On Wed, 23 Sep 2009, Jonathan Dieter wrote:
As I think may have been mentioned elsewhere, the *only* problem is that the rpm signatures must match and the signatures are over the *compressed* rpm. I would *love* to see deltarpm rebuilding uncompressed rpms, but that will require storing two signatures per rpm in the metadata (compressed and uncompressed sha256), and either modifying yum to check the appropriate one, or deltarpm to change the rpm's signature to the uncompressed one. I don't think we want to go down the road of having deltarpm-rebuilt rpms not having their signature checked at all.
I agree about having to deal with the signatures but as a minor mitigating circumstance - we're going to be gpg signing the repomd.xml - which should at least help you keep a safe infrastructure down to the deltarpm metadata.
-sv -- fedora-devel-list mailing list fedora-devel-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-devel-list
