Re: [gentoo-dev] [RFC] GLEP 74: Full-tree verification using Manifest files

["Hanno Böck" <hanno@gentoo.org>]

Hi,

On Thu, 26 Oct 2017 22:12:25 +0200
Michał Górny <mgorny@gentoo.org> wrote:

> After a week of hard work, I'd like to request your comments
> on the draft of GLEP 74. This GLEP aims to replace the old
> tree-signing GLEPs 58 and 60 with a superior implementation and more
> complete specification.

Thanks for working on this, it's really one of the biggest security
issues Gentoo has these days that need to be fixed.

I hope I'll find time to read it in detail, but by skimming through it
I noted that the downgrade attack prevention is kinda not very clear.
It says in the timestamp section "The package manager can use it  to
detect an outdated repository checkout." But it doesn't say how exactly.

Should a package manager reject a sync if it is too old? or not install
packages if a sync hasn't happened for some time? What is considered
"outdated"? I think that should be clarified how exactly it's supposed
to work.

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@hboeck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42