Gentoo Archives: gentoo-dev

From: hasufell <hasufell@g.o>
To: gentoo-dev@l.g.o
Subject: Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore)
Date: Mon, 10 Aug 2015 20:52:11
Message-Id: 55C90EEF.3020002@gentoo.org
In Reply to: Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore) by Andrew Savchenko
1 On 08/10/2015 10:47 PM, Andrew Savchenko wrote:
2 > On Mon, 10 Aug 2015 22:13:23 +0200 hasufell wrote:
3 >> On 08/10/2015 05:09 PM, Rich Freeman wrote:
4 >>> On Mon, Aug 10, 2015 at 11:04 AM, Mike Gilbert <floppym@g.o> wrote:
5 >>>>
6 >>>> Expanding on this: the rsync master creates the following
7 >>>> files/directories under metatdata. On my own system, I like to symlink
8 >>>> them to locations outside my repo so that related portage features
9 >>>> continue to work.
10 >>>>
11 >>>> I would like to have these added in .gitignore.
12 >>>>
13 >>>> metadata/dtd/ # used by something?
14 >>>> metadata/glsa/ # used by the GLSA utilities?
15 >>>> matadata/herds.xml # used by equery from gentoolkit
16 >>>> metadata/news/ # used by eselect news
17 >>>>
18 >>>
19 >>> As a side note, it probably wouldn't hurt to set up a guide for
20 >>> running git on /usr/portage, including setting up these symlinks,
21 >>> running egencache after emerge --sync, etc. I imagine that this is a
22 >>> configuration that many developers will tend to use, and with the
23 >>> advent of git we may see more users who tend to contribute doing the
24 >>> same.
25 >>>
26 >>
27 >> In fact, this should be the recommended way of running gentoo for
28 >> everyone. Our rsync methods are still inherently insecure (unless I
29 >> missed something), because:
30 >> 1. machine key
31 >> 2. profiles, eclasses and so on are not covered with a
32 >> signature/Manifest anyway
33 >
34 > Not unless metadata cache will be synced too from a trusted source.
35 > It takes too much time to generate, especially on non-brand-new
36 > hardware.
37 >
38
39 I was wondering if that could be automated in a separate branch (only
40 needs to update in 24h intervals).

Replies

Subject Author
Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore) "Michał Górny" <mgorny@g.o>