Re: [Sbcl-devel] SHA-1 implementation for contrib/

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


[ CCed to cclan-list, clump.  Apologies to people on >1 list who get
  multiple copies.  I recommend Gnus with 
  (setq gnus-suppress-duplicates t)                                  ]

Miles Egan <[email protected]> writes:

> On Fri, 2003-08-08 at 01:16, Nathan J. Froyd wrote:
>> Pursuant to crhodes's suggestion, I have packaged up the SHA-1
>> implementation I announced on the Clump mailing list yesterday 
> This will be v. nice to have in the core distribution.
>
> While we're at it, I know sbcl devel core is reluctant to add extra
> things to contrib, but a good base64 library would be very handy too. 
> Kevin Rosenberg's seems like a good one.

The main criterion for contrib is "SBCL-specific".  The SHA1 I'm
looking at here (thanks, btw) definitely qualifies on those grounds
due to lashings of sb-kernel:32bit-logical-and and the like.  Does
base64 really have the same efficiency issues?

That said, I know it's a lot more convenient when this stuff is
bundled instead of having to be downloaded and installed separately -
at least, for people who want it, or who have sufficiently fast
internet connections that they don't mind the extra weight even if
they're not going to use it.  

So, I propose that we accept an automated download tool (asdf-install
or cclan-get or something) into contrib, then there's much less
fussing around for people who want to grab larger or plausibly
portable packages for use with SBCL.  I'd be inclined to go for
asdf-install, with the following changes:

- - ability to run from the Lisp prompt as well as from the unix shell

- - defaults to /not/ checking PGP signatures when the package is 
  being downloaded from a CCLAN site, because for the average user
  to get their web-of-trust sufficiently sorted out is tricky.  
  Still checks signatures from random sites, because that's much
  riskier behaviour

  (Incidentally, IWBNI there were a CL interface to pgp/gpg that could
  do general things like sign/encrypt/decrypt streams, verify
  signatures and tell you who signed something, etc etc)

- - some documentation would be nice


Objections?

- -dan

- -- 

   http://www.cliki.net/ - Link farm for free CL-on-Unix resources 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE/NOrxHDK5ZnWQiRMRApCRAKCM/joos4aHPXpR0Iz/1lJq2qFxTgCcCCPS
u1eV4NAAr3noU+BAqeTqE8M=
=kZPt
-----END PGP SIGNATURE-----