1 |
On Tuesday 06 April 2010 23:13:47 Paul Hartman wrote: |
2 |
> On Tue, Apr 6, 2010 at 3:41 PM, Alan McKinnon <alan.mckinnon@×××××.com> |
3 |
wrote: |
4 |
> > On Tuesday 06 April 2010 20:56:30 Butterworth, John W. wrote: |
5 |
> >> Thanks. |
6 |
> >> |
7 |
> >> Do you know if someone makes a change to a copy of apache hosted on a |
8 |
> >> public mirror, will the sync between the servers determine that it's |
9 |
> >> corrupted (via 'bad' checksum) on the public side and replace it? |
10 |
> > |
11 |
> > I can answer this, I run a public Gentoo mirror (not an official one) |
12 |
> > |
13 |
> > If I, or some clown, loads a trojaned copy of Apache source code into |
14 |
> > my distfiles mirror, portage will complain bitterly because the hash in |
15 |
> > the manifest will fail. Then you will know something is wrong. |
16 |
> > |
17 |
> > If I trojan the ebuild and the portage tree to match my trojaned sources, |
18 |
> > you will probably not pick it up. This would be very risky indeed for me |
19 |
> > to do as I can't be sure you will sync the tree and get your distfiles |
20 |
> > from me. |
21 |
> |
22 |
> Isn't there something like FEATURES="gpg" to enable checking gpg |
23 |
> signatures on ebuilds? (I haven't tried it so I don't know if this is |
24 |
> actually used) |
25 |
|
26 |
FEATURES=sign |
27 |
|
28 |
"man 5 make.conf" implies that the dev signs the Manifest by checking |
29 |
something into the tree using repoman. Presumably, the user either has to |
30 |
fetch the public key or portage includes it in the tree. But documentation in |
31 |
the man pages is sparse, I can't find an explanation of how it should work. |
32 |
|
33 |
|
34 |
-- |
35 |
alan dot mckinnon at gmail dot com |