Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

first attempt at explaining binary policies #36

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

becker33
Copy link
Member

@becker33 becker33 commented Jun 4, 2021

This is the first draft of a page that Spack will link to when prompting users for which binaries to trust.

Copy link
Member

@tgamblin tgamblin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@becker33: these look pretty good -- can you make one more pass over this and let's re-review after that?


Spack has the ability to create, download, install, and bootstrap
dependencies from binary packages. Spack signs binary packages with
gpg, and the ``spack gpg trust`` or ``spack buildcache keys -it``
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GPG should be all caps and defined on first use on the page, e.g. "GNU Privacy Guard (GPG)"

author_profile: false
---

Spack has the ability to create, download, install, and bootstrap
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does bootstrap mean here? I think we should leave that word out until it's defined in paragraph 2

verification capabilities. In those cases, Spack will bootstrap from a
very limited selection of binaries with sha256 checksums associated in
Spack. These bootstrapping binaries will also be associated with a
binary installation policy.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"binary installation policy" isn't defined yet -- we should probably lead with some motivation and that definition. Why is trusting binaries special (vs sources), what are Spack's policies -- basically the idea that a signature or a set of binaries are created using some process, and we want users to understand the process and trust it (or not)

decisions, here we describe each of the policies available in Spack
and what it means.

## Binary Trust Policies
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

top level is #, then ##, then ###, etc.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants