guix: Brainstorm w/re guix.sigs repo layout #21273

issue dongcarl openend this issue on February 22, 2021

dongcarl commented at 9:52 pm on February 22, 2021: member
A few ideas for modernizing the layout as we’re creating a new guix.sigs repo:
1. Hierarchy would look something like: guix.sigs/$TAG/$HOST(-codesigned)/$SIGNER/SHA256SUMS
2. We can move contrib/gitian-keys to this new guix.sigs repo
These are just some initial thoughts, please let me know if this sounds reasonable without bike-shedding 😬
dongcarl added the label Brainstorming on Feb 22, 2021
achow101 commented at 11:12 pm on February 22, 2021: member

I don’t think the only signature should be the commit. It makes it harder to verify a particular version after the fact because then you involve git and having to find the commit in the git history. Not to mention the fact that occasionally, the hashes file can change if someone does a rebuild (e.g. after clearing caches). I like the current method of a hashes file and then .sig of that file. It would just be a SHA256SUMS.sig in addition to the SHA256SUMS.
dongcarl commented at 6:25 pm on February 23, 2021: member

I don’t think the only signature should be the commit…

True!
dongcarl added this to the "Issues" column in a project
dongcarl commented at 9:44 pm on March 17, 2021: member

Layout is now implemented in: #21462
dongcarl closed this on Mar 17, 2021
dongcarl moved this from the "Issues" to the "Done" column in a project
DrahtBot locked this on Aug 18, 2022