From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id EED831382C5 for ; Sun, 28 Jan 2018 06:40:26 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id BAE78E0B58; Sun, 28 Jan 2018 06:40:20 +0000 (UTC) Received: from mail-lf0-x230.google.com (mail-lf0-x230.google.com [IPv6:2a00:1450:4010:c07::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 45779E0AA3 for ; Sun, 28 Jan 2018 06:40:20 +0000 (UTC) Received: by mail-lf0-x230.google.com with SMTP id h92so5486502lfi.7 for ; Sat, 27 Jan 2018 22:40:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-transfer-encoding; bh=rvoLhxpDxejfIzrpq4H75awi4YpEIDonoUd4Nat//Oo=; b=hXr57JM6xUUzLtYOVx4ouK0LX2d7tOq7WGU4Stza/r5JfDGwGt58viaLplBGhE3EUz NRVbRyd2ZDOuiNMXAhFhfCBUAG70Z2Kkaz7yJWQSKIow0RtFu1pOA8liL3tOABbLkFHc wOWIOFOb/cFZViLlOY0qlq69f9+iHE7NkbADBiTVbfhDi4b3MQOVIIuYVabAom1FXnf0 zbkSDb/t1AwAH68ewLelOatrvU/SiqwggPpe2ZLHNQlLrDjK5QrMFhb4IYhVWjTjxTOw 11ekCKQWB76ZIlDHw5taUQ2rnG2/exi39zyxCh7UqSvvdMnzpWDcFai6IkoHBd5+fCs3 YgNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:content-transfer-encoding; bh=rvoLhxpDxejfIzrpq4H75awi4YpEIDonoUd4Nat//Oo=; b=VQEpYuPbVM+pnIwtuI7NAH1xnDF+Ai4layi5qAusI5g6y4/OxDn2O6YGbxR5cdosUT cipxHZnxQFfVpBW/FKKUKCsR0/ZGyUDQtBwoPATQvrUSjAXtYloGfao+2MID1dC8vwT2 3GoyYMxEp6OgJxcTChxeEX2Jn2iJU3yPzy5t+v5AtIf8LFXY1/aokRjkdMhflRlakrvg h4L3aJv1la3E655CRDFADqH6o9aQJYMs4qLG2K0gk36ZFeln4BECipLdQNVLKYaCuRRV sDGWF2erUwktp7d3xyKmLYCQHvJVHNUrRszOT/cs2GaVAzS4hymB4Snc9UQnXGh4ahQu xu/A== X-Gm-Message-State: AKwxytdq5WwZFTgWgva6tKexjVNOVV//Ctv7GzgeMBkuDiQBpCbxO25k xFwrbDvvhosMNoLaL4MmXAIQ5s7ZYvFNDjUmMOc= X-Google-Smtp-Source: AH8x224zeJjYOh9gn3CQ+PNrtkSfYaUhpA7omZYDU3tMco1Pz6HpSZ51KzMnAxW48NYnJxZGkscWgg4H5eTJPaEwdAQ= X-Received: by 10.25.31.200 with SMTP id f191mr11368834lff.68.1517121617761; Sat, 27 Jan 2018 22:40:17 -0800 (PST) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org MIME-Version: 1.0 Received: by 10.46.25.216 with HTTP; Sat, 27 Jan 2018 22:40:17 -0800 (PST) In-Reply-To: <1517063245.3816.13.camel@gentoo.org> References: <1516874667.1833.4.camel@gentoo.org> <1516883717.1833.10.camel@gentoo.org> <1516916746.30594.3.camel@gentoo.org> <1517063245.3816.13.camel@gentoo.org> From: R0b0t1 Date: Sun, 28 Jan 2018 00:40:17 -0600 Message-ID: Subject: Re: [gentoo-dev] [News item review] Portage rsync tree verification (v2) To: gentoo-dev@lists.gentoo.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Archives-Salt: d96698bf-fa9e-45e6-8b03-b4bc5268b52d X-Archives-Hash: 4e541d2a61b39c4bff6c3165d01351c7 On Sat, Jan 27, 2018 at 8:27 AM, Micha=C5=82 G=C3=B3rny = wrote: > W dniu czw, 25.01.2018 o godzinie 15=E2=88=B655=E2=80=89-0600, u=C5=BCytk= ownik R0b0t1 > napisa=C5=82: >> On Thu, Jan 25, 2018 at 3:45 PM, Micha=C5=82 G=C3=B3rny wrote: >> > W dniu czw, 25.01.2018 o godzinie 21=E2=88=B637=E2=80=89+0000, u=C5=BC= ytkownik Robin H. >> > Johnson napisa=C5=82: >> > > On Thu, Jan 25, 2018 at 01:35:17PM +0100, Micha=C5=82 G=C3=B3rny wro= te: >> > > > Title: Portage rsync tree verification >> > > > Author: Micha=C5=82 G=C3=B3rny >> > > > Posted: 2018-01-xx >> > > > Revision: 1 >> > > > News-Item-Format: 2.0 >> > > > Display-If-Installed: > > > >> > > Drop Display-If-Installed, they need to always see this until they k= now >> > > it was bootstrapped. >> > >> > Well, the idea was that if someone starts with stage that has >2.3.21, >> > then he has bootstrapped via verifying the stage signature. >> > >> > > > Starting with sys-apps/portage-2.3.22, Portage enables cryptograph= ic >> > > > verification of the Gentoo rsync repository distributed over rsync >> > > > by default. >> > > >> > > Seems very wordy, suggested cleanup: >> > > > > Starting with sys-apps/portage-2.3.22, Portage will verify the G= entoo >> > > > > repository after rsync by default. >> > > > >> > > > This aims to prevent malicious third parties from altering >> > > > the contents of the ebuild repository received by our users. >> > > > >> > > > This does not affect users syncing using git and other methods. >> > > > Appropriate verification mechanisms for them will be provided >> > > > in the future. >> > > >> > > Note that emerge-webrsync has verification via FEATURES=3Dwebrsync-g= pg? >> > >> > I'm sorry, I have never used that. Does it cover full key maintenance >> > or rely on user to do the gpg work? >> > >> >> It used to be necessary to set up a GnuPG home for portage and pull >> the keys in, but now users can emerge app-crypt/gentoo-keys and set >> PORTAGE_GPG_DIR=3D"/var/lib/gentoo/gkeys/keyrings/gentoo/release". >> > > In that case I'd rather not announce it until it is integrated properly. > What is "properly?" It's referenced in the handbook. Cheers, R0b0t1