From 7ece95bae42f202007345ac3b07908e22787b0a4 Mon Sep 17 00:00:00 2001 From: Holger Levsen Date: Sat, 12 Dec 2015 12:54:25 +0100 Subject: reproducible archlinux: use gpg to verify sources --- TODO | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'TODO') diff --git a/TODO b/TODO index 99a0c72d..1cbe1e2b 100644 --- a/TODO +++ b/TODO @@ -309,8 +309,8 @@ This is about Debian, below are more todo entries for other projects… * arch build.sh: ** introduce more variations: USER ** confirm the others are really working -** 'makepkg --skippgpcheck' should be replaced by 'makepkg' and 'echo "keyserver-options auto-key-retrieve" >> ~/.gnupg/gpg.conf' -*** which should make this obsolete: 'schroot --directory /tmp -c source:jenkins-reproducible-archlinux -- grep ^validpgpkeys= $PKG/PKGBUILD|cut -d "'" -f2|xargs schroot --directory /tmp -c source:jenkins-reproducible-archlinux -- gpg --recv-keys' +** 'echo "keyserver-options auto-key-retrieve" >> ~/.gnupg/gpg.conf' is now being used and should make this not needed: +*** 'schroot --directory /tmp -c source:jenkins-reproducible-archlinux -- grep ^validpgpkeys= $PKG/PKGBUILD|cut -d "'" -f2|xargs schroot --directory /tmp -c source:jenkins-reproducible-archlinux -- gpg --recv-keys' ** on SIGTERM, also ssh to remote host and cleanup there! (via ssh &) * put results in a db ** graph results -- cgit v1.2.3-70-g09d2