Re: signed summary file

[Matthew Barnes <mbarnes redhat com>]

On 05/05/2015 11:54 AM, Colin Walters wrote:
> On Mon, May 4, 2015, at 05:13 PM, Matthew Barnes wrote:
>
> > I also don't have a strong opinion on the issue, but I'm still learning
> > the summary code.  I think my question still stands on whether summary
> > extensions (currently unused) should be part of the signed content.
>
> If we want to have static delta checksums covered, then they need to be.

...

> So...I think I'm OK with adding a new `summary.sig`.  It has the advantage
> of sharing architecture with the commit signatures.  At some point soon
> I think I need to take an action item to write up some basic documentation
> on the repository layout that we can fill in with things like this.

Okay, so if summary extensions need to be part of the signed content 
then that leaves no place to cram signatures directly into a summary 
file without breaking the format.

So I'm in favor of a separate summary.sig as well.

Matt