[Rpm-metadata] Another suggestion

[seth vidal]

On Thu, 2004-06-03 at 02:02 -0400, seth vidal wrote:
> > I have another small suggestion. I've just noticed that repomd.xml
> > doesn't include information about the uncompressed files (e.g.
> > primary.xml). It may be interesting to maintain this information around,
> > since it'd make it possible to check the file validity after
> > uncompressing it, and it'd also make it possible to maintain only the
> > uncompressed file locally and even then know if the file has been
> > changed remotely or not. Notice that I'm not suggesting to remove
> > the current compressed information.
> 
> Looking at this I noticed a problem.
> 
> Timestamp preservation inside a gzip file is questionable to begin
> with. 
> 
> In createrepo I've subclassed gzip in order to make sure it maintains
> the timestamp internally, but as you said, servers lie about the time.
> So I think just keeping a checksum for the uncompressed file is
> sufficient for verifiying the file, it's not as quick as a timestamp
> check, to be sure, but it's more reliable.
> 
> 
> So I figure adding the uncompressed checksum only to each data element
> in the repomd.xml file would be more appropriate and less bulky:
> 
>   <data type="primary">
>     <location href="repodata/primary.xml.gz"/>
>     <checksum type="md5">ca6a857c8055bff678e687284667a8ba</checksum>
>     <uncompressed-checksum type="md5">somestring</uncompressed-checksum>
>     <timestamp>1086241497</timestamp>
>   </data>
> 
> the element name is a bit bulky, I'm open to other suggestions.
> 
> would that work for everyone?
> 

The addition of this data takes the repomd.xml file from ~650 bytes to
~950bytes. Not a huge hit - figure one of these per repository - it's
not too much for a site to take, though I admit it could definitely be
smaller.

We could compress this file if it was really too big - it folds down to
~350 bytes.

I'm not sure it makes that much difference, of course.

-sv