Bug#207400: An RPM port of APT
> > I've just read "How it works" in the URL you mentioned. That's exactly
> > how our system works.
>
> The high level is the same, but the implementation details are not.
> Mainly we have a metaIndex object which itself queues the index files
> for download once it's done and verified. This came out of a lot of
> discussion with Jason. Also the fingerprint checking is a bit more
> abstracted. And there's other things too that I don't recall offhand.
I'm surprised for knowing about this just now. I'd like to have made
part of that discussion. Anyway, I hope Matt will be able to extract
whatever he finds interesting from both implementations, and will take
care as hard as possible to avoid breaking legacy usage. I'll merge
it back into apt-rpm once it's there (of course, as far as it doesn't
break our system completely).
> > They have even mentioned to be using a "small
> > part" of our code in the "Authors" section (besides that which was
> > *already* merged in APT, I belive).
>
> Yeah. We took your gpg method, and turned it into a gpgv method, since
> using root's keyring doesn't seem like a good idea to me.
> There were other smallish cleanups and fixes associated with this.
We haven't found any problems using root's keyring for that, since
nobody usually takes the root keyring for personal applications, and a
system application like this seems legitimate for that. Anyway, that
could be easily made configurable in the gpg method. That's the kind of
stuff that breaks compatibility between our implementations
unnecessarily. Matt, please check this when merging. I'm able to help
you if necessary.
--
Gustavo Niemeyer
http://niemeyer.net
Reply to: