Jan Alexander Steffens <jan.steffens@xxxxxxxxx> on Mon, 2014/12/22 08:07:
> On Dec 22, 2014 8:00 AM, "Christian Hesse" <list@xxxxxxxx> wrote:
> > For Arch packages there is nothing that requires repeatable output.
>
> Yes, there is. Package signatures are made using the compressed package.
> Delta packages work by patching the uncompressed package and then
> recompressing it. If the compressor works differently the verification of
> the product will fail. I'm not sure xdelta3 in smart enough to compensate,
> or if the needed information is even there.
Ah, ok... Never used delta packages. You are right then.
But the same applies for other compression options, no? How is gzip
compression speed (-1...9 --fast --best) handled?
--
main(a){char*c=/* Schoene Gruesse */"B?IJj;MEH"
"CX:;",b;for(a/* Chris get my mail address: */=0;b=c[a++];)
putchar(b-1/(/* gcc -o sig sig.c && ./sig */b/42*2-3)*42);}
Attachment:
pgpg3Pa1wWVCK.pgp
Description: OpenPGP digital signature
