RPM submission procedure

[Alan Cox]

On Wed, Jan 07, 2004 at 08:24:38PM -0500, Eric S. Raymond wrote:
> Whenever I do a release, I run an upload script specific to that
> project.  The upload script does a bunch of uploads, then calls
> freshmeat-submit.  freshmeat-submit does an XML-RPC transaction with
> freshmeat.net and posts a release announcement.

That side of it makes complete sense.

> You tell me the required metadata is (1) an URL to an SRPM, an MD5
> signature, and a package description.  This raises a couple of 
> questions:
> 
> (1) Why not just mine the description out of the Description field
>     of the SRPM?
> 
> (2) Don't RPMs have their own internal checksum?

Checksums and digital signatures optionally. One very good reason for
submitting an MD5sum in the request though is to make sure you didn't
screw up the URL or get a stale file cached somewhere. It could be
a completely valid genuine GPG signed wrong RPM otherwise.  Having the
extra verification just means the system knows it got the right package,
nobody slipped up and no evil web accelerator or cache got in the way
to ruin the party.

(BTW SHA please MD5 has flaws 8)

Alan