1 |
On Mon, 8 Nov 2004, Peter Simons wrote: |
2 |
> Ervin Nmeth writes: |
3 |
>> How about this: the developers have to sign the files |
4 |
>> they upload, but do this before they upload them? |
5 |
> |
6 |
> I believe that it is practically unfeasible to verify the |
7 |
> signatures of dozens of people which are spread over dozens |
8 |
> of different directories. By building the signatures into |
9 |
> Portage only, you require the user to have a working Gentoo |
10 |
> system before he can verify he has a _real_ Gentoo system. |
11 |
> When Portage runs the checks, it is too late. You have to be |
12 |
> able to verify the authenticity of your downloaded files |
13 |
> before you start the first executable you've downloaded. |
14 |
> That's why I am in favor of a simple, ordinary text file |
15 |
> which is GPG-signed and contains ordinary hashes. |
16 |
|
17 |
Before you have a Gentoo system, you need to download a Gentoo CD image, |
18 |
or you need to get a Gentoo CD. The Gentoo CD images can be signed |
19 |
themselves, so you can verify it before it is extracted. |
20 |
|
21 |
After you've booted with the install image, it's too late - how do you |
22 |
trust the software on the install disk, if you haven't checked it |
23 |
already? |
24 |
|
25 |
Is there a way you can install Gentoo without using an install image? |
26 |
Well, I know one, but it basically would be 'download portage code, |
27 |
check signature, install code, run code'. I don't see the problem. The |
28 |
only way I'd see a problem here is if the user didn't have cryptographic |
29 |
checking software already, in which case it isn't a problem, because the |
30 |
user is trusting everything. (That is, there's nothing you can do to |
31 |
assure them of the Gentoo package authenticity, so there's no need to |
32 |
worry about it.) |
33 |
|
34 |
Ed |