Re: [gentoo-dev] Peer-to-Peer?

[Yannick Koehler]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On July 19, 2002 05:20 am, Nils Decker wrote:
> >  > propose or take it from the distribution system.  Basically the
> >  > same as ccache ;-)
> >
> > I like the idea. I was thinking of something similar.
> > I think it's possible to hash the use flags used to build
> > the package and compare it to the package to be downloaded.
>
> I see another problem with this. There is no way to make the packages
> trusted. In the portage tree, every downloaded file is checked against a
> MD5 hash. This means, I have to trust the person who build the port. This
> is not a big problem to me, because those people are "near" to the gentoo
> core, and everybody can check the MD5s against the official downloads of
> the packet.
>
> I can't do this sort of check agains precompiled binaries, because every
> binary would have a different MD5. The only way to check would to compile
> the package myself with the same flags, thus defeating the purpose.
> Using those binary packages means to trust every user of gentoo, that he
> doesn't put trojans or whatever on my system.

The MD5 hash verification is only providing proof that the file you've 
transferred between the distribution server and your PC was the same intended 
by the server on which you did your rsync of the digest files.

You actually implicitely trust that whoever put the digest files inside the 
rsync server used "correct" sources tarballs, you could verify that but the 
process is kind of lenghty as it would be for a binary check too.

And now because there may be multiple rsync server, that trust is getting less 
and less meaningful.

To fix that, one would have to actually use the same PGP signature of the 
package as the one provided on the original distribution site from the 
original author.

- -- 

Yannick Koehler
 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE9OA5ofuKOJNEyL1URAgjIAJ9uevL5x70xa9gpTZsckyivZzAcRQCdEVry
YpQYX7E3DVoJtRlhTXQyqpg=
=djr/
-----END PGP SIGNATURE-----