Date: Sat, 18 Jan 2020 01:13:36 +0200
From: Timo Teras <timo.teras@iki.fi>
To: "Drew DeVault" <sir@cmpwn.com>
Cc: "Natanael Copa" <ncopa@alpinelinux.org>,
 <~alpine/devel@lists.alpinelinux.org>
Subject: Re: repo pinning, whether to include repository name in pkg [was
 Re: new package format and repository layout changes]
Message-ID: <20200118011336.1b420be4@vostro.lan>
In-Reply-To: <BZYFLKB40RWB.2OYQP2D818H8G@homura>
References: <20200118001927.3492f70d@vostro.lan>
	<BZYFLKB40RWB.2OYQP2D818H8G@homura>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Fri, 17 Jan 2020 17:48:52 -0500
"Drew DeVault" <sir@cmpwn.com> wrote:

> On Sat Jan 18, 2020 at 12:19 AM, Timo Teras wrote:
> > > Still NACK on signing the repo name. Signed data should be
> > > autonomous of its original source, so long as it's signed it
> > > doesn't matter how it got to you.  
> >
> > Would you be able to give some reasoning, arguments or use-cases why
> > you think this is the correct approach?  
> 
> The whole point of cryptographic signing is to be able to move
> packages over an untrusted medium without ill effect. Should we also
> sign the mirror URL? I don't think so. What if someone wants to stand
> up a new mirror, do they really need us to intervene and agree to set
> up a key for them?
> 
> Consider for example that I run Alpine CI on builds.sr.ht. What if I
> want to cache downloaded packages on the LAN for faster builds by
> adding a "magic" repo?
> 
> These kinds of use-cases ought to be supported. If the package
> contents are signed by a trusted key, it's legit. Doesn't matter
> where it came from.

The above is not restricted in my suggestion. The signature is *not*
over the URL.

What I proposed putting in it, is the distro name and repository
portions only. E.g. the string "alpine/edge/community" or similar.

Doing caches and mirrors would still be supported as expected.

Are there any more detailed requirements you might have?

And do you think it should be possible to clone alpine/edge/community
and rename it to "mynewlinux/x.y-stable/main" without resigning?

Timo