Re: [gentoo-dev] 2004.1 will not include a secure portage.

[Jesse Nelson]

Back when the zynot guys did thier thing i laid out a system for dist/pacakage signing on the wiki, but that has gone away.
I have thrown up a quick htmlized version of that *and removed the zynot refs for those still sore bout that* and put it up 

http://f00bar.com/files/ds.html

heres the quick overview:
	* GPG signatures for builds, patches, distfiles and sources from cvs or svn repositories
	* Auditing of distfiles/ebuilds for inclusion in the "secure or stable" branch
	* Options for securing the transmission channel for trees and distfiles
	* Revocation of certificates
	* Policy for dealing with poison mirrors,distfiles, and ebuilds
	* Policy for accetping new developer/maintainer keys ( see http://www.debian.org/devel/join/nm-step2    debians docs on this)
	* Web of trust and how it could apply to p2p and other areas

the zynot forums had a good thread bout this as well @ p2p stuff and thats linked from the top of this html page. 


* Chris Bainbridge (c.j.bainbridge@×××××.uk) wrote:
> Date: Wed, 24 Mar 2004 00:09:20 +0000
> From: Chris Bainbridge <c.j.bainbridge@×××××.uk>
> To: gentoo-dev@l.g.o
> User-Agent: KMail/1.6.1
> X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63
> Subject: Re: [gentoo-dev] 2004.1 will not include a secure portage.
>
> I think the idea of a central key controlling everything is bad - this means
> one person is ultimately responsible for the portage tree, and compromising
> this will allow access to everything. It would be better if every gentoo
> developer had a gpg key. Each package in the portage tree would then have
> a .gpg file which lists signatures for the package digest which contains
> hashes of each ebuild, files/*, and downloaded distfiles, and a permissions
> section listing who has access to make modifications to this dir (such as
> writing new ebuilds). People who already have access to a package are then
> free to grant access to others merely by inserting their public key into this
> file. emerge sync would have to be modified so that it checks signatures
> before files are updated.
>
> Important packages may require multiple signatures before a file is installed
> - this is to eliminate the possibility that a compromise of a single gentoo
> developer will hand root access to every gentoo installed system. At the
> moment, every developer is a point of cvs write access from which an attacker
> could root many gentoo installations.
>
> The key downloads, checking, revocation etc. would be handled by the existing
> gpg keyserver infrastructure (eg. keyserver.net). There is no need for an all
> powerful gentoo key, or even distribution system. Simply have emerge call gpg
> to do everything.
>
> This only really requires changes to the emerge sync process and a developer
> script to check, sign, and post changes. Everything else can be handed off to
> gpg. It would also enable some more exciting distribution methods like RSS
> channels listing new signed files in portage along with a p2p backend to
> fetch them, automatic security updates, etc.
>
> On Tuesday 23 March 2004 13:12, Paul de Vrieze wrote:
>
> > Ok, the biggest problem is an idea for how the actual checking should
> > function. (Signing is straightforward).
> >
> > I'll take a first shot at describing a key chain idea. Please shoot at it
> > and try to find the holes. But remember it needs to stay workable. First
> > the premises:
>
> --
> gentoo-dev@g.o mailing list
>
>

--
gentoo-dev@g.o mailing list