Front page | perl.perl5.porters |
Postings from October 2009
On Wed, Oct 14, 2009 at 08:51:24PM +0200, demerphq wrote: > 2009/10/14 jesse <jesse@fsck.com>: > > > > > > On Wed, Oct 14, 2009 at 11:44:07AM -0700, Jan Dubois wrote: > >> On Wed, 14 Oct 2009, jesse wrote: > >> > > >> > > If you want to handle tarballs in vendor repositories, I see only the > >> > > extreme solution : run md5sum on source files, and compare with a list > >> > > just downloaded off CPAN, before compilation. > >> > > >> > I've been vaguely considering whether we want to ship something along > >> > the lines of a cpan-style SIGNATURE file with each release containing a > >> > pgp-signed list of the MD5 of every file in the distribution and a tool > >> > to verify those signatures later on an installed system. > >> > >> I find it only somewhat useful though as it will only cover changes in > >> Perl files and misses changes to XS code, or any of the C code in the > >> core. > > > > I'm pretty sure this is a bad idea, but one option could be to compute > > SHA1 sums of every file in the distro at build time and bake them into > > some perl -V output. > > You mean like the ones you get from doing a It's not how to get them that's at issue in my head. it's baking them into the built.Thread Previous