Gentoo Archives: gentoo-dev

From: "Michał Górny" <mgorny@g.o>
To: hasufell <hasufell@g.o>
Cc: gentoo-dev@l.g.o
Subject: Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore)
Date: Tue, 11 Aug 2015 16:42:39
Message-Id: 20150811184221.2f6a9db1@pomiot
In Reply to: Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore) by hasufell
1 Dnia 2015-08-10, o godz. 22:51:59
2 hasufell <hasufell@g.o> napisał(a):
3
4 > On 08/10/2015 10:47 PM, Andrew Savchenko wrote:
5 > > On Mon, 10 Aug 2015 22:13:23 +0200 hasufell wrote:
6 > >> On 08/10/2015 05:09 PM, Rich Freeman wrote:
7 > >>> On Mon, Aug 10, 2015 at 11:04 AM, Mike Gilbert <floppym@g.o> wrote:
8 > >>>>
9 > >>>> Expanding on this: the rsync master creates the following
10 > >>>> files/directories under metatdata. On my own system, I like to symlink
11 > >>>> them to locations outside my repo so that related portage features
12 > >>>> continue to work.
13 > >>>>
14 > >>>> I would like to have these added in .gitignore.
15 > >>>>
16 > >>>> metadata/dtd/ # used by something?
17 > >>>> metadata/glsa/ # used by the GLSA utilities?
18 > >>>> matadata/herds.xml # used by equery from gentoolkit
19 > >>>> metadata/news/ # used by eselect news
20 > >>>>
21 > >>>
22 > >>> As a side note, it probably wouldn't hurt to set up a guide for
23 > >>> running git on /usr/portage, including setting up these symlinks,
24 > >>> running egencache after emerge --sync, etc. I imagine that this is a
25 > >>> configuration that many developers will tend to use, and with the
26 > >>> advent of git we may see more users who tend to contribute doing the
27 > >>> same.
28 > >>>
29 > >>
30 > >> In fact, this should be the recommended way of running gentoo for
31 > >> everyone. Our rsync methods are still inherently insecure (unless I
32 > >> missed something), because:
33 > >> 1. machine key
34 > >> 2. profiles, eclasses and so on are not covered with a
35 > >> signature/Manifest anyway
36 > >
37 > > Not unless metadata cache will be synced too from a trusted source.
38 > > It takes too much time to generate, especially on non-brand-new
39 > > hardware.
40 > >
41 >
42 > I was wondering if that could be automated in a separate branch (only
43 > needs to update in 24h intervals).
44
45 Please don't cruft the repo with huge metadata. And I have
46 metadata-applied mirrors for all repositories at [1].
47
48 [1]:https://github.com/gentoo-mirror/
49
50 --
51 Best regards,
52 Michał Górny
53 <http://dev.gentoo.org/~mgorny/>

Replies

Subject Author
Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore) hasufell <hasufell@g.o>