seems somehow analogous to that) Cheers, Phil. -- Philip Hands -- https://hands.com/~phil
Attachment:
signature.asc
Description: PGP signature