Re: [gentoo-security] Re: Out of air

[Dominik Schäfer]

Chris Haumesser wrote:

> No, they /need/ not, and should not. I would be _thrilled_ to just
> get a signature with my tree, that I can manually verify by firing up
> gpg. No portage support is necessary for this interim solution. We
> all know something better is in the works for portage.
Mhmm, in that case you will not be able to use portage to get the
portage tree (at least it would not reasonable) because emerge executes
some code from the tree during emerge sync as somebody wrote here two
days ago. If you do not verify the signature + hashes before that, it is
completely senseless to do it all.
And as Marius mentioned you need a solution for checking 100000 hashes
(not just the gpg signature of the file containing the hashes). Somebody
has to write that, even if you don't patch portage.

> While there is surely some work in the area of job control, it has
> been pointed out already that the proposed solution is not terribly
> resource intensive. So unless gentoo's infrastructure is already
> severely stretched to the max (is it? how do i know?), I can't see
> how this is a huge obstacle. Is there an admin who can weigh in with
> an informed answer on this? Too much speculation on this point, not
> enough fact.
I am not a developer and I am basically repeating what people already
mentioned during the last 2 days.
You have to create the hashes and the signature everytime somebody
commits something to tree and you have to take care, that nobody syncs
during that time. So, a simple cronjob (as suggested several times) is
not sufficient. As far as I perceived, some patch to repoman (?) would
be necessary. Certainly those hashes have to be created incrementally to
reduce load and calculation time which also adds some complexicity.

> Key management/security/policy is an issue that will need to be
> addressed regardless of the mechanics of any signing process, so I
> don't see how that is a blocker to this proposal. The idea of a
> master key is equally applicable (and optional) to both the proposal
> on this list, and the one currently under development.
But the PKI and public key policy for Gentoo have not been developed yet
(AFAIK). And that is crucial for even a quick solution as a signature
without defined key policy (and management) is really not worth much.

Of course, all these issues can be solved, but not by the way...

My 2 Eurocents...
Dominik


--
gentoo-security@g.o mailing list