Gentoo Archives: gentoo-dev

From: hasufell <hasufell@g.o>
To: gentoo-dev@l.g.o
Cc: Rich Freeman <rich0@g.o>
Subject: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore)
Date: Mon, 10 Aug 2015 20:13:37
Message-Id: 55C905E3.3080005@gentoo.org
In Reply to: Re: [gentoo-dev] .gitignore by Rich Freeman
1 On 08/10/2015 05:09 PM, Rich Freeman wrote:
2 > On Mon, Aug 10, 2015 at 11:04 AM, Mike Gilbert <floppym@g.o> wrote:
3 >>
4 >> Expanding on this: the rsync master creates the following
5 >> files/directories under metatdata. On my own system, I like to symlink
6 >> them to locations outside my repo so that related portage features
7 >> continue to work.
8 >>
9 >> I would like to have these added in .gitignore.
10 >>
11 >> metadata/dtd/ # used by something?
12 >> metadata/glsa/ # used by the GLSA utilities?
13 >> matadata/herds.xml # used by equery from gentoolkit
14 >> metadata/news/ # used by eselect news
15 >>
16 >
17 > As a side note, it probably wouldn't hurt to set up a guide for
18 > running git on /usr/portage, including setting up these symlinks,
19 > running egencache after emerge --sync, etc. I imagine that this is a
20 > configuration that many developers will tend to use, and with the
21 > advent of git we may see more users who tend to contribute doing the
22 > same.
23 >
24
25 In fact, this should be the recommended way of running gentoo for
26 everyone. Our rsync methods are still inherently insecure (unless I
27 missed something), because:
28 1. machine key
29 2. profiles, eclasses and so on are not covered with a
30 signature/Manifest anyway

Replies

Subject Author
Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore) Andrew Savchenko <bircoph@g.o>