Re: signed summary file

[Matthew Barnes <mbarnes redhat com>]

On 05/04/2015 10:27 AM, Giuseppe Scrivano wrote:
> I am working on having static-delta files listed into the summary, in
> this way it will be possible to sign only the summary file instead of
> each file separately:
>
> https://github.com/GNOME/ostree/pull/98
>
> As part of the review process, we got into the question whetever it is
> better to have a separate summary.sig file, as my series does, or
> instead include signatures in the summary file itself and by possibly
> breaking backward compatibility.


I wanted to review the comments there but can't find them now.

Did you perhaps force-push a rebase?  If so, can you scrounge up links 
to the relevant comments?

(GitHub not keeping rebase history on a PR is very annoying.)

I also don't have a strong opinion on the issue, but I'm still learning 
the summary code.  I think my question still stands on whether summary 
extensions (currently unused) should be part of the signed content.

Matt