Re: [gentoo-dev] suggestion portage ebuild system file modification rights and protection

[Chris Bainbridge]

On Sunday 07 September 2003 21:43, Jan Krueger wrote:
> On Sunday 07 September 2003 19:20, Martin Schlemmer wrote:
> > So how are any of these going to help if you do not trust us or any
> > other developers/upstream_authors, encryption, etc, etc.  I mean,
> > this *IS* what this whole issue is about, no ?
>
> No. I trust you. But trusting you doesnt mean that the ebuild you checked
> in to the tree arrives at my hardrive unmodified. There is no way for you
> as a human beeing to garantee this to me. Instead it should be expected
> that the ebuild gets modified (by faulty software/hardware/network/whatever
> or by a malicious attacker). So this must be taken care of.
>
> With Manifest and digest portage very much points in the right direction,
> but this is not enough, from my point of view.
>
> Jan

This has been discussed before ( http://bugs.gentoo.org/show_bug.cgi?id=5902 
). I think the gpg signatures development got put on hold because there was 
talk of making individuals responsible for packages (like Debian), rather 
than the system at the moment where a small core does all of the work.

My proposal was to use signatures along with the concept of requiring a 
certain number of developers to "sign off" an ebuild. Its important that the 
compromise of a single developer with cvs access shouldn't impact thousands 
of users. Therefore, most packages should require two or more developer 
signatures before they will be installed. 

Using a secure distribution infrastructure (eg. rsync over ssl) is not an 
option if gentoo is going to be distributed over untrusted p2p networks 
(which I think it will in the future). 


--
gentoo-dev@g.o mailing list