Date: Sat, 18 Jan 2020 00:19:27 +0200
From: Timo Teras <timo.teras@iki.fi>
To: "Drew DeVault" <sir@cmpwn.com>
Cc: "Natanael Copa" <ncopa@alpinelinux.org>,
 <~alpine/devel@lists.alpinelinux.org>
Subject: Re: repo pinning, whether to include repository name in pkg [was
 Re: new package format and repository layout changes]
Message-ID: <20200118001927.3492f70d@vostro.lan>
In-Reply-To: <BZY4HPQ7P5IO.32ODJBJGIGRTN@homura>
References: <20200117093110.13bfdc9f@vostro.lan>
	<BZY4HPQ7P5IO.32ODJBJGIGRTN@homura>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Fri, 17 Jan 2020 09:06:38 -0500
"Drew DeVault" <sir@cmpwn.com> wrote:

> On Fri Jan 17, 2020 at 9:31 AM, Timo Teras wrote:
> > Having said all this. I am still somewhat concerned and thinking
> > that putting repository name to the package might be useful thing.
> > But perhaps in should be the originally-built-from-repository and
> > not the index name.
> >
> > Does any of you share my concerns that the repo name should be
> > signed?  
> 
> Still NACK on signing the repo name. Signed data should be autonomous
> of its original source, so long as it's signed it doesn't matter how
> it got to you.

Would you be able to give some reasoning, arguments or use-cases why
you think this is the correct approach?

Thanks,
Timo