Re: [gentoo-security] Gentoo's security

[Jason Stubbs]

On Monday 08 November 2004 11:02, Alexander Holler wrote:
> So you have on the one side carefully crafted environments to protect
> the system/user from software-failures or attackers, but on the other
> side there is portage which is run regulary and is fetching scripts from
> the internet which are run unchecked by root.
>
> I think this explains why I doesn't understand that nobody cares about
> that.

It really seems to me like you are trolling. The first email you sent was done 
so after getting frustrated with Mike Frysinger's (vapier) closing of the 
"versioned eclasses" bug. Yet, what you are talking about here is absolutely 
nothing to do with that. You made most of the same statements on the bug, but 
they were off-topic in that bug's context as well. Furthermore, there is 
already another bug open for that off-topicness.

So, let me give you an account of where I see things are at:
* SHA1 support is in portage but can't be enabled yet due to compatibility 
  issues. That is, enabling it will prevent user's running <portage-2.0.51 
  from being able to upgrade.
* Ebuild signing support is in portage and is starting to be adopted. 
  Presently, there is a push for developer education.
* CVS portage now runs most ebuild phases as the portage user rather than 
  root and work is being done to support the last few as well.
* Eclass, package and profile signing are all currently being worked on (and 
  had begun before you started trolling)

The thing you seem to keep coming back to is why it hasn't already been 
completed. You've been given the answer to that several times - lack of time 
and higher priority issues. What I really would like to know is why you are 
trying to tie up so much more of the time of the people that you would have 
implement support for these critical features with these pointless emails?

Regards,
Jason Stubbs

--
gentoo-security@g.o mailing list