Re: [gentoo-security] Re: No, apparently not.

[Thierry Carrez]

Tobias Klausmann wrote:

>>cat /usr/portage/sys-apps/portage/Manifest
>
> This does not contain a GPG signature here. Of all packages...

My /usr/portage/sys-apps/portage/Manifest does.

> I've run a script across the entire tree, collecting 43 different
> signature keys IDs from Manifest files in all (from a total of
> 2074 signed Manifest files, making up about 1/4). Of those keys,
> 16 were unavailable on the Subkeys Public Key Network (listed
> below). Where can I get those?
> [...]

I think you get the problem. There have been threads like this one in
the past (on gentoo-dev mostly), all discussing how easy signing is and
why isn't it already implemented. Signing is not hard. Trusting the
signature is. Having "eclasses signed" is necessary at some point. But
if you can't already trust the signatures that are today in portage,
it's not top priority.

We are aware of the problem. We're slowly getting Gentoo package
maintainers to sign their ebuilds. Next we'll have to establish the
chain of trust right, from a master key published on trusted media, to
published keys, to verification when using any file downloaded. Next
we'll plug the remaining holes. All of this takes time, in part because
portage modifications have to go slowly so that we don't just break
things for our existing users.

For the moment you still have to trust Gentoo rsync mirror
infrastructure security. In the future we will get that weak link
handled. And then we'll hurry to fix the new weakest link.

Note that getting the key from a public key server won't authenticate
anything. It will merely do the identification part. Anyone can submit a
key with a gentoo.org address to a public key server.

-- 
Thierry Carrez
Operational Manager, Gentoo Linux Security