Re: [gentoo-dev] Idea about signing ebuilds

[Jeremiah Mahler]

On Thu, Jun 06, 2002 at 08:56:30PM +0200, Alexander Holler wrote:
> Hello,
>
> what do you think about signing the ebuilds and digests with gpg?
>
> That would make it harder for blackhats to introduce a worm or something
> similiar (if they have got access to an rsync mirror).
>
> My idea is to automatically sign the released ebuilds (before mirroring
> them) with a key of gentoo.org.
>
> Then emerge could check the sign and could discard wrong ebuilds or just
> throws a warning (preferable customized with make.conf).
>
> Just my 2 cents. ;)
>
>
> Alexander
>
> _______________________________________________
> gentoo-dev mailing list
> gentoo-dev@g.o
> http://lists.gentoo.org/mailman/listinfo/gentoo-dev

The goal is to have packages that are of high quality.

One solution is to only allow one or a small number of trusted people to
change the packages.  Development is slow and it is safe from trouble
makers. Debian uses this solution.

Another solution is to let anyone submit and change packages.
Development is fast but it is not safe from trouble makers.

My solution is to allow anyone to submit changes but also have a rating
system in place to gauge the trust people should place on a package.
Development is fast and is safe from trouble makers.

Of course my solution is not clear cut. There are many possible ways to
measure the trust people should place on a package. If it is brand new
it should not be trusted. If it has been used by many people and they
think it is trustworthy than it can be trusted. If the changes were made
by a trusted developer than it can be trusted. etc...

I have used Debian for a long time and I would hate to see Gentoo become
plagued with the same problems they have.

-- 
Jeremiah Mahler
<jmahler@×××××××.net>