Re: [gentoo-security] Re: Out of air

[Antoine Martin]

> > The current development effort that is underway is not one that can be
> > implemented overnight, but there is a solution that manages to satisfy
> > the core needs of this thread that can be implemented overnight.
I second that.

To reply to a few other threads:
1) This is no disrespect to the gentoo devs (kudos here) or the other,
better solution that is in the works. Just a band-aid we would rather
have now.
2) To all those saying that code should be submitted, we do not have
access to the rsync servers needed to code 5 lines of bash.

> I would advise everybody to read through aforementioned discussions in the
> archives of gentoo-dev@g.o before persuing this. Something that
> appears so simple as this on the surface still has a number of sharp edges.
> The infrastructure team would have to do some careful planning and possibly
> restructing of job control on the master rsync and cvs servers. The portage
> team would need to implement support for verifying the signature is valid.
> Whoever else would have to plan and implement distribution of this
> all-powerful key.
I think we all admit it may take some time, but we are talking about the
quick and dirty solution as a stop-gap measure, nothing else.
And if the better solution takes more than 1.5years to roll out, backup
plans are just common sense - not criticism.

> But it doesn't stop there. Following this would be plan of action for the case
> that the all-powerful key is compromised. Then there is also the up to six
> month transition period between this solution and the solution that is
> currently being implemented. That also requires careful planning and
> implementation. So.. adding this simple solution now actually more than
> doubles the amount of work that needs to be done down the track.
Would you care to expand on that?

I is just a cron job and a script, how would that double the amount of
work in the future?!?

Antoine


--
gentoo-security@g.o mailing list