| 1 |
W dniu czw, 25.01.2018 o godzinie 15∶55 -0600, użytkownik R0b0t1 |
| 2 |
napisał: |
| 3 |
> On Thu, Jan 25, 2018 at 3:45 PM, Michał Górny <mgorny@g.o> wrote: |
| 4 |
> > W dniu czw, 25.01.2018 o godzinie 21∶37 +0000, użytkownik Robin H. |
| 5 |
> > Johnson napisał: |
| 6 |
> > > On Thu, Jan 25, 2018 at 01:35:17PM +0100, Michał Górny wrote: |
| 7 |
> > > > Title: Portage rsync tree verification |
| 8 |
> > > > Author: Michał Górny <mgorny@g.o> |
| 9 |
> > > > Posted: 2018-01-xx |
| 10 |
> > > > Revision: 1 |
| 11 |
> > > > News-Item-Format: 2.0 |
| 12 |
> > > > Display-If-Installed: <sys-apps/portage-2.3.21 |
| 13 |
> > > |
| 14 |
> > > Drop Display-If-Installed, they need to always see this until they know |
| 15 |
> > > it was bootstrapped. |
| 16 |
> > |
| 17 |
> > Well, the idea was that if someone starts with stage that has >2.3.21, |
| 18 |
> > then he has bootstrapped via verifying the stage signature. |
| 19 |
> > |
| 20 |
> > > > Starting with sys-apps/portage-2.3.22, Portage enables cryptographic |
| 21 |
> > > > verification of the Gentoo rsync repository distributed over rsync |
| 22 |
> > > > by default. |
| 23 |
> > > |
| 24 |
> > > Seems very wordy, suggested cleanup: |
| 25 |
> > > > > Starting with sys-apps/portage-2.3.22, Portage will verify the Gentoo |
| 26 |
> > > > > repository after rsync by default. |
| 27 |
> > > > |
| 28 |
> > > > This aims to prevent malicious third parties from altering |
| 29 |
> > > > the contents of the ebuild repository received by our users. |
| 30 |
> > > > |
| 31 |
> > > > This does not affect users syncing using git and other methods. |
| 32 |
> > > > Appropriate verification mechanisms for them will be provided |
| 33 |
> > > > in the future. |
| 34 |
> > > |
| 35 |
> > > Note that emerge-webrsync has verification via FEATURES=webrsync-gpg? |
| 36 |
> > |
| 37 |
> > I'm sorry, I have never used that. Does it cover full key maintenance |
| 38 |
> > or rely on user to do the gpg work? |
| 39 |
> > |
| 40 |
> |
| 41 |
> It used to be necessary to set up a GnuPG home for portage and pull |
| 42 |
> the keys in, but now users can emerge app-crypt/gentoo-keys and set |
| 43 |
> PORTAGE_GPG_DIR="/var/lib/gentoo/gkeys/keyrings/gentoo/release". |
| 44 |
> |
| 45 |
|
| 46 |
In that case I'd rather not announce it until it is integrated properly. |
| 47 |
|
| 48 |
-- |
| 49 |
Best regards, |
| 50 |
Michał Górny |
Archives