On Fri, Jun 27, 2014 at 7:35 PM, Kevin Fenzi <kevin@xxxxxxxxx> wrote: > On Fri, 27 Jun 2014 19:23:04 +0200 > drago01 <drago01@xxxxxxxxx> wrote: > >> Why? > > My understanding of the process as it exists: > > Download drpm. > Take drpm contents + old package files installed locally that were not > changed and create updated rpm. > yum/dnf hands off this updated new version to rpm as normal. > > If they didn't create the orig rpm, it would require rpm to handle > drpms differently and apply them somehow on existing files and update > rpmdb. If the drpms were signed, only those parts of the package that > changed in that drpm could be verified, the rest of the ones from the > filesystem would just be whatever was on the filesystem. Whatever is on the filesystem does not be rechecked for signature ... only integrity needs to be checked (and rpm already can do that). Signing the delta files would mean you can verify that you did not download a malicious delta file. > Right now rpm doesn't need or want to know anything about drpms. > If we change the process, you would likely need to implement drpm > support in rpm directly. I don't know if rpm maintainers would be open > to this, but I suspect it would be a lot of work. Or do the verification of the delta signatures elsewhere (like by delta rpm). -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
