Re: [gentoo-soc] About improved binary package support

> > > Here you have a central server and stuff. Before somebody told me he
> > > wants to create the following: A p2p network where all the data is
> > > stored in the network (on different peers) and not on a central
> > > server. There you get a really distributed system with lots and
> > > lots of things to think about and lots and lots of problems to
> > > address.
> >
> > You are completely misunderstanding and incorrectly stating what I
> > said by the way.
> > I clearly stated in my thread that there would be a central server
> > controlling the network, this server would obviously be used for
> > things like hashes as well.
> > To have the entire thing completely distributed with no central
> > control would be absolutely stupid.
> >
> > If you want people to look at what "somebody" told you please point
> > them to the original thread on the mailing list to interpret it for
> > themselves instead of telling them stuff which is not true, thanks.
>
> Sorry, I meant to sum the differences up and had forgotten that fact.
> You said "There obviously might be security concerns for users of such
> a system, this can be mitigated by using a central controlling server
> and by taking Hash signatures of compiled packages from users other
> then the original contributer." which mentions a central server.
>
> But what exactly would it do? Store hashes? Calculate hashes? Store
> metadata? Where does it get that from?
The central server would store various information on packages residing in the 
system as well as authentication details for users.
For packages it would store:
* A trust level for the package.[1]
* A hash of the package tarball to be used after a download to ensure the file 
has been downloaded correctly - used by all downloaders.
* A hash of the internals of the package tarball to be used when verifying 
that somebodies provided package is not a tampered with one that has a rootkit 
in for example. - provided by anyone who generates a package.
* Records of who provided the package and who has verified its integrity with 
the above hash.
* A torrent file for the package.(Not necessarily torrents just an example, 
the server would act as the tracker for all torrents as well or potentially a 
seperate server)
* Other inconsequential but useful stuff like number of download requests per 
package etc..

[1] The trust level could be as fine grained as one liked, it could start out 
with just a few different levels and as the system grows be made more fine 
grained if necessary.
An example of how the levels might look(in decreasing order of trust) but this 
is by no means concrete yet:
1/ Package compiled by central Gentoo build server.
2/ Package compiled by more then one trusted user.(Gentoo developer)
3/ Package compiled by trusted user.
4/ Package compiled by X quantity of semi-trusted users.(Contributers who have 
been deemed trustworthy enough to be marked as such)
5/ Package compiled by semi-trusted user.
6/ Package compiled by X quantity of untrusted users.

The system would always seek to upgrade the trust of a package where possible 
so if a package is currently on level 4 trust and then a Gentoo developer 
compiles it the trust for that package would then rise to level 2. Unless of 
course the internal hash did not match in which case other action would then 
be taken...
The compile server(s) would work tirelessly attempting to upgrade as many 
packages as possible to level 1 trust, starting with the more popular ones 
first. In doing so they would also be keeping a check up on the users who 
compiled it before them as it can compare internal hashes and take action when 
clashes are found.

The central server would also be in charge of various other things like 
choosing users to host copies of packages when new packages become available.

When a user wants to emerge something, emerge would query the package server 
and ask if a package to suit its needs(including security level) is available, 
if one is then the server would reply with a .torrent file to download. The 
client would then download the package over the torrent and then emerge would 
emerge it as a package.
If no suitable package is available emerge will instead just act as normal and 
compile the package itself, and then potentially make the result available to 
the server so that others can benefit from it.

The acceptable trust level is something the user would decide on, so people 
who are extremely paranoid(whether it be with a good reason or not) and don't 
trust even the Gentoo devs can accept only level 1 packages, while others can 
accept level 5/6 packages if they want.
> So if I understand it right, for building packages you use some
> client-server system and for distributing them you have a central
> server to get information from and download packages using the p2p
> network?
That sounds about right yes.