search

ceph / merfi

Finds and signs files with different signing tools (gpg, rpm-sign)
MIT License
3 stars 3 forks source link

RFE: inline-sign .dsc files #19

Open ktdreyer opened 8 years ago

ktdreyer commented 8 years ago

It is typical for Debian/Ubuntu to sign all .dsc files. This ticket explores the possibility of having merfi handle this.

An example of an inline-signed .dsc file (the curl package for trusty): http://us.archive.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.19.7-1ubuntu1.dsc

The problem is that this affects the reprepro metadata, because the .dsc file's overall checksum changes after it gets signed.

An example of a metadata file that contains a checksum of a .dsc file is http://us.archive.ubuntu.com/ubuntu/dists/trusty/main/source/Sources.bz2

The workflow would have to look something like this:

  1. Inline-sign the .dsc file (conventionally Debian developers use debsign for this, but technically it could be done with gpg or rpm-sign)
  2. Add the signed .dsc file using reprepro
  3. Sign the repo's Release files (as merfi already does).

Alternatively, if we wanted to do the signing without interleaving reprepro, another workflow might be:

  1. Add the unsigned .dsc file to the repo, using reprepro
  2. Inline-sign the .dsc file
  3. Re-write the sha sums for the newly-signed .dsc file within the Sources file(s)
  4. Re-write the sha sums for the newly-altered Sources within the Release file
  5. Sign the repo's Release file (as merfi already does).

This is more complex, more tightly coupled with the behavior of reprepro, and more prone to possible errors. On the other hand, the advantage is that reprepro can be run only once at the beginning, before anything has to be signed.

Maybe it would be easier to package and build reprepro for Red Hat rel-eng's platform (ie RHEL 6) than it would be to implement this "fiddle with the checksums" workflow in merfi.

ktdreyer commented 8 years ago

TODO: check out https://github.com/mkouhei/pydebsign . It is a Python re-implementation of debsign, and it might suit our goals.

ktdreyer commented 8 years ago

Any .changes files that reference .dsc files need to be rewritten as well. They typically contain checksums of the .dsc files.

ktdreyer commented 7 years ago

Note: this blog post has more information about generating repo metadata. The dpkg-scansources utility (dpkg-dev RPM in EPEL 7) can generate the Sources file from .dsc files.