From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gentoo-dev+bounces-83619-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by finch.gentoo.org (Postfix) with ESMTPS id 4144D1382C5
	for <garchives@archives.gentoo.org>; Thu, 25 Jan 2018 12:35:27 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
	by pigeon.gentoo.org (Postfix) with SMTP id 1E601E09CE;
	Thu, 25 Jan 2018 12:35:22 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by pigeon.gentoo.org (Postfix) with ESMTPS id C3253E0991
	for <gentoo-dev@lists.gentoo.org>; Thu, 25 Jan 2018 12:35:21 +0000 (UTC)
Received: from pomiot (d202-252.icpnet.pl [109.173.202.252])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	(Authenticated sender: mgorny)
	by smtp.gentoo.org (Postfix) with ESMTPSA id 33ABA335C09;
	Thu, 25 Jan 2018 12:35:20 +0000 (UTC)
Message-ID: <1516883717.1833.10.camel@gentoo.org>
Subject: Re: [gentoo-dev] [News item review] Portage rsync tree verification
 (v2)
From: =?UTF-8?Q?Micha=C5=82_G=C3=B3rny?= <mgorny@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Date: Thu, 25 Jan 2018 13:35:17 +0100
In-Reply-To: <1516874667.1833.4.camel@gentoo.org>
References: <1516874667.1833.4.camel@gentoo.org>
Organization: Gentoo
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.24.6 
Precedence: bulk
List-Post: <mailto:gentoo-dev@lists.gentoo.org>
List-Help: <mailto:gentoo-dev+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-dev+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-dev+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-dev.gentoo.org>
X-BeenThere: gentoo-dev@lists.gentoo.org
Reply-to: gentoo-dev@lists.gentoo.org
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
X-Archives-Salt: 24b41f27-1e3e-437c-b815-fc8adce788c2
X-Archives-Hash: 38502b26cc39a03dd5a1762a843db832

Here's the updated version:

---
Title: Portage rsync tree verification
Author: Michał Górny <mgorny@gentoo.org>
Posted: 2018-01-xx
Revision: 1
News-Item-Format: 2.0
Display-If-Installed: <sys-apps/portage-2.3.21

Starting with sys-apps/portage-2.3.22, Portage enables cryptographic
verification of the Gentoo rsync repository distributed over rsync
by default. This aims to prevent malicious third parties from altering
the contents of the ebuild repository received by our users.

This does not affect users syncing using git and other methods.
Appropriate verification mechanisms for them will be provided
in the future.

The verification is implemented via using app-portage/gemato. Currently,
the whole repository is verified after syncing. On systems with slow
hard drives, this could take around 2 minutes. If you wish to disable
it, you can disable the 'rsync-verify' USE flag on sys-apps/portage
or set 'sync-rsync-verify-metamanifest = no' in your repos.conf.

Please note that the verification currently does not prevent Portage
from using the repository after syncing. If 'emerge --sync' fails,
do not install any packages and retry syncing. In case of prolonged
or frequent verification failures, please make sure to report a bug
including the failing mirror addresses (found in emerge.log).

The verification uses information from the binary keyring provided
by the app-crypt/gentoo-keys package. The keys are refreshed
from the keyserver before every use in order to check for revocation.
The post-sync verification ensures that the key package is verified
itself. However, manual verification is required before the first use.

On Gentoo installations created using installation media that included
portage-2.3.22, the keys will already be covered by the installation
media signatures. On existing installations, you need to manually
compare the primary key fingerprint (reported by gemato on every sync)
against the official Gentoo keys [1]. An example gemato output is:

  INFO:root:Valid OpenPGP signature found:
  INFO:root:- primary key: 1234567890ABCDEF1234567890ABCDEF12345678
  INFO:root:- subkey: FEDCBA0987654321FEDCBA0987654321FEDCBA09

The primary key printed must match 'Gentoo Portage Snapshot Signing Key'
on the site. Please make sure to also check the certificate used
for the secure connection to the site!

[1]:https://www.gentoo.org/downloads/signatures/
---

-- 
Best regards,
Michał Górny