Re: [ptxdist] [PATCHv2 1/2] strongswan: version bump 5.2.2 -> 5.3.2

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Tue, Jul 07, 2015 at 01:07:46PM +0000, Bruno Thomsen wrote:
> > >  STRONGSWAN_URL		:= http://download.strongswan.org/$(STRONGSWAN).$(STRONGSWAN_SUFFIX)
> >
> > Changing here to https to get this security related package would be nice.
> 
> Yes, I just tested https and it works flawlessly.
> I will send it as a new patch so it's highlighted in ptxdist short log, that packages should preferably be downloaded from https/ftps urls.
> 
> > By the way, is there any work in the pipe to get PGP-Signature verification into ptxdist instead of "md5summing"? 
> 
> Yes, PGP-signature verification could be nice. Would you bundle all public keys in ptxdist git repo?
> 
> An easy step stone could be to add SHA256 hash support in ptxdist. 
> 
> Pseudo code:
> if STRONGSWAN_SHA256 exist:
> 	hash = sha256sum STRONGSWAN_SOURCE
> 	return (hash == STRONGSWAN_SHA256)
> else
> 	hash = md5sum STRONGSWAN_SOURCE
> 	return (hash == STRONGSWAN_MD5)
> 
> 
> After looking at how the md5 hash check is performed, I think it's easier to
> add sha256 hashes to all rules and then change hash function.

I think we can just add another argument to ptxd_make_check_src /
ptxd_make_check_src_impl for the sha256sum. Then we can change the packages
on by one.

Michael

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

-- 
ptxdist mailing list
ptxdist@pengutronix.de