Re: Torrenting GuixSD!

[Mark H Weaver <mhw@netris.org>]

Andreas Enge <andreas@enge.fr> writes:

> On Wed, Feb 25, 2015 at 03:00:59PM +0100, Ludovic Courtès wrote:
>> Andreas Enge <andreas@enge.fr> skribis:
>> > I still think it would be nice to include the signature into the torrent.
>> It’s probably fine to point to the .sig that’s on alpha.gnu.org, no?
>
> Well, it is more a question of education than anything: By including the
> signature, downloaders are directly pointed to it. Of course, it can also
> be downloaded separately, but this is an additional step. We should make
> "the right thing" as easy as possible.

If we were to extend this argument to non-torrent downloads, then all
of our downloads (source tarballs and images) should be tar files
containing a signature bundled with the thing being signed.  mit-krb5
follows this policy with their source tarballs.  I suppose there can be
no arguments on matters of taste, but personally I don't like it.

I have some experience with torrents, and I tend to find it annoying
when downloads that would naturally be a single file are bundled into a
directory with other stuff.  For one thing, it means that I can't
organize my files as I prefer without keeping the directory name and
structure that the torrent creator chose, at least not if I want to
facilitate later seeding.

My preference would be to keep things as they are now.  IMO, it would be
better to educate people on how to download and check the detached
signature in our installation instructions.  That's a lesson that can be
used for almost every software package that is signed upstream, which
would be far more useful than educating them on some non-standard
signature distribution method that hardly anyone uses.

    Regards,
      Mark