Date: Thu, 2 Jan 2020 22:28:39 +0200
From: Timo Teras <timo.teras@iki.fi>
To: "Drew DeVault" <sir@cmpwn.com>
Cc: "Rasmus Thomsen" <oss@cogitri.dev>, "Kevin Daudt"
 <kdaudt@alpinelinux.org>, <~alpine/devel@lists.alpinelinux.org>
Subject: Re: new package format and repository layout changes
Message-ID: <20200102222839.67345997@vostro.lan>
In-Reply-To: <BZIY70GY8LED.6O9B0FCA816L@homura>
References: <34cd93c2ddfb985c29b3b74862c9e71945a34954.camel@cogitri.dev>
	<BZIY70GY8LED.6O9B0FCA816L@homura>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Mon, 30 Dec 2019 13:00:34 -0500
"Drew DeVault" <sir@cmpwn.com> wrote:

> I'm not sure where in the thread this was originally mentioned, but -1
> to signing the repository name - i.e. main, community, edge, etc.
> 
> The source of the package is unimportant if its content can be
> verified with the signature. The ability to freely move signed
> packages between repos without re-signing them is desirable to me.
> Note as well that we do not sign the name of the mirror the package
> came from, despite arguably qualifying as some kind of metadata about
> the package.

The mirror is irrelevant for signing from my point of view.

But I'd rather not allow moving a alpine edge main to stable main
without rebuild (or at least resigning). So that's a different thing.

Though, I understand there might be need to to move packages like this
in certain scenarios. Is this just for purpose or redistributing the
packages in a new partial mirror, or alternate branding?

I would be interested to hear more about the use case to learn if we
could introduce a new feature to suit this requirement.

Timo