on security and patch formats

[Tom Lord]

   > If you are really worried about it, we can make some modest changes to
   > an FTP server.  In particular, as I mentioned, `arch' never needs to
   > _modify_ files in the repository, only to add, rename and delete
   > them.  It never needs to delete precious files -- only lock files and
   > cache files.   One can imagine adding a feature to an FTP server that
   > implicitly manipulates the permissions on files and directories to
   > help ensure that precious files, once created, can not be modified or
   > deleted by the server under any circumstances.

   Have you thought this out?

Yes.

   rename implies a soft delete ability : you can't destroy information,
   but you can make file existence checks fail on arbitrary files.

   even worse, rename + add implies modify.

Consider the repository as a static archive of files with well-known
names.  Once a file reaches its "final" location, it never needs to be
renamed or deleted after that.  It can even be transfered to
write-once storage.

The ascension process -- the process of adding a new file: that
requires renames and deletes to implement locking and atomic
operation.   Thus, once ascension is complete, permissions can be
locked down.   Between native filesystem permissions and a filter on
the system calls issued by the FTP server, precious files can be quite
well protected.

Servers also benefit from "cache files" that summarize information
found in precious files.  These do, indeed, complicate the security
concerns -- but not, I think, very much.

If you like, we can get into details of the repository format and
protocols off-list.

-t