[Dwai-developers] Full DFX + modified XSD

[Lucio C. <lu...@su...>]

I've tried to write a full DFX that uses all the available options, While 
doing so I had to modify the schema to accomodate a more flexible repository 
line for the sources.list file (because a repository is not just a URI, but 
it has "deb" or "deb-src" in front of it, then a distribution and maybe other 
components).

The final DFX is quite a long file, but it says a lot of things that would 
have been hard to say without XML. In natural language, it says that the debs 
for killer-app version 2.7.45 are available at 
http://debmirror.killerapp.org/debian or 
http://it.debmirror.killerapp.org/debian in the distro folder named "sarge" 
in the "main" and "contrib" sections. It also says that killer-app 2.7.45 
needs a /etc/apt/preferences tuning to be installed; then it says that the 
debs have been tested on Sarge, Knoppix 3.4 and Agnula 1.2.1. Finally it says 
that the debs are likey to work on any other debian based system that can 
provide libc6 version 2.2 or later (or glibc version 2.2 or later) and cpp 
version 3.3 or older.

There still one problem that we can safely ignore for the time being, but it 
sooner or later it will come up: the tested distribution list has no standard 
way to name a distribution, so for example one dewmaster could in principle 
name a distribution "Debian 3.1", another name it "Sarge" and another name 
it "Debian GNU/Linux 3.1r1 Sarge i386". Maybe we can ignore the problem 
forever, because the decision that the DWAI client has to take about 
installing the package or not can be made looking only at the dependecies and 
happily ignoring whatever distro the package has been tested on. In such 
case, the client could use the tested distro list only to show it to the user 
and let the user decide about what to do.

Final note: seems to me that secutiry is not to take into account as long as 
the XSD is concerned, because digital signatures & Co. are already 
implemented at https protocol level (useful to guarantee DFX is authentic) 
and at repository level. Do you agree? 

Lucio.