From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 652021382C5 for ; Sun, 28 Jan 2018 08:58:50 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id A8D12E0C4F; Sun, 28 Jan 2018 08:58:43 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 515D0E0C4B for ; Sun, 28 Jan 2018 08:58:43 +0000 (UTC) Received: from pomiot (d202-252.icpnet.pl [109.173.202.252]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: mgorny) by smtp.gentoo.org (Postfix) with ESMTPSA id 2C098335C0C; Sun, 28 Jan 2018 08:58:40 +0000 (UTC) Message-ID: <1517129917.1270.1.camel@gentoo.org> Subject: Re: [gentoo-dev] [News item review] Portage rsync tree verification (v4) From: =?UTF-8?Q?Micha=C5=82_G=C3=B3rny?= To: gentoo-dev@lists.gentoo.org Date: Sun, 28 Jan 2018 09:58:37 +0100 In-Reply-To: <1516874667.1833.4.camel@gentoo.org> References: <1516874667.1833.4.camel@gentoo.org> Organization: Gentoo Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.24.6 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Archives-Salt: e8d1fe3a-3327-4615-8d47-972e0b482876 X-Archives-Hash: 3a8c561ac6a7f98d93debdfceb6a235c Hopefully the final version. --- Title: Portage rsync tree verification Author: Michał Górny Posted: 2018-01-xx Revision: 1 News-Item-Format: 2.0 Display-If-Installed: sys-apps/portage Starting with sys-apps/portage-2.3.22, Portage will verify the Gentoo repository after rsync by default. The new verification is intended for users who are syncing via rsync. Verification mechanisms for other methods of sync will be provided in the future. This does not affect users syncing using git and other methods. Appropriate verification mechanisms for them will be provided in the future. The verification is implemented via app-portage/gemato. Currently, the whole repository is verified after syncing. On systems with slow hard drives, this could take around 2 minutes. If you wish to disable it, you can disable the 'rsync-verify' USE flag on sys-apps/portage or set 'sync-rsync-verify-metamanifest = no' in your repos.conf. Please note that the verification currently does not prevent Portage from using the repository after syncing. If 'emerge --sync' fails, do not install any packages and retry syncing. In case of prolonged or frequent verification failures, please make sure to report a bug including the failing mirror addresses (found in emerge.log). The verification uses information from the binary keyring provided by the app-crypt/gentoo-keys package. The keys are refreshed from the keyserver before every use in order to check for revocation. The post-sync verification ensures that the key package is verified itself. However, manual verification is required before the first use. On Gentoo installations created using installation media that included portage-2.3.22, the keys will already be covered by the installation media signatures. On existing installations, you need to manually compare the primary key fingerprint (reported by gemato on every sync) against the official Gentoo keys [1]. An example gemato output is: INFO:root:Valid OpenPGP signature found: INFO:root:- primary key: 1234567890ABCDEF1234567890ABCDEF12345678 INFO:root:- subkey: FEDCBA0987654321FEDCBA0987654321FEDCBA09 Please note that the above snippet does not include the real key id on purpose. The primary key actually printed by gemato must match the 'Gentoo Portage Snapshot Signing Key' on the website. Please make sure to also check the certificate used for the secure connection to the site! [1]:https://www.gentoo.org/downloads/signatures/ -- Best regards, Michał Górny