[gentoo-commits] gentoo commit in users/robbat2/tree-signing-gleps: 01-distribution-process-security

[Robin H. Johnson (robbat2)]

robbat2     07/11/28 04:30:03

  Modified:             01-distribution-process-security
  Log:
  Improve wording and rewrite the verification section.

Revision  Changes    Path
1.6                  users/robbat2/tree-signing-gleps/01-distribution-process-security

file : http://sources.gentoo.org/viewcvs.py/gentoo/users/robbat2/tree-signing-gleps/01-distribution-process-security?rev=1.6&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo/users/robbat2/tree-signing-gleps/01-distribution-process-security?rev=1.6&content-type=text/plain
diff : http://sources.gentoo.org/viewcvs.py/gentoo/users/robbat2/tree-signing-gleps/01-distribution-process-security?r1=1.5&r2=1.6

Index: 01-distribution-process-security
===================================================================
RCS file: /var/cvsroot/gentoo/users/robbat2/tree-signing-gleps/01-distribution-process-security,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- 01-distribution-process-security	28 Nov 2007 00:27:53 -0000	1.5
+++ 01-distribution-process-security	28 Nov 2007 04:30:03 -0000	1.6
@@ -1,7 +1,7 @@
 GLEP: xx+1
 Title: Security of distribution of Gentoo software - Infrastructure to User distribution - MetaManifest
-Version: $Revision: 1.5 $
-Last-Modified: $Date: 2007/11/28 00:27:53 $
+Version: $Revision: 1.6 $
+Last-Modified: $Date: 2007/11/28 04:30:03 $
 Author: Robin Hugh Johnson <robbat2@g.o>, 
 Status: Draft
 Type: Standards Track
@@ -67,26 +67,30 @@
 ---------------------------------------------
 1. Start at the root of the Gentoo Portage tree (gentoo-x86, although
    this procedure applies to overlays as well).
-2. Initialize two empty lists: COVERED, ALL.
-2.1 'ALL' will contain every file in the tree.
-2.2 'COVERED' will contain every file that is mentioned in an existing
-    Manifest2.
+
+2. Initialize two unordered sets: COVERED, ALL.
+2.1. 'ALL' will contain every file in the tree.
+2.2. 'COVERED' will contain every file that is mentioned in an existing
+     Manifest2.
+
 3. Traverse the tree, depth-first.
 3.1. At the top level only, ignore the distfiles and packages
      directories.
-3.2  Place every file (including the Manifest itself) in the directory
-     in the ALL list.
+3.2. Place every file (including the Manifest itself) in the directory
+     in the ALL set.
 3.3. If a directory contains a Manifest file, extract all AUX, MISC, and
-     EBUILD items from it, and place them into the COVERED list.
-4. Produce a new list, UNCOVERED, as the set difference between ALL and
+     EBUILD items from it, and place them into the COVERED set.
+
+4. Produce a new set, UNCOVERED, as the set-difference between ALL and
    COVERED. This is every item that is not covered by another Manifest.
 5. If an existing MetaManifest file is present, remove it.
-6. For each file in the list, assign a Manifest2 type per [GLEPxx+5].
-7. For each file in the list, produce the hashes, and add with the
+6. For each file in UNCOVERED, assign a Manifest2 type per [GLEPxx+5].
+7. For each file in UNCOVERED, produce the hashes, and add with the
    filetype to the MetaManifest file.
+
 8. The MetaManifest must ultimately be GnuPG-signed.
-8.1. For the initial implementation, the same key as used for tarball
-     signing is sufficient.
+8.1. For the initial implementation, the same key as used for snapshot
+     tarball signing is sufficient.
 8.2. For the future, the key used for fully automated signing by infra
      should not be on the same keyring as developer keys. See [GLEPxx+3
      for further notes].
@@ -114,38 +118,50 @@
 Secondly, the MetaManifest may be checked during installation of a
 package.
 
