Closed tartansandal closed 9 years ago
I'm still wrapping my head around the signature mechanics, so I don't have any comment on that yet.
It seems like the audit
command is intended to be an extensible interface for reporting arbitrary information about distributions in your repo, like "tell me all dists with a GPL license", "or tell me all dists that don't have any tests".
Therefore, the essence of the audit
command is (or should be) a visitor pattern that can invoke arbitrary code on each distribution. So the actual business of verifying signatures seems orthogonal to the command itself. In other words, verification is an extension or plugin to Action::Audit, but not part of it.
Does that make any sense? Or have I completely misunderstood your vision?
Added 8 commits to hopefully address issues raised. Many thanks for looking over this. Travis is still complaining which is sad :-(
After writing #186, I'm thinking that, rather than having 2 options, --verify-upstream
and --verify-upstream-strictly
, we should set an --upstream-verification-level
with 5 meaningful levels.
After cloning pinto-release into my test repository, the behaviour of the verification command is very slow. This was the motivation for adding the progress meter dots. Not sure why this is happening, but the slow down is substantial and warrants investigation. Maybe slow upstream or, well, a bug.
This PR has gotten way to messy. I'm going to close it and rebase a fresh one.
Note: requires 2 new modules for the Pinto stack: Safe and Module::Signature