boxit sync doesn't see changed package signatures #16

New issue

Open

opened 2018-04-11 18:33:43 +00:00 by philm · 1 comment

philm commented

2018-04-11 18:33:43 +00:00

(Migrated from gitlab.manjaro.org)

Created by: jonathonf

Upstream may upload new package signatures to fix issues with expired keys rather than rebuilding and/or bumping a package.

boxit sync currently pulls only changed packages and doesn't check whether the signature in the upstream package database, or the key file, has changed.

This can lead to situations where package signatures won't validate as the boxit server has the old package signature file.

If detecting these changes automatically isn't possible, boxit could do with a "clean" or "full sync" option to force a full sync from the upstream mirror so all files are checked and/or downloaded. Ideally this would still detect when a particular file hasn't changed and skip it.

*Created by: jonathonf* Upstream may upload new package signatures to fix issues with expired keys rather than rebuilding and/or bumping a package. boxit sync currently pulls only changed packages and doesn't check whether the signature in the upstream package database, or the key file, has changed. This can lead to situations where package signatures won't validate as the boxit server has the old package signature file. If detecting these changes automatically isn't possible, boxit could do with a "clean" or "full sync" option to force a full sync from the upstream mirror so all files are checked and/or downloaded. Ideally this would still detect when a particular file hasn't changed and skip it.

philm commented

2018-04-12 05:10:12 +00:00

(Migrated from gitlab.manjaro.org)

Created by: philmmanjaro

How many packages are currently affected by this? For now a manual server update task is needed.

*Created by: philmmanjaro* How many packages are currently affected by this? For now a manual server update task is needed.