1 |
W dniu czw, 18.01.2018 o godzinie 09∶27 -0800, użytkownik Zac Medico |
2 |
napisał: |
3 |
> On 01/16/2018 08:43 AM, Michał Górny wrote: |
4 |
> > Include a repo.postsync.d hook to verify the rsync checkout using |
5 |
> > gemato. Given that not all people will want to have it enabled |
6 |
> > unconditionally, no setup.py rules are included -- instead, the file |
7 |
> > would be installed conditionally by the ebuild. |
8 |
> > |
9 |
> > [v2: included link to the wiki page] |
10 |
> > --- |
11 |
> > MANIFEST.in | 2 +- |
12 |
> > misc/repo.postsync.d/00gemato | 18 ++++++++++++++++++ |
13 |
> > 2 files changed, 19 insertions(+), 1 deletion(-) |
14 |
> > create mode 100644 misc/repo.postsync.d/00gemato |
15 |
> > |
16 |
> > diff --git a/MANIFEST.in b/MANIFEST.in |
17 |
> > index 4f6cac162..edc6704e7 100644 |
18 |
> > --- a/MANIFEST.in |
19 |
> > +++ b/MANIFEST.in |
20 |
> > @@ -14,4 +14,4 @@ include cnf/make.conf.example.* |
21 |
> > include .portage_not_installed |
22 |
> > |
23 |
> > # extra scripts |
24 |
> > -include misc/* |
25 |
> > +graft misc |
26 |
> > diff --git a/misc/repo.postsync.d/00gemato b/misc/repo.postsync.d/00gemato |
27 |
> > new file mode 100644 |
28 |
> > index 000000000..f2af50925 |
29 |
> > --- /dev/null |
30 |
> > +++ b/misc/repo.postsync.d/00gemato |
31 |
> > @@ -0,0 +1,18 @@ |
32 |
> > +#!/bin/bash |
33 |
> > +# repo.postsync.d hook to verify ::gentoo checkout using gemato |
34 |
> > + |
35 |
> > +name=${1} |
36 |
> > +url=${2} |
37 |
> > +path=${3} |
38 |
> > + |
39 |
> > +# keyring installed by gentoo-keys |
40 |
> > +openpgp_key=/var/lib/gentoo/gkeys/keyrings/gentoo/release/pubring.gpg |
41 |
> > + |
42 |
> > +# apply only to ::gentoo, when synced over rsync. |
43 |
> > +if [[ ${name} == gentoo && ${url} == rsync://* ]]; then |
44 |
> > + if ! gemato verify -K "${openpgp_key}" -s "${path}"; then |
45 |
> > + eerror "For troubleshooting the verification failures, please see:" |
46 |
> > + eerror " https://wiki.gentoo.org/wiki/Project:Portage/Repository_Verification" |
47 |
> > + return 1 |
48 |
> > + fi |
49 |
> > +fi |
50 |
> > |
51 |
> |
52 |
> The fact that this hook doesn't check online for revoked keys means it's |
53 |
> vulnerable to a MITM attack if our keys ever get stolen and revealed to |
54 |
> the world. That means it gives a false sense of security, and if we |
55 |
> release it then we're guaranteed to have an immediate GLSA because of it. |
56 |
|
57 |
I'm currently working on a solution to this problem. I've tried to |
58 |
establish if we have some 'official' solution to it but it doesn't seem |
59 |
like it, so I suppose checking keyservers is the way to go forward. |
60 |
|
61 |
-- |
62 |
Best regards, |
63 |
Michał Górny |