Re: [gentoo-dev] possible trojan in openssh-3.4p1

[Jean-Michel Smith <jean@kcco.com>]

On Friday 02 August 2002 02:36 am, Johannes Findeisen wrote:

> if this should be a option in portage, we always need to download two files
> from two servers to check if the md5sum are the same... :-(
> IMO it is good as it is. the gentoo-core team are providing a md5sum in the
> portage tree and that should be enough.

Until it isn't, which is going to happen, sooner or later.

Ideally each developer would GPG sign their source tarballs (and have their 
public keys available from several independent locations, such as 
key-servers, a public key-ring available for download, and purchase on CDR).

But at the very least, Gentoo should have a public keyring available (again, 
from multiple sources to insure the keyring itself hasn't been modified), and 
each ebuild and digest file should be cryptographically signed.  Emerge 
should check those signatures and validate them before installing an ebuild.

If this issue isn't addressed in some fashion, it really only becomes a 
question of time before Gentoo is trojanned via the ebuild/emerge process, 
and the entire distro gets a big black eye as a result, and then addresses 
these concerns anyway.

Why not do it proactively instead?

Jean.