On Sun, Oct 11, 2009 at 5:35 PM, Allan McRae <allan@archlinux.org> wrote:
Loui Chang wrote:
On Sun 11 Oct 2009 11:14 -0500, Dan McGee wrote:
On Sun, Oct 11, 2009 at 7:57 AM, Allan McRae <allan@archlinux.org> wrote:
Dan McGee wrote:
On Sun, Oct 11, 2009 at 6:59 AM, Allan McRae <allan@archlinux.org> wrote:
The current --skip-integ isa bit weird. It does not skip integrity checks, but instead does them and prints a warning. Change this behaviour to actually skipping the checks.
I (we?) did this on purpose; we didn't want to skip the following check:
elif [ ${#integrity_sums[@]} -gt 0 ]; then error "$(gettext "Integrity checks (%s) differ in size from the source array.")" "$integ"
That seems strange to me. If you are skipping integrity checks, then do you really care if the array size is wrong?
I thought this point got brought up here and no one objected (and I agreed with Xavier, maybe offline somewhere): http://bugs.archlinux.org/task/15830
Xavier: "I prefer Profjim's patch, except I would keep the error in case of incomplete (whats the point of letting an incomplete checksums array in a pkgbuild...)"
The only change I really think makes sense is only allow --skip-integ if there are no checksum arrays at all; that way you can never produce an invalid source package; I would assume we shouldn't allow source package creation without integrity sums?
Yeah that makes sense. If you didn't include checksums then makepkg could assume that they aren't important. It shouldn't explicitly allow creating invalid packages.
It seems a very strange name to me then... --skip-integ means do integrity checks but ignore the results when the actual integrity checks fails but not in the case where the array sizes are different? How is the array size being different any worse than a wrong checksum?
Also, when did we start assuming people were stupid. If I use the --skip-integ option, then I know there are issues with my md5sums or I do not want to download the sources to check them. Either way, I have gone out of my way not to check them so I really do not want them checked.
I only assume people are stupid when they combine --skip-integ with something that makes no sense. One of these (and I could even concede this one) is when the *sum array is there but completely the wrong size. I think my point here would make more sense if --skip-integ really only worked for times when there were no checksums at all present. However the second reason is more serious. If you do --source --skip-integ, that is a terrible decision. This is something that can be given to someone else and they have *no idea* this is a completely broken source package. To me, this is no better than a package with missing dependencies, etc. -Dan