Re: [gentoo-security] Re: Is anybody else worried about this? (was: Trojan for Gentoo, part 2)

[Kurt Lieber]

On Sun, Nov 07, 2004 at 12:01:35PM -0500 or thereabouts, Chris Frey wrote:
> Plus, the glibc ebuild maintainer should be tracking the changes.  He knows
> what's going on in glibc land, he knows the build process, he should be
> in touch with the main developers, and he should be reading the diffs.

If you believe this happens for even 20% of the packages in our tree,
you're mistaken.  Most devs look at changelogs.  Few devs look at code
diffs.  Note I did not say "Gentoo devs".

> I would instead recommend that he compare Gentoo to other distros that take
> package signing more seriously.  It may be that the features and benefits
> of a source-based distro like Gentoo outweigh the need for signed ebuilds,
> like it does for me on one of my machines.  But it also may mean that
> some machines require the security and peace of mind of another distro's
> signing practices and verification policies.  Other machines I admin
> fall into this category as well.

I would recommend that you, along with the other folks who have
misunderstood what this thread is about go back and re-read the original
post.  This has nothing to do with signed ebuilds in portage.  Signed
ebuilds in portage is something that is already implemented and supported
as an experimental feature as of 2.0.51:

http://www.gentoo.org/news/20041021-portage51.xml

The original poster was talking about the inability to verify *eclasses*,
not ebuilds.  eclasses are an important part of portage from a features and
functionality perspective, but they make up a small fraction of the overall
tree in terms of sheer number of files.  My point was and still is that
investing the time and effort to also sign these files isn't worth it given
the myriad of other larger holes that already exist further upstream.

We can argue all day long about whether or not to stick our finger in the
dike to plug the leak we see, but if there's a 3x3 hole just around the
bend that's gushing water, are we really serving any useful purpose?

Or, to leverage one of the primary tenets of FOSS -- if there are folks on
the list who truly believe this is a hole that should be fixed, provide
patches to portage to add this functionality.  It already supports signing
to some degree -- one could reasonably assume that adding support for
signing of eclasses is relatively easy for a competent python programmer.

--kurt