Gentoo Logo
Gentoo Spaceship




Note: Due to technical difficulties, the Archives are currently not up to date. GMANE provides an alternative service for most mailing lists.
c.f. bug 424647
List Archive: gentoo-dev
Navigation:
Lists: gentoo-dev: < Prev By Thread Next > < Prev By Date Next >
Headers:
To: gentoo-dev@g.o
From: "Robin H. Johnson" <robbat2@g.o>
Subject: Re: integrity of stage files
Date: Sat, 8 Oct 2011 22:43:14 +0000
On Sat, Oct 08, 2011 at 02:45:02PM -0700, "Paweł Hajdan, Jr." wrote:
> I checked
> <http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=1&chap=5>
> and the Handbook only mentions validating MD5 checksums.
> 
> There are two possible issues:
> 
> 1. Why are we using _only_ MD5 and SHA1 as the checksums? Shouldn't we
> be using something stronger?
Fixed in Catalyst now.
http://git.overlays.gentoo.org/gitweb/?p=proj/catalyst.git;a=commit;h=42b4f6608682cf03954918ecce7923330a1656fe
So when the stagebuilders update their Catalyst, they will be generated
with newer hashes.

> 2. I noticed the checksums are signed (.asc files). With what key are
> they signed? How is that key handled, and how to ensure people use the
> right key when verifying the signature?
Documented here:
http://www.gentoo.org/proj/en/releng/

Relevant to this discussion:
The weekly builds are signed with:
key 2D182910 RSA 4096-bit, generated 2009/08/25
Gentoo Linux Release Engineering (Automated Weekly Release Key) <releng@g.o>

It's located in the pipeline that collects stages and isos for publication.

The non-weekly releases (eg 11.2) have a separate key
key 17072058, DSA 1024-bit, generated 2004/07/20
Gentoo Linux Release Engineering (Gentoo Linux Release Signing Key) <releng@g.o>

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Trustee & Infrastructure Lead
E-Mail     : robbat2@g.o
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85


Replies:
Re: integrity of stage files
-- Matt Turner
Re: integrity of stage files
-- Paweł Hajdan, Jr.
References:
integrity of stage files
-- Paweł Hajdan, Jr.
Navigation:
Lists: gentoo-dev: < Prev By Thread Next > < Prev By Date Next >
Previous by thread:
integrity of stage files
Next by thread:
Re: integrity of stage files
Previous by date:
Re: Lastrite: media-gfx/pngcrush
Next by date:
Re: GCC upgrades, FUD and gentoo documentation


Updated Jun 29, 2012

Summary: Archive of the gentoo-dev mailing list.

Donate to support our development efforts.

Copyright 2001-2013 Gentoo Foundation, Inc. Questions, Comments? Contact us.