[gentoo-security] Re: Gentoo Portage Attack Tree

[Peter Simons]

Ervin Németh writes:

 > How about this: the developers have to sign the files
 > they upload, but do this before they upload them?

I believe that it is practically unfeasible to verify the
signatures of dozens of people which are spread over dozens
of different directories. By building the signatures into
Portage only, you require the user to have a working Gentoo
system before he can verify he has a _real_ Gentoo system.
When Portage runs the checks, it is too late. You have to be
able to verify the authenticity of your downloaded files
before you start the first executable you've downloaded.
That's why I am in favor of a simple, ordinary text file
which is GPG-signed and contains ordinary hashes.

Peter


--
gentoo-security@g.o mailing list