-In the following, I've used term 'M2-verify' to note following the
-hash verification procedures as defined by the Manifest2 format - which
-compromise checking the file length, and that the hashes match.
-
-TODO(from ciaranm): Deal with excludes properly - a missing package.mask
-should be treated as an error.
-
 Procedure for verifying an item in the MetaManifest:
 ----------------------------------------------------
-NEEDS REWRITE
-XX 1. Check the GnuPG signature on the MetaManifest against the keyring of
-XX    automated Gentoo keys. See [GLEPxx+3] for full details regarding
-XX    verification of GnuPG signatures. 
-XX 1.1. Do not continue if the signature check fails.
-XX 2. For a verification of the tree following an rsync:
-XX 2.1. M2-verify every entry in the MetaManifest
-XX 2.2. (optional if Manifests will be checked before use) M2-verify each
-XX      normal Manifest file listed in the MetaManifest.
-XX 3. If checking at the installation of a package:
-XX 3.1. M2-verify the entry in MetaManifest for the Manifest
-XX 3.2. M2-verifying the contents of the Manifest. 
-XX 3.3. Perform M2-verification of all eclasses used (both directly and
-XX      indirectly) by the ebuild. 
-XX 3.4. For initial implementations, it is acceptable to check EVERY item
-XX      in the eclass directory, rather than tracking the exact files used
-XX      by every eclass (see note #1). Later implementations should strive
-XX      to only verify individual eclasses as needed.
-XX 
-XX Notes:
-XX 1. Tracking of exact files is of specific significance to the libtool
-XX eclass, as it stores patches under eclass/ELT-patches, and as such that
-XX would not be picked up by any tracing of the inherit function.
+In the following, I've used term 'M2-verify' to note following the hash
+verification procedures as defined by the Manifest2 format - which
+compromise checking the file length, and that the hashes match. Which
+filetypes may be ignored on missing is discussed in [GLEPxx+5].
+
+1. Check the GnuPG signature on the MetaManifest against the keyring of
+   automated Gentoo keys. See [GLEPxx+3] for full details regarding
+   verification of GnuPG signatures. 
+1.1. Do not continue if the signature check fails.
+
+2. For a verification of the tree following an rsync:
+2.1. Build a set 'ALL' of every file covered by the rsync. (exclude
+     $DISTDIR, $PKGDIR, local/)
+2.2. M2-verify every entry in the MetaManifest, descending into inferior
+     Manifests as needed. Place the relative path of every checked item
+     into a set 'COVERED'.
+2.3. Construct the set 'UNCOVERED' by set-difference between the ALL and
+     COVERED sets.
+2.4. For each file in the UNCOVERED set, assign a Manifest2 filetype.
+2.5. If the filetype for any file in the UNCOVERED set requires a halt
+     on error, do so.
+2.6. Completed verification
+
+3. If checking at the installation of a package:
+3.1. M2-verify the entry in MetaManifest for the Manifest
+3.2. M2-verify all relevant metadata/ contents if metadata/ is being
+     used (optionally done before dependancy checking).
+3.3. M2-verifying the contents of the Manifest. 
+3.4. Perform M2-verification of all eclasses and profiles used (both
+     directly and indirectly) by the ebuild.
+3.5. For initial implementations, it is acceptable to check EVERY item
+     in the eclass and profiles directory, rather than tracking the
+     exact files used by every eclass (see note #1). Later
+     implementations should strive to only verify individual eclasses
+     and profiles as needed.
+
+Notes:
+1. Tracking of exact files is of specific significance to the libtool
+eclass, as it stores patches under eclass/ELT-patches, and as such that
+would not be picked up by any tracing of the inherit function. This may
+be alleviated by a later eclass and ebuild variable that explicitly
+declares what files from the tree are used by a package.
 
 Implementation Notes
 ====================



-- 
gentoo-commits@g.o mailing list