--- xml/htdocs/proj/en/glep/glep-0058.html 2010/01/13 01:02:36 1.2 +++ xml/htdocs/proj/en/glep/glep-0058.html 2010/01/13 03:28:33 1.3 @@ -27,9 +27,9 @@
If other Manifests are added (such as per-category, per first-level -directory, or protecting versioned eclases), the size of the +directory, or protecting versioned eclasses), the size of the MetaManifest will be greatly reduced, and this specification was written with such a possible future addition in mind.
MetaManifest generation will take place as part of the existing process @@ -204,7 +204,7 @@ automated Gentoo keys. See [#GLEPxx+3] for full details regarding verification of GnuPG signatures. 1. Abort if the signature check fails.
On all rsync mirrors directly maintained by the Gentoo infrastructure, and not on community mirrors, there should be a new module 'gentoo-portage-metamanifests'. Within this module, all MetaManifests -for a recent time frame (eg one week) should be kept, named as +for a recent time frame (e.g. one week) should be kept, named as "MetaManifest.$TS", where $TS is the timestamp from inside the file. The most recent MetaManifest should always be symlinked as MetaManifest.current. The possibility of serving the recent -MetaManifests via HTTPS should also be explored to mitigate MitM -attacks.+MetaManifests via HTTPS should also be explored to mitigate +man-in-the-middle attacks.
The package manager should obtain MetaManifest.current and use it to decide is the tree is too out of date per operation #2 of the verification process. The decision about freshness should be a @@ -286,10 +286,10 @@
With only two levels of Manifests (per-package and top-level), every -rsync will cause a lot of traffic transfering the modified top-level +rsync will cause a lot of traffic transferring the modified top-level MetaManifest. To reduce this, first-level directory Manifests are strongly recommended. Alternatively, if the distribution method -efficently handles small patch-like changes in an existing file, +efficiently handles small patch-like changes in an existing file, using an uncompressed MetaManifest may be acceptable (this would primarily be distributed version control systems). Other suggestions in reducing this traffic are welcomed.@@ -330,7 +330,7 @@
Copyright (c) 2006 by Robin Hugh Johnson. This material may be +
Copyright (c) 2006-2010 by Robin Hugh Johnson. This material may be distributed only subject to the terms and conditions set forth in the Open Publication License, v1.0.
vim: tw=72 ts=2 expandtab:@@ -340,7 +340,7 @@