Re: gar2vcheck

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, Feb 15, 2006 at 10:55:20PM -0500, William Immerman wrote:
> Paul--
> 
> I submitted the original gar2vcheck, and I have been thinking of it 
> again...may be timely that you're resurrecting the project. I'd be 
> willing to help if you needed it.
> 
> I may have a requirement for a system that maintains a software archive 
> that contains a self-hosting core of packages, and additional packages 
> for variants, that maintains a secure record of the components included 
> in any given build, that ensures the integrity of the build (verifying 
> that the recorded versions of included components were the 
> authoritative copies and are the same as the copies held in the 
> archive, ...), that automatically updates from authoritative upstream 
> sources, that versions its own build system, etc. I think gar + vcheck 
> + garchive + cvs + cryptographic checksums + some glue?? may be close 
> to what I'm looking for. The point would be to be able to quickly 
> generate high integrity, trusted, specialized systems, for everything 
> from servers to desktop to embedded systems, all based on the same core 
> and a common set of components, and to be able to rebuild from scratch 
> any such system at any time after its release, including the toolchain 
> used to produce it.
> 
> Bill Immerman

Hi Bill,

Great to hear from you.  

I really like your approach above.  The one thing missing above, that I can
envision, is the actual build environment in the form of a chroot.  As building
the lnx-bbc from sources can illustrate, the build environment comes into play
in the final deliverable too.

We have some chroots for the ppc and i386 variants.  Is this something you'd be
interested in including?

- -- 
Paul Gray                                         -o)
323 Wright Hall                                   /\\
University of Northern Iowa                      _\_V
Message void if penguin violated ...  Don't mess with the penguin
No one says, "Hey, I can't read that ASCII attachment ya sent me."
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFD9HicOH45TZW7mh4RAsIKAJ9LDQGwfNZmr3vNKCToP1c/ZhycNQCeOh6X
bpuqle72RmF/LhPctWjlX48=
=ZSGD
-----END PGP SIGNATURE-----