On Fri, May 31, 2019 at 7:58 AM Martin Kolman <mkolman(a)redhat.com> wrote:
I guess we can't just switch what the signature refers to as
there are other tools
that do this kind of verification on the compressed data, not just delta-RPM, right ?
So maybe, could we attach a second signature computed on the uncompressed payload ?
Delta-RPM could then use that to verify the reconstructed package & would be crazy
fast,
as the slow XZ compression will no longer be needed to be performed client-side to
verify
the signature.
"something like 90% of packages are below 1MB compressed" (ajax upthread)
How about only doing deltarpm on a subset of large packages: firefox,
libreoffice, etc, whose most recent RPMs are retained locally? Now
rebuilding the oldrpm doesn't need to happen. The space for the oldrpm
is needed anyway for the rebuild. Why not keep it, instead of
rebuilding?
--
Chris Murphy