[Yum-devel] [PATCH] Add verison groups, for the version command.

[James Antill]

On Thu, 2009-09-24 at 14:28 -0400, Seth Vidal wrote:
> 
> On Wed, 23 Sep 2009, James Antill wrote:
> 
> > Config. file is /etc/yum/version-groups.conf
> >
> > Allows you to track subsets of packages to version.
> > ---
> > docs/yum.8              |    6 ++-
> > etc/Makefile            |    6 +++-
> > etc/version-groups.conf |   11 ++++++
> > yum.spec                |    1 +
> > yum/config.py           |   19 +++++++++++
> > yum/packageSack.py      |   35 +++++++++++++++----
> > yum/rpmsack.py          |   32 ++++++++++++++----
> > yumcommands.py          |   82 ++++++++++++++++++++++++++++++++++++++--------
> > 8 files changed, 159 insertions(+), 33 deletions(-)
> > create mode 100644 etc/version-groups.conf
> 
> 
> ACK on the patch.
> two items I thought of while reading it all over. - do we want to make the 
> hash sha256 instead of sha1?

 Two items?:)

 I'd initially thought about the hash thing, when I first did versions,
but I don't think we want to be chasing the hash of the weak^W week. I
mean I don't think we need crypto. level hashes, we just want something
that's usable which is going to be different a large percentage of the
time when there is a difference. Atm. the output looks like:

# yum version
Loaded plugins: aliases, noop, presto, security
Installed: 11/x86_64               1389:4e20e3f746e930be138bc78810e686c69c899a1d
Group-Installed: james-RHEL           5:27475cdd7a7a35e01c52f7ae204344b7ce50eeb6
Group-Installed: yum                 18:40d9dd4828d8627e0cfd6ce8d48a03fac5e3a4a8
version

 Now for the same file we get:

md5    47725e181cfeb8dde303d0782be0f5d5
sha1   1f9cc1ba30446e040f386771ec9a224c4f5b454a
sha256 c8d58b53261b284ad69aef6b64fd8d95c24b30bba4ae3a66ce846495683db044

...so I figured it was worth moving from md5 to sha1, but the move to
sha256 wasn't worth it. Also it seems like any decent attacker would
keep the nevra's the same (and thus. not alter the checksum anyway).

-- 
James Antill <james at fedoraproject.org>
Fedora