[Starlingx-discuss] Adding packages to build .lst files

[Ponce Castaneda, Guillermo A]

>On 7/23/18, 3:08 PM, "Scott Little" <scott.little at windriver.com> wrote:

    >Do we trust every link on google to point to a malware free version of 
    >the package ?
    
    >I think it's ill advised to take the human out of the loop.  At most, 
    >list the validated download url's found... along with a warning from all 
    >but a few trusted url's.

Totally agree, the script prints the URL where the package comes from on
Line 64:
64             print("Downloading file %02d: %s" % (count, p))

Regarding the trusted URLs, I did not know there was a list of them, in fact
I thought the problem was that since the package was not found on the
repositories, which are trusted, we needed to look for them on the web,
if there is a list, I will make use of it and display any warning message just
as suggested.

The workaround so far is to run a command rpm -Kv <package.rpm> on
the packages to be sure the packages are signed and throw away the ones
that are not.

As for the automation of the rpm check process, it is still work in progress,
I want to avoid using a subprocess command to do it and I want to do it
using only python modules, so far I haven't had luck when looking for a
module that does that, another reason not to use a subprocess command is
that if you run the program from a system that does not have rpm command
the script would fail anyway.
    
    >Scott    

Thank you
- Guillermo Ponce
    
    >>On 18-07-23 03:58 PM, Ponce Castaneda, Guillermo A wrote:
    >> Hello team,

    >> I am giving it another try to introduce and automatic package downloader
    >> to the mirror creation process, this time I managed to actually write it
    >> on python3.

    >> The goal of this tool is still the same, to avoid the hassle of manually go
    >> looking and downloading failing packages from Google and just run a
    >> single command instead.

    >> You can go and review the code here: https://review.openstack.org/#/c/585009/
    >> I really appreciate any feedback, specially opportunities of improvement and any
    >> kind comments.

    >> Thank You
    >>   - Guillermo Ponce

    >> On 7/18/18, 12:42 PM, "Ponce Castaneda, Guillermo A" <guillermo.a.ponce.castaneda at intel.com> wrote:
    >>

      
    >>>On 7/18/18, 11:47 AM, "Dean Troyer" <dtroyer at gmail.com> wrote:
      
              >>>On Wed, Jul 18, 2018 at 8:26 AM, Ponce Castaneda, Guillermo A
              >>><guillermo.a.ponce.castaneda at intel.com> wrote:
              >>>>     That is correct, I do not think there is another node.js code, and that is why I
              >>>>     also created a Dockerfile so nobody has to install node on their machines and
              >>>>     just run it inside a container.
          
              >>>I'm sorry but I do not consider requiring Docker and some non-trivial
              >>>OS image to run a simple script to be an improvement.  It isn't just
              >>>the installation of the runtime it is also the cognitive overhead of
              >>>requiring another bit of language expertise to maintain the tool.  If
              >>>this were a node project I'd say the same thing about introducing a
              >>>python script.

              >>Thanks for the feedback Dean,
              >>I will the improve this tool on the points you are mentioning and will try going
              >>at it again.

              >>>dt

              >>Guillermo Ponce

              >>--

              >>>Dean Troyer
              >>>dtroyer at gmail.com




    >> _______________________________________________
    >> Starlingx-discuss mailing list
    >> Starlingx-discuss at lists.starlingx.io
    >> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
    
    
    
    >_______________________________________________
    >Starlingx-discuss mailing list
    >Starlingx-discuss at lists.starlingx.io
    >http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss