Partial wishlist for mirrors

[Andrew Lewman <andrew@xxxxxxxxxxxxxx>]

These are just some thoughts.  I'm sure other projects have solved the
mirror problem as well, perhaps we could see what they've done.  I'd
also like to put mirrors into better rotation, rather than have the
buried 4 links deep into the site, and no one ever uses them.  These are
also known as fun, minor coding challenges:

1) we only look for the trace file off the website mirror
(project/trace/www.torproject.org), not /dist.  Some better way to
randomly check files on torproject.org and mirrors for how different
they are would be great.

2) we don't check any of the binaries in any automated fashion.  Some
way to even check sha1 hashes of the current packages would be great.

3) what to do when a mirror has been offline for 30, 60, 90 days?  do we
simply remove it from the list, contact the owner, both?

4) what to do when sha1 hashes of the binaries don't match?  take it out
of rotation and contact the owner?

5) automated status update of the mirrors on website publish would be
great.  We'll need some "fuzziness" in determining how up to date a
mirror is at the time of publishing.  I suspect older than 36h can be
considered out of date.



-- 
Andrew Lewman
The Tor Project
pgp 0x31B0974B

Website: https://torproject.org/
Blog: https://blog.torproject.org/
Identica/Twitter: torproject