From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gentoo-dev+bounces-83614-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by finch.gentoo.org (Postfix) with ESMTPS id 8CF131382C5
	for <garchives@archives.gentoo.org>; Thu, 25 Jan 2018 10:04:40 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id 1FCA0E0924;
	Thu, 25 Jan 2018 10:04:33 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by pigeon.gentoo.org (Postfix) with ESMTPS id C5937E0826
	for <gentoo-dev@lists.gentoo.org>; Thu, 25 Jan 2018 10:04:32 +0000 (UTC)
Received: from pomiot (d202-252.icpnet.pl [109.173.202.252])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	(Authenticated sender: mgorny)
	by smtp.gentoo.org (Postfix) with ESMTPSA id 24E7D335C36;
	Thu, 25 Jan 2018 10:04:30 +0000 (UTC)
Message-ID: <1516874667.1833.4.camel@gentoo.org>
Subject: [gentoo-dev] [News item review] Portage rsync tree verification
From: =?UTF-8?Q?Micha=C5=82_G=C3=B3rny?= <mgorny@gentoo.org>
To: gentoo-dev <gentoo-dev@lists.gentoo.org>
Date: Thu, 25 Jan 2018 11:04:27 +0100
Organization: Gentoo
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.24.6 
Precedence: bulk
List-Post: <mailto:gentoo-dev@lists.gentoo.org>
List-Help: <mailto:gentoo-dev+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-dev+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-dev+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-dev.gentoo.org>
X-BeenThere: gentoo-dev@lists.gentoo.org
Reply-to: gentoo-dev@lists.gentoo.org
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Archives-Salt: 55ff42c6-14b5-4188-837d-b067bfb6b21b
X-Archives-Hash: 2beee70a57dca2d8418cb7b06acaa208

Hi,

This one would be committed once new sys-apps/portage release is wrapped
up and hits ~arch.

---
Title: Portage rsync tree verification
Author: Michał Górny <mgorny@gentoo.org>
Posted: 2018-01-xx
Revision: 1
News-Item-Format: 2.0
Display-If-Installed: <sys-apps/portage-2.3.21

Starting with sys-apps/portage-2.3.22, Portage enables strong
cryptographic verification of the Gentoo rsync tree by default.
This aims to prevent malicious third parties from altering the contents
of the ebuild repository received by our users.

The verification is implemented using app-portage/gemato. Currently,
the whole repository is verified after syncing. On systems with slow
hard drives, this could take around 2 minutes. If you wish to disable
it, you can disable the 'rsync-verify' flag on sys-apps/portage
or set 'sync-rsync-verify-metamanifest = no' in your repos.conf.

Please note that the verification currently does not prevent Portage
from using the repository after syncing. If 'emerge --sync' fails,
do not install any packages and retry syncing. In case of prolonged
or frequent verification failures, please make sure to report a bug
including the failing mirror addresses (found in emerge.log).

The verification uses keys provided by the app-crypt/gentoo-keys
package. The keys are refreshed from the keyserver before every use
in order to check for revocation. The post-sync verification ensures
that the key package is verified itself. However, manual verification
is required before the first use.

On new Gentoo installations including portage-2.3.22, the verification
of the keys will be covered by verifying the installation media
and repository snapshot signatures. On existing installations, you need
to manually compare the primary key fingerprint (reported by gemato
on every sync) against the official Gentoo keys [1]. An example gemato
output is:

  INFO:root:Valid OpenPGP signature found:
  INFO:root:- primary key: 1234567890ABCDEF1234567890ABCDEF12345678
  INFO:root:- subkey: FEDCBA0987654321FEDCBA0987654321FEDCBA09

The primary key printed must match 'Gentoo Portage Snapshot Signing Key'
on the site. Please make sure to also check the certificate used
for the secure connection to the site!

[1]:https://www.gentoo.org/downloads/signatures/
---

-- 
Best regards,
Michał Górny