Roadmap

[the-maldridge]

13:02 ericonr: I don't see the point of merging things if we don't know how we are going forward

So lets have a roadmap. This is a simple problem to solve, lets set what we want XBPS to be able to do a year from now and then go from there.

I for one would like to have signing of the repo metadata as we've discussed for several years now. I think we'd agreed that signify would be the most appropriate mechanism for this, and we'd start out not rotating keys, but ideally maintain the capability for future use.

[ericonr]

The new signature scheme can also be synced with #323 , if we move to BearSSL. BearSSL doesn't support reading a raw public key from PEM, so our current key verification scheme needs some glue between bearssl code and XBPS itself.