X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=-2.8 required=5.0	tests=AWL,BAYES_00,KHOP_THREADED,T_RP_MATCHES_RCVD
X-Spam-Check-By: sourceware.org
Message-ID: <4FD73CC9.3070501@etr-usa.com>
Date: Tue, 12 Jun 2012 06:57:45 -0600
From: Warren Young <warren AT etr-usa DOT com>
User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: Re: Trusted Software Vendor
References: <!&!AAAAAAAAAAAYAAAAAAAAAH3PqnIBVHtCiVMVjN0ExZLigAAAEAAAAJXIkaLIcH5Pn+g+gRSa2KoBAAAAAA==@expertise.cl> <20120608184641 DOT GA13771 AT ednor DOT casa DOT cgf DOT cx> <4FD32DC5 DOT 10703 AT gmail DOT com> <20120609155700 DOT GA21988 AT ednor DOT casa DOT cgf DOT cx>
In-Reply-To: <20120609155700.GA21988@ednor.casa.cgf.cx>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

On 6/9/2012 9:57 AM, Christopher Faylor wrote:
>
>and I'm really
> not willing to burden cygwin.com with the cycles necessary to unpack
> tarballs at cygwin.com to sign them.

Based on the traffic I see to cygwin-apps, my sense is that this would 
amount to single-digit CPU-minutes per day, once you get through the 
initial conversion.  That can be nice'd to the point that it takes a 
month; this doesn't have to be a Big Bang conversion.

I think a much bigger problem is getting a Linux toolchain set up on the 
main package repo server that can sign these executables.  My Google-fu 
says the GNU tools have no idea how to do this today.

Then someone has to spend at least a few hours writing and testing the 
script to do all this.  It might take a person-day.

Red Hat might not have to buy a code signing cert for this.  They might 
already have one that will work: http://goo.gl/5Hm3C

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple