On 1/7/21 10:41 AM, Panu Matilainen wrote:
On 1/5/21 8:12 PM, Matthew Miller wrote:
On Tue, Jan 05, 2021 at 01:05:01PM -0500, Ben Cotton wrote:
We want to add signatures to individual files that are part of shipped RPMs.
This is for _every file_ in every RPM? Or some files in some RPMs?
Every file in every RPM is the idea. This comes at at a very significant size increase for everything.
Taking the rather small and trivial popt package with 39 files as an example, pre and post file-signing [1]:
58254 JanĀ 7 11:19 /tmp/popt-1.18-1.fc33.x86_64.rpm 130222 JanĀ 7 11:21 popt-1.18-1.fc33.x86_64.rpm
Isn't there a cost in the fileystem too? Adding more and more additional file attributes increases space overhead and pushes people to ugly "DB in a file" "packs", while we know that small files is the right way to do many things (e.g. "*.d" directories for confs).
Can't this stuff be moved out of the main rpm and used only by whoever cares about signatures? Like debuginfo has been addressed (for sure an immensely more useful thing to have).
Regards.