[gentoo-security] Re: Trojan for Gentoo, part 2

[Peter Simons]

Kurt Lieber writes:

 > I can easily use the same flawed logic and say, "well,
 > none of our users ever bothered to submit patches to
 > portage to implement GPG signing, so it must not be
 > important to them."

I think it is important to stress that everybody is on the
same side here. The important thing right now is how to
_fix_ this problem. As I see it, the simplest possible
solution is this:

 (1) Run "find /usr/portage -type f | xargs sha1sum -b" on
     the Gentoo main system.

 (2) Sign the output with GPG.

 (3) Put it into the portage tree.

 (4) If the user has GPG installed and has manually put the
     appropriate public key in some place _outside_ of the
     portage tree, have "emerge sync" verify that the
     signature is intact and all hashes hold.

Done.

This is by no means perfect, obviously. But even if it means
that a dozen people have access to the secret key that
generates the signature, it is still a lot better than the
current situation.

Peter


--
gentoo-security@g.o mailing list