Previous: Using Automake and Swbis, Up: Top

8 Using CVS and Swbis

This section describes how to use swbis to place GPG signatures into a source code management repository such as CVS. The application of swbis simply involves adding the ./catalog/ directory and its contents to the repository and is not specific to any particular SCM. The files in the ./catalog/ directory are either directories or ascii text regular files.

The first step is to perfectly sync-up with the repository. Empty directories should be removed and created on the fly by the Makefiles. Stray junk files in the working directory and repository need to be deleted from both. Failure to do this will result in failed verification although the partial success can still be useful. (Also the RCS style file Id's used by CVS may interfere the verification of the file digests.)

Step two is to initialize, add, and commit the ./catalog/ directory in the top level module. Just make the regular files empty for now. The order does not matter. The files are:


Next, checkout the ./catalog/ directory. Treat it just like any other directory except you will be using the swign command to generate its contents. Then at any point of your choosing sign your working directory by running swign and then commit all of your changes to the repository including the ./catalog/ directory.

Here's how to sign:

     make distclean;
     SWPACKAGEPASSFD=agent; GNUPGNAME="Your Name"  swign --name-version=module_name-1.2.3 -s --no-remove @.

This swign invocation will only alter files in ./catalog/.

Note that the --no-remove option is required as this prevents the SCM control files from being deleted. Also, the --name-version option is required.

The file has several specializatons. The %__tag and %__revision macros must be used and the exclude directive must exclude the SCM's working directory control files. The file must also specify a checkdigest script as this is required to verify the directory form of a package. The file from swbis version 0.496 is a working example of this script.

Next, you should tag this point so it can retrieved in the future. Now, export (to exclude the SCM's control files) the module to a new directory and run swverify with the --scm option (The swverify version must be at least 0.496).

     cvs export -r your_tag_name module_name
     cd module_name
     swverify -d --scm @.

That's it.