Re: [gentoo-dev] 2004.1 will not include a secure portage.

[Paul de Vrieze]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 24 March 2004 00:36, Jesse Nelson wrote:
>   so a dev key would be revoked by a sync on a file containing a list
> of dev keys ? what if i compromise a rsync server adn a developers
> box. This isnt that far fetched a scenario. I get acess to a dev key
> and i stop a server from updateing the signed key sigs file.

That's why the signing key needs to be shortlived. Basically if the 
signing key is valid for 1 day, the list of dev keys becomes invalid 
after a day. That would halt the rsync part of the problem. Of course it 
would still be a compromise and we would need to check all files signed 
by the key, but it would be needed anyway as it is unlikely we can stop 
the intrusion at the moment it happens.

> this also doesnt begin to solve the rogue developer problem (tho thats
> not the goal on this i guess)

There is no way to stop this before that person is identified in any 
case. After this person is identified his keys will be revoked and all 
the packages signed by him/her are invalid. They will need to be 
resigned by someone else to be valid again.

> imho every package needs 2 pairs of eyes b4 gettin released. (2 dev
> sigs + sign key) but theres procedural and time constraints that will
> probly prevent that from ever happening.

That is a QA issue, but would not change the basic infrastructure. I 
think we should first discuss single signatures and then only discuss 
multiple signatures.

Paul

- -- 
Paul de Vrieze
Gentoo Developer
Mail: pauldv@g.o
Homepage: http://www.devrieze.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAYWS9bKx5DBjWFdsRAr7cAKDdO71+8LiHg9KR2E1pZp7QyqAVvQCgrOXY
EPRjTlCzStpL5DNQCKh8T8U=
=INcS
-----END PGP SIGNATURE-----

--
gentoo-dev@g.o mailing list