[Rpm-metadata] Another suggestion

[seth vidal]

> I have another small suggestion. I've just noticed that repomd.xml
> doesn't include information about the uncompressed files (e.g.
> primary.xml). It may be interesting to maintain this information around,
> since it'd make it possible to check the file validity after
> uncompressing it, and it'd also make it possible to maintain only the
> uncompressed file locally and even then know if the file has been
> changed remotely or not. Notice that I'm not suggesting to remove
> the current compressed information.

Looking at this I noticed a problem.

Timestamp preservation inside a gzip file is questionable to begin
with. 

In createrepo I've subclassed gzip in order to make sure it maintains
the timestamp internally, but as you said, servers lie about the time.
So I think just keeping a checksum for the uncompressed file is
sufficient for verifiying the file, it's not as quick as a timestamp
check, to be sure, but it's more reliable.


So I figure adding the uncompressed checksum only to each data element
in the repomd.xml file would be more appropriate and less bulky:

  <data type="primary">
    <location href="repodata/primary.xml.gz"/>
    <checksum type="md5">ca6a857c8055bff678e687284667a8ba</checksum>
    <uncompressed-checksum type="md5">somestring</uncompressed-checksum>
    <timestamp>1086241497</timestamp>
  </data>

the element name is a bit bulky, I'm open to other suggestions.

would that work for everyone?

-sv