| 1 |
On Wed, Jan 24, 2018 at 3:56 AM, Michał Górny <mgorny@g.o> wrote: |
| 2 |
|
| 3 |
> Hi, everyone. |
| 4 |
> |
| 5 |
> Since the initial review of my patch lost focus, and lacked sufficient |
| 6 |
> context, here's the plan that I'd like to follow in order to initially |
| 7 |
> integrate gemato with portage and give our users secure checkouts by |
| 8 |
> default. |
| 9 |
> |
| 10 |
> 1. Add postsync hook to Portage git. Eventually, it will be replaced by |
| 11 |
> direct Portage support. |
| 12 |
> |
| 13 |
|
| 14 |
> 2. Add IUSE=+rsync-verify to portage-9999 that controls installing the |
| 15 |
> hook. This will give users the ability to easily disable it without jumping |
| 16 |
> through cross package hoops. |
| 17 |
> |
| 18 |
|
| 19 |
I think it makes sense to avoid installing the hook through this means |
| 20 |
(e.g. I don't want it, so I set USE=-rsync-verify) |
| 21 |
|
| 22 |
I think its a bit trickier to control the hook's behavior. For instance: |
| 23 |
|
| 24 |
1) I install portage[rsync-verify]. This installs the hook. |
| 25 |
2) I end up not liking the hook, I install portage[-rsync-verify] |
| 26 |
3) Does the hook get config-protected here? |
| 27 |
4) I run emerge --depclean # gemato is un-merged here. |
| 28 |
|
| 29 |
Now the hook fails because gemato is gone but the hook remains due to |
| 30 |
config-protect? |
| 31 |
|
| 32 |
5) I run etc-update and the hook is deleted; I don't recall etc-update |
| 33 |
deleting files... |
| 34 |
|
| 35 |
So basically I'm curious how the hook works w/config-protect; but |
| 36 |
admittedly its been a while since I worried about such things so I could be |
| 37 |
wrong. |
| 38 |
|
| 39 |
Other considerations include: |
| 40 |
|
| 41 |
1) Hooks don't matter anyway, so we may not care if it breaks. |
| 42 |
2) Verification doesn't matter currently (portage will install software |
| 43 |
regardless), so we may not care if it doesn't function. |
| 44 |
|
| 45 |
|
| 46 |
> |
| 47 |
> 3. Submit a news item for review that will explain how to initially verify |
| 48 |
> the keys on existing installations. |
| 49 |
> |
| 50 |
> The news item would be published when the hook hits a release. |
| 51 |
> |
| 52 |
> What do you think? If you agree, then I'll start writing the news item. |
| 53 |
> |
| 54 |
|
| 55 |
The other part of the user story I don't understand is what actions should |
| 56 |
users take when verification legit fails? |
| 57 |
|
| 58 |
1) file a bug? |
| 59 |
2) re-sync their tree? |
| 60 |
3) something else? |
| 61 |
|
| 62 |
|
| 63 |
-- |
| 64 |
> Best regards, |
| 65 |
> Michał Górny (by phone) |
| 66 |
> |
| 67 |
> |
Archives