[Haskell-cafe] Improvements to package hosting and security
magnus at therning.org
Thu Apr 16 22:01:22 UTC 2015
On Thu, Apr 16, 2015 at 03:28:10PM +0000, Michael Snoyman wrote:
> Minor update. Some of your points about checking signatures before
> unpacking made me curious about what Git had to offer in these
> circumstances. For those like me who were unaware of the
> functionality, it turns out that Git has the option to reject
> non-signed commits, just run:
> git pull --verify-signatures
> I've set up the Travis job that pulls from Hackage to sign its
> commits with the GPG key I've attached to this email (fingerprint
> E595 AD42 14AF A6BB 1552 0B23 E40D 74D6 D6CF 60FD).
One thing I, as a developer of a tool that consumes the Hackage
index, would like to see is a bit more meta data, in particular
- alternative download URLs for the source
- hashes of the source (probably needs to be per URL)
I thought I saw something about this in the thread, but going through
it again I can't seem to find it. Would this sort of thing also be
included in "improvements to package hosting"?
Magnus Therning OpenPGP: 0xAB4DFBA4
email: magnus at therning.org jabber: magnus at therning.org
twitter: magthe http://therning.org/magnus
There's a big difference between making something easy to use and
making it productive.
-- Adam Bosworth
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 163 bytes
Desc: not available
More information about the Haskell-Cafe