Re: [gentoo-hardened] The state of ebuild signing in portage

[Toby Dickenson]

On Thursday 24 April 2003 3:10 pm, Joshua Brindle wrote:

> >Will there be provision for controlling which developers are authorised to
> >sign each package, or will portage allow any developer to sign any package
> >manifest?
>
> there is no easy way since the only way cvs knows to allow/disallow commits
> is by permissions, we use permissions but they aren't fine grained, ie:
> everyone who has access to commit any package can commit to all of them.
> This is a lot better anyway since we have to be able to add new packages,
> do quick bumps on packages we don't necessarilly maintain, etc. Obviously
> if a dev is abusing we'll have records of what was commited and where and
> be able to take care of that.

Consider this fictional scenario: A colleague is appointed a new gentoo 
developer because of his interest in maintaining app-games/abcabcabcabc. I am 
not interested in this package, and never intend to install it on our server 
cluster.

Do I have to worry about him planting trojan sys-libs/glibc ebuilds in our 
local portage mirror? 


Another way of looking at it........

If I understand correctly, your proposal is using signatures from an inner 
keyring for two different purposes:
1. To confirm identity. This is the conventional meaning of a key signature, 
as should be understood by everyone that signs someone elses key.
2. To confirm status. That is, to confirm that the owner of the key is an 
official gentoo developer.

Would it be better to use key signatures from the inner keyring only for the 
first of those two purposes. Some file in portage, appropriately signed, 
would list all official developers and the packages that they are authorised 
to maintain. Senior gentoo developers will be authorised for everything.

-- 
Toby Dickenson
http://www.geminidataloggers.com/people/tdickenson


--
gentoo-hardened@g.o mailing list