Re: [Gnu-arch-users] tla--devo--1.2 has preliminary gpg stuff

[Miles Bader]

On Thu, Dec 25, 2003 at 09:19:01PM -0500, James Blackwell wrote:
> I heard a nasty rumor from Bob that mirrors aren't signed. 

I just checked:  mirroring seems to regenerate the ../checksum files, and if
the mirror has a =meta-info/signed-archive file, it will re-run gpg to sign
the checksum files in the mirror.

Is there any reason why it can't simply _copy_ the checksum file, along with
any gpg signature information in the original archive?  That seems a lot more
convenient, as well as being more `correct' (who knows how much time passes
between commit and mirroring), and a lot more useful for pull-based
mirroring.

-Miles
-- 
"Most attacks seem to take place at night, during a rainstorm, uphill,
 where four map sheets join."   -- Anon. British Officer in WW I