Arch Linux

+1 from me if it isn't a P in the A.

Do they usually live at a well-defined location that we could guess at, or would this be a separate array? Part of me says a separate array would be best, so something like:

source=('http://my.com/foobar/asdfasdf-$pkgver.tar.gz' 'mypatch1' 'myconfig1')
signatures=('http://my.com/foobar/asdfasdf-$pkgver.tar.gz.sig' '' '')

The emptiness indicates "no sig available", or perhaps we could use some other sentinel value.

For GNU projects, the signatures are always alongside the source file, but I am sure there would be exceptions so a separate array is almost definitely the way to go.

We could even add one magic value that says "hey it's $filename.sig" or something.

I was thinking about working on this.

my plan was to add a sigcheck build option. then in download_sources check for the flag if it is set download the *.sig file along with the existing file.

then in replace of md5sum checking use gpg --verify . this part I'm still looking into.

ok I did some hacking this is based of
http://projects.archlinux.org/pacman.git master HEAD


git diff can be found here.
https://github.com/str1ngs/pacman/compare/sigs

this is just a rough outline I can post proper patches to the ML if needed.

In a nut shell it looks for a sig option in the PKGBUILD only. if it is set then it will download the sig
along with the source file.

it will then run check_checksigs and check downloaded files only. it also runs check_checksums after which is redundant but since its checking local files anyways I do not see the harm.

the only real issue I see here is not being able to set sig in makepkg.conf. however it does give the option for Allan and others to atleast sig check toolchain/gnu related builds on a per PKGBUILD basis.

I've done nearly the same thing (without checking the bugtracker first): https://github.com/mineo/pacman/compare/makepkg-pgp

We shouldn't be doing this two different ways, so please contact me (github, irc (same nick as here)) or follow the existing thread on the mailing list.

Implemented in http://projects.archlinux.org/pacman.git/commit/?id=94f61c5b . Will leave open to remind me to tidy documentation...

Documentation, Allan? :)

It is started... Will try and tidy up this weekend.