Received: from mail.cmpwn.com (mail.cmpwn.com [45.56.77.53])
	by nld3-dev1.alpinelinux.org (Postfix) with ESMTPS id 6840F782B5D
	for <~alpine/devel@lists.alpinelinux.org>; Thu, 16 Jan 2020 14:27:40 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=cmpwn.com; s=cmpwn;
	t=1579184858; bh=+zIxsoJgEy4j2f967R/1pS1qlB/MvQ97yX2V849+6x4=;
	h=In-Reply-To:Date:Cc:Subject:From:To;
	b=WpCSaI/ZxcW9ASOb7zJugww8hKL0j30/QZZZyrtF0wBZ658ZuBn2xcYm3A1TJpDnQ
	 iq1vTZyjawgc6RAgm2SpNo3rfrWVq2pTfrA2kyjjJxmzMSADStTGv0wR7EHEw/MCpn
	 PQdNjhAt4CSRvcSlC60KVxetrN+N+z2qgo5OkIUk=
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
In-Reply-To: <20200116151947.63f7ade8@ncopa-desktop.copa.dup.pw>
Date: Thu, 16 Jan 2020 09:22:30 -0500
Cc: <~alpine/devel@lists.alpinelinux.org>
Subject: Re: apk-tools plans
From: "Drew DeVault" <sir@cmpwn.com>
To: "Natanael Copa" <ncopa@alpinelinux.org>, "Timo Teras"
 <timo.teras@iki.fi>
Message-Id: <BZXA7BCRF3I4.1S1I48FFFZ1KD@homura>

On Thu Jan 16, 2020 at 3:19 PM, Natanael Copa wrote:
> I think it as been mentioned before but I think it would be nice if we
> could have 2 operational install modes:
>
> - quick: in-the-air extraction/verification of packages (current style)
> - safe: store all packages locally and verify before trying to extract
> them
>
> safe mode is useful when the network connection is unreliable. In case
> of network error it could continue where it left off last time, rather
> than try fetch it all from scratch. Something like
> `apk upgrade --fetch-first` or `apk upgrade --safe`.

In my opinion, the "quick" mode is so unsafe that I find it really
objectionable to have at all. It's not just an unreliable network to
consider - what if a signature check fails partway through and the
upgrade aborts half-finished? What if an man in the middle orchestrates
this situation? "Quick" mode also makes it difficult to reckon if
there'll be sufficient disk space in advance - today apk just breaks
your system if it hits ENOSPC.