[gentoo-commits] gentoo commit in users/robbat2/tree-signing-gleps: 01-distribution-process-security

[Robin H. Johnson (robbat2)]

robbat2     08/07/01 07:01:41

  Modified:             01-distribution-process-security
  Log:
  Fix headings to REST format. Update the creation procedure as suggested by genone.

Revision  Changes    Path
1.8                  users/robbat2/tree-signing-gleps/01-distribution-process-security

file : http://sources.gentoo.org/viewcvs.py/gentoo/users/robbat2/tree-signing-gleps/01-distribution-process-security?rev=1.8&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo/users/robbat2/tree-signing-gleps/01-distribution-process-security?rev=1.8&content-type=text/plain
diff : http://sources.gentoo.org/viewcvs.py/gentoo/users/robbat2/tree-signing-gleps/01-distribution-process-security?r1=1.7&r2=1.8

Index: 01-distribution-process-security
===================================================================
RCS file: /var/cvsroot/gentoo/users/robbat2/tree-signing-gleps/01-distribution-process-security,v
retrieving revision 1.7
retrieving revision 1.8
diff -p -w -b -B -u -u -r1.7 -r1.8
--- 01-distribution-process-security	28 Nov 2007 04:36:48 -0000	1.7
+++ 01-distribution-process-security	1 Jul 2008 07:01:40 -0000	1.8
@@ -1,16 +1,17 @@
 GLEP: xx+1
 Title: Security of distribution of Gentoo software - Infrastructure to User distribution - MetaManifest
-Version: $Revision: 1.7 $
-Last-Modified: $Date: 2007/11/28 04:36:48 $
+Version: $Revision: 1.8 $
+Last-Modified: $Date: 2008/07/01 07:01:40 $
 Author: Robin Hugh Johnson <robbat2@g.o>, 
 Status: Draft
 Type: Standards Track
 Content-Type: text/plain
 Requires: GLEP44, GLEPxx+5
 Created: October 2006
-Updated: November 2007
+Updated: November 2007, June 2008
 Post-History: ...
 
+========
 Abstract
 ========
 MetaManifest provides a means of verifiable distribution from Gentoo
@@ -19,6 +20,7 @@ untrusted networks and system, by extend
 and adding a top-level Manifest file, with support for other nested
 Manifests.
 
+==========
 Motivation
 ==========
 As part of a comprehensive security plan, we need a way to prove that
@@ -48,6 +50,7 @@ guarantee: A user can prove that the tre
 has not been tampered with since leaving the Gentoo infrastructure.
 No other guarantees, either implicit or explicit are made.
 
+=============
 Specification
 =============
 For lack of a better name, the following solution should be known as the
@@ -64,6 +67,7 @@ are protected.
 In the following, the MetaManifest file is a file named 'Manifest',
 located at the root of a repository.
 
+---------------------------------------------
 Procedure for creating the MetaManifest file:
 ---------------------------------------------
 1. Start at the root of the Gentoo Portage tree (gentoo-x86, although
@@ -77,22 +81,21 @@ Procedure for creating the MetaManifest 
 3. Traverse the tree, depth-first.
 3.1. At the top level only, ignore the distfiles and packages
      directories.
-3.2. Place every file (including the Manifest itself) in the directory
-     in the ALL set.
-3.3. If a directory contains a Manifest file, extract all AUX, MISC, and
-     EBUILD items from it, and place them into the COVERED set.
-
-4. Produce a new set, UNCOVERED, as the set-difference between ALL and
-   COVERED. This is every item that is not covered by another Manifest.
+3.2. If the directory contains a Manifest file add it to the ALL set and
+     don't descend any further, otherwise add all files to the ALL set
+3.3. If a directory contains a Manifest file, extract all relevant local
+     files from it (presently: AUX, MISC, EBUILD; but should follow the
+     evolution of Manifest2 entry types per [GLEPxx+5]), and place them
+     into the COVERED set.
+4. Produce a new set, UNCOVERED, as the set-difference (ALL)-(COVERED).
+   This is every item that is not covered by another Manifest.
 5. If an existing MetaManifest file is present, remove it.
-6. For each file in UNCOVERED, assign a Manifest2 type per [GLEPxx+5].
-7. For each file in UNCOVERED, produce the hashes, and add with the
-   filetype to the MetaManifest file.
-
-8. The MetaManifest must ultimately be GnuPG-signed.
-8.1. For the initial implementation, the same key as used for snapshot
+6. For each file in UNCOVERED, assign a Manifest2 type, produce the
+   hashes, and add with the filetype to the MetaManifest file.
+7. The MetaManifest must ultimately be GnuPG-signed.
+7.1. For the initial implementation, the same key as used for snapshot
      tarball signing is sufficient.
-8.2. For the future, the key used for fully automated signing by infra
+7.2. For the future, the key used for fully automated signing by infra
      should not be on the same keyring as developer keys. See [GLEPxx+3
      for further notes].
 
@@ -112,13 +115,16 @@ distribution via rsync, which includes g
 Manifest files are not checked at this point, as they are assumed to be
 correct.
 
+--------------------------------------------------------
 Verification of one or more items from the MetaManifest:
+--------------------------------------------------------
 There are two times that this may happen: firstly, immediately after the
 rsync has completed - this has the advantage that the kernel file cache
 is hot, and checking the entire tree can be accomplished quickly.
-Secondly, the MetaManifest may be checked during installation of a
+Secondly, the MetaManifest should be checked during installation of a
 package.
 
+----------------------------------------------------
 Procedure for verifying an item in the MetaManifest:
 ----------------------------------------------------
 In the following, I've used term 'M2-verify' to note following the hash
@@ -158,12 +164,14 @@ filetypes may be ignored on missing is d
      and profiles as needed.
 
 Notes:
+======
 1. Tracking of exact files is of specific significance to the libtool
 eclass, as it stores patches under eclass/ELT-patches, and as such that
 would not be picked up by any tracing of the inherit function. This may
 be alleviated by a later eclass and ebuild variable that explicitly
 declares what files from the tree are used by a package.
 
+====================
 Implementation Notes
 ====================
 For this portion of the tree-signing work, no actions are required of
@@ -172,6 +180,7 @@ commit as they do presently, and the Met
 Infrastructure during the tree generation process, and distributed to
 users.
 
+=======================
 Backwards Compatibility
 =======================
 There are no backwards compatibility issues, as old versions of Portage
@@ -179,6 +188,7 @@ do not look for a Manifest file at the t
 Manifest2-aware versions of Portage ignore entries that they are not
 certain how to handle.
 
+======
 Thanks
 ======
 I'd like to thank the following people for input on this GLEP.
@@ -190,6 +200,7 @@ I'd like to thank the following people f
 TODO:
 - Ned Ludd (solar) - Security concept review
 
+=========
 Copyright
 =========
 Copyright (c) 2006 by Robin Hugh Johnson. This material may be



-- 
gentoo-commits@l.g.o mailing list