| 1 |
On 10/30/2016 01:44 PM, Michał Górny wrote: |
| 2 |
> Hi, everyone. |
| 3 |
> |
| 4 |
> Just a quick note: I've prepared a simple tool [1] to verify clones of |
| 5 |
> gentoo-mirror repositories. It's still early WiP but can be easily used |
| 6 |
> to verify a clone: |
| 7 |
> |
| 8 |
> $ ./verify-repo gentoo |
| 9 |
> [/var/db/repos/gentoo] |
| 10 |
> Untrusted signature on 42ccdf48d718287e981c00f25caea2242262906a |
| 11 |
> (you may need to import/trust developer keys) |
| 12 |
> Note: unsigned changes in metadata and/or caches found (it's fine) |
| 13 |
|
| 14 |
I don't think it's acceptable to use an unsigned metadata/cache commit. |
| 15 |
Can't we use an infrastructure key for this? |
| 16 |
|
| 17 |
|
| 18 |
> |
| 19 |
> It can take any number of repository names and/or paths on argv, or |
| 20 |
> will verify all installed repositories if run without arguments. |
| 21 |
> |
| 22 |
> It has explicit support for unsigned cache update commits from |
| 23 |
> gentoo-mirror (verifies the last signed commits and diffs it against |
| 24 |
> HEAD); though it will probably get confused if signed commits out of |
| 25 |
> metadata/ subrepos come (very rare case). |
| 26 |
> |
| 27 |
> Verification is done using git's default GPG magic. I'd like to |
| 28 |
> improve it to use gkeys but the project still hasn't achieved |
| 29 |
> the ability to run out-of-the-box without local hackery. |
| 30 |
|
| 31 |
Is there an open bug for this? We really need gkeys to be usable. |
| 32 |
|
| 33 |
> |
| 34 |
> Oh, as a side note: since Portage defaults to --depth=1 clones, |
| 35 |
> signatures are usually lost. I've submitted a patch to increase |
| 36 |
> the default depth to 10. |
| 37 |
> |
| 38 |
> [1]:https://github.com/mgorny/verify-repo-mirror |
| 39 |
> |
| 40 |
|
| 41 |
|
| 42 |
-- |
| 43 |
Thanks, |
| 44 |
Zac |
Archives