Re: [gentoo-dev] [News item review] Portage rsync tree verification (v2)

["Robin H. Johnson" <robbat2@gentoo.org>]

On Thu, Jan 25, 2018 at 01:35:17PM +0100, Michał Górny wrote:
> Title: Portage rsync tree verification
> Author: Michał Górny <mgorny@gentoo.org>
> Posted: 2018-01-xx
> Revision: 1
> News-Item-Format: 2.0
> Display-If-Installed: <sys-apps/portage-2.3.21
Drop Display-If-Installed, they need to always see this until they know
it was bootstrapped.

> Starting with sys-apps/portage-2.3.22, Portage enables cryptographic
> verification of the Gentoo rsync repository distributed over rsync
> by default. 
Seems very wordy, suggested cleanup:
|| Starting with sys-apps/portage-2.3.22, Portage will verify the Gentoo
|| repository after rsync by default.

> This aims to prevent malicious third parties from altering
> the contents of the ebuild repository received by our users.
> 
> This does not affect users syncing using git and other methods.
> Appropriate verification mechanisms for them will be provided
> in the future.
Note that emerge-webrsync has verification via FEATURES=webrsync-gpg?

Rewrite:
|| The new verification is intended for users who syncing via rsync.
|| Users who sync by emerge-webrsync should see [linkref]. 
|| Verification mechanisms for other methods of sync will be provided in
|| future.


> On Gentoo installations created using installation media that included
> portage-2.3.22, the keys will already be covered by the installation
> media signatures. On existing installations, you need to manually
> compare the primary key fingerprint (reported by gemato on every sync)
> against the official Gentoo keys [1]. An example gemato output is:
>   INFO:root:Valid OpenPGP signature found:
>   INFO:root:- primary key: 1234567890ABCDEF1234567890ABCDEF12345678
>   INFO:root:- subkey: FEDCBA0987654321FEDCBA0987654321FEDCBA09
Either we should use real key here, or specifically note this is a fake
key output on purpose.

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136