Re: [gentoo-dev] status of security improvments (GLEPs 57-61)

[Robin H. Johnson]

On Wed, Aug 07, 2013 at 10:47:15PM +0200, hasufell wrote:
> On 08/07/2013 09:55 PM, Robin H. Johnson wrote:
> > On Tue, Aug 06, 2013 at 10:32:39AM -0400, Alex Xu wrote:
> >> AFAIK, the status is "unimplemented, and nobody's working on it".
> > No, I did post implementation patches for much of it back when the GLEPs
> > were in process. The overwhelming message from other devs at the time
> > was that it should happen at the same time or shortly after the Git
> > migration, and that in the short-term, if you needed that security, you
> > should be using the signed portage snapshot tarballs.
> So the git migration IS actually a blocker?
>
> Do we really expect it to happen? Should we wait? Why?
The computational cost to generating the layers of MetaManifest is
significantly eased with git. But the best argument was actually taking
advantage of thin Manifests.

When we move to Git, all the per-package Manifests are going to be
thin-Manifest (DIST) entries only. If we KEEP them intact, and put ALL
of the other (git-implicit) entries in the MetaManifest, we only need to
inject very few files into the rsync tree.

> I'd say let's push for it. I am willing to do a lot of testing.
The code support shouldn't be held up by the Git migration however. The
code for it needs to be done, I doubt my old patches even apply anymore;
Portage has changed significantly since I wrote them.

You also asked about PMS, and I'm wondering if PMS specifies the
Manifest contents at all, and/or if it needs updates for MetaManifest.

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Trustee & Infrastructure Lead
E-Mail     : robbat2@g.o
GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85