Re: [gentoo-security] Re: No, apparently not. (was: Is anybody else worried about this?)

[Kurt Lieber]

On Mon, Nov 08, 2004 at 02:05:26AM +0100 or thereabouts, Peter Simons wrote:
> The entire contents of /usr/portage is not authenticated.
> All the manifest files, all the patches, all the ebuilds are
> obtained through a public network without _any_ form of
> authentication.

That is factually incorrect.  

Pick any Gentoo machine that has a reasonably recent portage tree and do
any of the following:

cat /usr/portage/sys-apps/portage/Manifest
cat /usr/portage/app-editors/vim/Manifest
cat /usr/portage/dev-lang/perl/Manifest

Those are but three examples.  Certainly not all files are signed, but to
say that we're completely ignorant of the problem is a grossly unfair
mischaracterization.  

> Does that make it any clearer why this problem might be
> worth being solved, like, soon?

It certainly does show that you haven't taken the time to understand what
features portage currently does and does not offer.

Again, nobody is arguing about signing ebuilds.  That functionality already
exists as of .51 and we're working on getting devs to sign their ebuilds.
Work is *already* under way to solve this problem -- you're wasting your
breath if this is all you're concerned about.  

The original message talked about eclasses and specifically, their lack of
versioning.

--kurt