Gentoo Archives: gentoo-dev

From: "Michał Górny" <mgorny@g.o>
To: Andrew Savchenko <bircoph@g.o>
Cc: gentoo-dev@l.g.o
Subject: Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore)
Date: Mon, 10 Aug 2015 21:03:20
Message-Id: 20150810230304.2b4d2654@pomiot
In Reply to: Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore) by Andrew Savchenko
1 Dnia 2015-08-10, o godz. 23:49:55
2 Andrew Savchenko <bircoph@g.o> napisał(a):
3
4 > On Mon, 10 Aug 2015 23:47:21 +0300 Andrew Savchenko wrote:
5 > > On Mon, 10 Aug 2015 22:13:23 +0200 hasufell wrote:
6 > > > On 08/10/2015 05:09 PM, Rich Freeman wrote:
7 > > > > On Mon, Aug 10, 2015 at 11:04 AM, Mike Gilbert <floppym@g.o> wrote:
8 > > > >>
9 > > > >> Expanding on this: the rsync master creates the following
10 > > > >> files/directories under metatdata. On my own system, I like to symlink
11 > > > >> them to locations outside my repo so that related portage features
12 > > > >> continue to work.
13 > > > >>
14 > > > >> I would like to have these added in .gitignore.
15 > > > >>
16 > > > >> metadata/dtd/ # used by something?
17 > > > >> metadata/glsa/ # used by the GLSA utilities?
18 > > > >> matadata/herds.xml # used by equery from gentoolkit
19 > > > >> metadata/news/ # used by eselect news
20 > > > >>
21 > > > >
22 > > > > As a side note, it probably wouldn't hurt to set up a guide for
23 > > > > running git on /usr/portage, including setting up these symlinks,
24 > > > > running egencache after emerge --sync, etc. I imagine that this is a
25 > > > > configuration that many developers will tend to use, and with the
26 > > > > advent of git we may see more users who tend to contribute doing the
27 > > > > same.
28 > > > >
29 > > >
30 > > > In fact, this should be the recommended way of running gentoo for
31 > > > everyone. Our rsync methods are still inherently insecure (unless I
32 > > > missed something), because:
33 > > > 1. machine key
34 > > > 2. profiles, eclasses and so on are not covered with a
35 > > > signature/Manifest anyway
36 > >
37 > > Not unless metadata cache will be synced too from a trusted source.
38 > > It takes too much time to generate, especially on non-brand-new
39 > > hardware.
40 >
41 > Another issue: we will have to setup git mirrors as well (probably
42 > reusing hosts providing rsync mirrors). I really doubt current
43 > infrastructure will survive if all users will sync from its git.
44
45 Do you mean git mirrors of the original repo, or md5-cache propagated
46 copy for users syncing? The latter is available for a few months now
47 [1,2].
48
49 [1]:https://github.com/gentoo-mirror/
50 [2]:https://wiki.gentoo.org/wiki/Project:Repository_mirror_and_CI
51
52 --
53 Best regards,
54 Michał Górny
55 <http://dev.gentoo.org/~mgorny/>