gar2vcheck

Paul--

I submitted the original gar2vcheck, and I have been thinking of it 
again...may be timely that you're resurrecting the project. I'd be 
willing to help if you needed it.

I may have a requirement for a system that maintains a software archive 
that contains a self-hosting core of packages, and additional packages 
for variants, that maintains a secure record of the components included 
in any given build, that ensures the integrity of the build (verifying 
that the recorded versions of included components were the 
authoritative copies and are the same as the copies held in the 
archive, ...), that automatically updates from authoritative upstream 
sources, that versions its own build system, etc. I think gar + vcheck 
+ garchive + cvs + cryptographic checksums + some glue?? may be close 
to what I'm looking for. The point would be to be able to quickly 
generate high integrity, trusted, specialized systems, for everything 
from servers to desktop to embedded systems, all based on the same core 
and a common set of components, and to be able to rebuild from scratch 
any such system at any time after its release, including the toolchain 
used to produce it.

Bill Immerman