Messages in this thread | | | Date | Sat, 15 Oct 2011 08:42:42 +0200 | From | Willy Tarreau <> | Subject | Re: Answers to some common kernel.org account questions |
| |
Hi Greg,
On Fri, Oct 14, 2011 at 09:21:00AM -0600, Greg KH wrote: > WHAT ABOUT FILE UPLOADS? > > The "robot signing" of uploaded files that was used in the past is no > longer considered to be sufficiently secure, so a new policy has been > instituted. A new tool ("kup") has been developed to help with the > implementation of that policy; it works in a manner similar to the > upload system used by the Debian project. > > The kup tool will require developers to sign files with their PGP key > prior to uploading to kernel.org. This mechanism will keep the private > signing keys from ever being stored on kernel.org (or any other server). > More information will be made available once the file upload capability > is restored.
Please reassure me, we will only have to upload the sig, not the whole file ? I'm assuming that it will still be possible to generate the files from the git tree (which should produce the exact same file, hence the same sig). I'm asking because uploading 2*75 MB kernels will take slightly more than two hours at full load assuming the link does not break at all during this time, while a git push of one hundred patches only takes a few seconds. This is a huge difference in efficiency and reliability !
Regards, Willy
| |