qubes-whonix build debuggbility of tags

[phabricator-migrator]

Information

ID: 252
PHID: PHID-TASK-kbsssqschxprqmctedgd
Author: Patrick
Status at Migration Time: invalid
Priority at Migration Time: Normal

Description

As per https://phabricator.whonix.org/T233#3363… Can you make builds without having signed tags available? @nrgaway

An eventual dependency on official signed git tags seems for non-redistributable builds seems weird, complicating and slowing down developing. Let’s suppose that tag doesn’t work, and we’d need 4, 5 intermediate test builds for development, then it would be awful if you’d always need to wait for me to create the tag.

Comments

---

nrgaway

2015-04-01 14:24:22 UTC

Personally I can make builds without signed tags since I use my repo when testing and I sign every commit and tag/sign every push.

By default the qubes-builder will not even initialize the git repo on download if it is not signed and verified. The process to download sources in then aborted. There is a flag that can be set to not verify, but it is really only useful in weird situations.

I would not advise an end user to disable verification though.

---

Patrick

2015-04-02 12:22:22 UTC

Seems not an issue then.