Re: Invalid checksums in repodata

Hi,
	(Context here is that createrepo created invalid metadata after package
signing - it reused cached csums from before the package signing)

On Wed, 2006-10-11 at 13:42 +0100, Mark McLoughlin wrote:
> On Wed, 2006-10-11 at 07:53 -0400, Jesse Keating wrote:
> > On Wednesday 11 October 2006 07:33, Mark McLoughlin wrote:

> > >         I had a little look through the logs and the problem seems to be
> > > that the checksum cache in /mnt/redhat/scripts/distill-cache is keyed off
> > > the sha1header which is the same whether the package is signed or not.
> > > Looks like we need a different cache for signed packages.
> > 
> > Arg, yeah.  The caching is horrible right now.  I'll fix it and spin again.
> 
> 	It should be fixed in latest createrepo with the attached patch, FWIW.

	Wait ...

  https://lists.dulug.duke.edu/pipermail/rpm-metadata/2006-June/000656.html

	SIGMD5 is "is invariant to signing events"? Sigh, that's what we don't
want :-)

	The csum cache should really be keyed off the signature since the
signature affects the csum - looks like Han's original patch:

  https://lists.dulug.duke.edu/pipermail/rpm-metadata/2006-June/000655.html

	was more like what's needed.

Cheers,
Mark.