-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-05-28 02:10, Nelson Marques wrote:
For the speed, I told you several times already that the data and metadata come for different servers in different countries. Two different sources.
Hmmz... this is interesting... imagine you have metadata refreshened, but the local mirrors haven't updated yet... what prevents zypper from having erratic behavior. If you know any docs about it share it with me... It's actually an interesting to look at to know how this is handled.
I don't have documentation or links about this, but believe me it is true. What I know is simply from reading what devs have posted about this on several occasions. Part of the metadata (the parts vary depending on the openSUSE versions; in recent versions it is less) is always downloaded directly from the openSUSE server, and is cryptographically signed. If a mirror does not contain the rpm wanted, it can not be downloaded, it will fail; I do not know if the redirector keeps track of what packages contain each mirror and redirect to the appropriate one. I think it does. If a mirror contains a manipulated rpm, as the metadata is downloaded directly from openSUSE the manipulation should be detected. However, if your repo list points to the mirrors directly, this is broken. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk/CxqcACgkQIvFNjefEBxqFJwCg0MsHvhoEe9QtJVJUMLpf5R4S Y5sAn0fGjr6qYnfOXT9rXqCOv4ZgRHHu =2Eny -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org