Re: [gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL

2015-09-23 Thread Justin (jlec)
On 22/09/15 22:16, Tim Harder wrote: > On 2015-09-22 15:23, Justin Lecher (jlec) wrote: >> https://github.com/jlec/gentoo/commit/0df86dcca0aa981fa7bdba633653697e2b >> 40781c > >> Although my script checks whether the size and SHA256 changed, but >> better you could also take a look. > > You could

Re: [gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL

2015-09-22 Thread Tim Harder
On 2015-09-22 15:23, Justin Lecher (jlec) wrote: > https://github.com/jlec/gentoo/commit/0df86dcca0aa981fa7bdba633653697e2b > 40781c > Although my script checks whether the size and SHA256 changed, but > better you could also take a look. You could open a pullreq against the gentoo github repo an

Re: [gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL

2015-09-22 Thread Justin Lecher (jlec)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi there, I did a first fix run. https://github.com/jlec/gentoo/commit/0df86dcca0aa981fa7bdba633653697e2b 40781c Although my script checks whether the size and SHA256 changed, but better you could also take a look. Thanks, Justin -BEGIN PGP S

Re: [gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL

2015-09-20 Thread Tim Harder
On 2015-09-18 04:58, Justin (jlec) wrote: > 2. > Any suggestion how to do this? repoman has a manifest-check function but that > is > not functioning (bug filed). Any other tool around? Perhaps using pkgcheck? With regards to pkgcheck, run the following in a configured gentoo repo to generate a l

Re: [gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL

2015-09-20 Thread Justin Lecher (jlec)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 20/09/15 19:41, Robin H. Johnson wrote: > On Fri, Sep 18, 2015 at 10:58:22AM +0200, Justin (jlec) wrote: >> Hello, >> >> there are quite a number of Manifest still not containing one or >> more of the three hashes. I would like to update them as

Re: [gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL

2015-09-20 Thread Robin H. Johnson
On Fri, Sep 18, 2015 at 10:58:22AM +0200, Justin (jlec) wrote: > Hello, > > there are quite a number of Manifest still not containing one or more of the > three hashes. I would like to update them as far as we can download the > sources. 540 of 17841 Manifest files have the problem, about 3%. Qui

Re: OpenPGP verification of source files (was: Re: [gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL)

2015-09-18 Thread Rich Freeman
On Fri, Sep 18, 2015 at 5:16 AM, Kristian Fiskerstrand wrote: > I do sincerely hope package maintainers > have a well thought out setup for key management locally and in fact > verify the OpenPGP signatures vs known good keys, and that appropriate > measures are being taken in the case of non-main

OpenPGP verification of source files (was: Re: [gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL)

2015-09-18 Thread Kristian Fiskerstrand
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 09/18/2015 10:58 AM, Justin (jlec) wrote: > Hello, > > there are quite a number of Manifest still not containing one or > more of the three hashes. I would like to update them as far as we > can download the sources. > > Procedure would be: 1. D

Re: [gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL

2015-09-18 Thread hasufell
On 09/18/2015 10:58 AM, Justin (jlec) wrote: > > 4. > What do you think is the best commit mode? PKG based, Cat based or repo based? > Repo based, don't bother with hundreds of commit messages. It's all about the same problem.

[gentoo-dev] Updating all Manifest to contain SHA256 SHA512 WHIRLPOOL

2015-09-18 Thread Justin (jlec)
Hello, there are quite a number of Manifest still not containing one or more of the three hashes. I would like to update them as far as we can download the sources. Procedure would be: 1. Download package 2. verify current hashes match 3. Calculate new 4. commit Following question need to be ans