From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 632EE138359 for ; Tue, 6 Oct 2020 12:06:19 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 6CF35E0B1E; Tue, 6 Oct 2020 12:06:17 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 30525E0AFE for ; Tue, 6 Oct 2020 12:06:17 +0000 (UTC) From: Ulrich Mueller To: =?utf-8?B?TWljaGHFgiBHw7Nybnk=?= Cc: gentoo-dev@lists.gentoo.org Subject: Re: [gentoo-dev] [PATCH 1/5] verify-sig.eclass: New eclass to verify OpenPGP sigs In-Reply-To: <5f8518a3afdd6bbd114b70d1bbb6c2450c9f6024.camel@gentoo.org> (=?utf-8?Q?=22Micha=C5=82_G=C3=B3rny=22's?= message of "Tue, 06 Oct 2020 13:46:24 +0200") References: <20201006095814.101719-1-mgorny@gentoo.org> <2741984c8bec9f66649b3b6b8d8bd5aeb53095e3.camel@gentoo.org> <5f8518a3afdd6bbd114b70d1bbb6c2450c9f6024.camel@gentoo.org> Date: Tue, 06 Oct 2020 14:06:12 +0200 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1.50 (gnu/linux) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Archives-Salt: 9d7d4e44-d9e3-4475-a28e-48e322021a15 X-Archives-Hash: 15d543fab84306a75307292bc1ee4c96 >>>>> On Tue, 06 Oct 2020, Micha=C5=82 G=C3=B3rny wrote: > On Tue, 2020-10-06 at 13:34 +0200, Ulrich Mueller wrote: >> > > > > > On Tue, 06 Oct 2020, Micha=C5=82 G=C3=B3rny wrote: >> > On Tue, 2020-10-06 at 13:18 +0200, Ulrich Mueller wrote: >> > > > > > > > On Tue, 06 Oct 2020, Micha=C5=82 G=C3=B3rny wrote: >> > > > +IUSE=3D"+verify-sig" >> > >=20 >> > > At least don't enable this by default. The feature increases >> > > build time and has little (if any) benefits. >> > Do you have any numbers to back this claim? >>=20 >> That's a strange question. Obviously build time can only increase if >> you install an additional dependency and download an additional >> distfile. > But how significant is the increase? Can you actually measure it > without trying hard to make things slow? IMHO it has no benefit at all for users, because distfile integrity is already guaranteed by digests. So this is a second and redundant method. On the other hand, it causes download of additional distfiles which may not be wanted by most users. > If you are going to claim that it outweighs the 'little' benefit, you > need to try harder than that. No. You are the one who wants to introduce a new feature, so it's up to you to motivate why (and how) adding a redundant method of distfile verification would make things more secure on the users' side. It is one thing to have this as a convenience eclass for developers (though I still think it's over-engineered), but another thing to make it the default for all users. Ulrich