Uploading new packages, and the editor's manual

Archaic archaic at linuxfromscratch.org
Fri Mar 31 10:35:48 PST 2006

IMO, direct links should point to the official upstream package and
should refer to the size of the official upstream package regardless of

The other option of using RR-DNS could be made feasible if several hoops
are jumped through, namely:

1) Create {us,eu,au,as}.ftp.lfs.org domains so that at least someone can
   download from their own continent.

2) Remove the packages and patches pages and replace them with links to
   a book-versioned directory on each of the above RR-DNS sites. ex:

3) Tell a person to grab them all or to grab the individual tarball
   containing all the individual packages/patches.

4) Put in a note that the mirrors may not update for 24 hours in which
   case they are simply out of luck and have the extra hassle of going
   through individual mirrors looking for one that is up to date, or
   going to the official download location which will require google
   because the book no longer points to the official location.

Obviously #4 makes me think we should instead just point directly to the
official upstream tarball and let a person decide for themselves whether
they want to bzip all the gzipped stuff (I don't on my slower systems as
bzip2 is horrendously slow in comparison). Also, no one has to trust
that the upstream MD5 was properly verified before bzipping them and
thus making the official MD5 useless. The same holds for signed
tarballs. We don't currently sign anything and it still requires an
extra layer of required trust to assume we properly checked the
signatures of tarballs before re-packaging them and signing them with a
non-upstream signature. More hassle than it is worth, IMO, but that's
just my 2 cents.


Want control, education, and security from your operating system?
Hardened Linux From Scratch

More information about the lfs-book mailing list