Re: Some ostree observatoins

[Florian Weimer <fweimer redhat com>]

On 02/21/2014 12:49 AM, Colin Walters wrote:
> [ Sorry about breaking threading...I accidentally archived your message
> and my current mail client apparently takes that to mean "delete
> permanently"... ]
>
> > I still need to review what is signed by GnuPG and how the hash
> > chaining works. Unless there is some documentation I've missed, this
> > will take quite a but of time because I have to reverse-engineer the
> > data structures from the source code itself.
>
> It's basically:  .commit -> .dirtree [ -> .dirtree ] -> .filez
>
> Where each arrow is a SHA256. And .commitmeta contains signature for
> .commit.  Please feel free to shoot me (or the list) a mail anytime if
> you have questions about the design.

I see some odd cases where ostree is hashing stuff internally that it 
has not downloaded from the repository.  I haven't yet figured out what 
is going on.

Having some explicit description of the GVariant data structures would 
help a lot.

--
Florian Weimer / Red Hat Product Security Team