4 ms·

As a long time gentoo dev I am happy that this gets more attention. Although this is an open secret and completely obvious. Gentoo's rsync-based system was alwa

by hannob 10y ago

As a long time gentoo dev I am happy that this gets more attention. Although this is an open secret and completely obvious. Gentoo's rsync-based system was always insecure. There have been multiple attempts to implement some kind of package signing, but it never made it to deployment. A workaround right now is to use git-based sync over https. You can sync from https://github.com/gentoo-mirror/gentoo https://github.com/gentoo-mirror/gentoo which is a copy of the portage tree with pregenerated metadata.

contingencies 10y ago
Hehe. I discovered this after our last discussion on HN, so really it's your doing. If you have handbook edit rights fixing that would be a good temporary measure... I've made some suggestions for revision: https://wiki.gentoo.org/wiki/Handbook_Talk:AMD64/Installation/Stage#Portage_and_stage3_security_recommendations https://wiki.gentoo.org/wiki/Handbook_Talk:AMD64/Installatio...
- hannob 10y ago
  I don't think the github-solution will make it into the official handbook. People want to have everything on Gentoo-owned infrastructure, which I can understand.
  - contingencies 10y ago
    I think the github thing is just a python GPG wrapper library that gkeys uses (and was written for that purpose), whereas the gkeys tool itself is already on Gentoo-owned infrastructure.
cheiVia0 10y ago
Who is it run by? It's not under https://github.com/gentoo https://github.com/gentoo and the gentoo-mirror org doesn't have any "public members" ... I'd be more concerned with trusting this, than my ISP or OSU OSL MITM-ing me. That aside, wouldn't it make sense to have the generated metadata in a separate repository? Sync the latest metadata, then check out the corresponding revision from the actual gentoo git repo.
zx2c4 10y ago
The official source for git-over-https is: https://anongit.gentoo.org/git/repo/gentoo.git https://anongit.gentoo.org/git/repo/gentoo.git
- cheiVia0 10y ago
  Unlike rsync/webrsync/above repo, it doesn't have pre-generated metadata, which makes things painful
- TheDong 10y ago
  It's dangerous to recommend that instead of the github mirror because the gentoo.org git server is not made to scale to the number of users of gentoo. That's the whole reason the rsync infrastructure exists in the first place.
anonbanker 10y ago
Calculate Linux, a Gentoo-variant, already syncs over git, and is therefore immune to this issue.
- jamiesonbecker 10y ago
  Funtoo as well, but the issue is that (at least for Funtoo), upstream that feeds the git has to be untampered with as well, which in this case is (you guessed it) Gentoo.
- hannob 10y ago
  I don't know Calculate Linux, but this indicates that they use the git://-protocol: http://www.calculate-linux.ru/blogs/en/320/show http://www.calculate-linux.ru/blogs/en/320/show That is just as insecure as rsync. You need to use https in order to protect data. (Appart from that it seems calculate linux doesn't even have a webpage over https...)

by hannob 10y ago

contingencies 10y ago

Hehe. I discovered this after our last discussion on HN, so really it's your doing. If you have handbook edit rights fixing that would be a good temporary measure... I've made some suggestions for revision: https://wiki.gentoo.org/wiki/Handbook_Talk:AMD64/Installation/Stage#Portage_and_stage3_security_recommendations https://wiki.gentoo.org/wiki/Handbook_Talk:AMD64/Installatio...

hannob 10y ago
I don't think the github-solution will make it into the official handbook. People want to have everything on Gentoo-owned infrastructure, which I can understand.
- contingencies 10y ago
  I think the github thing is just a python GPG wrapper library that gkeys uses (and was written for that purpose), whereas the gkeys tool itself is already on Gentoo-owned infrastructure.

cheiVia0 10y ago

Who is it run by? It's not under https://github.com/gentoo https://github.com/gentoo and the gentoo-mirror org doesn't have any "public members" ... I'd be more concerned with trusting this, than my ISP or OSU OSL MITM-ing me. That aside, wouldn't it make sense to have the generated metadata in a separate repository? Sync the latest metadata, then check out the corresponding revision from the actual gentoo git repo.

zx2c4 10y ago

The official source for git-over-https is: https://anongit.gentoo.org/git/repo/gentoo.git https://anongit.gentoo.org/git/repo/gentoo.git

cheiVia0 10y ago
Unlike rsync/webrsync/above repo, it doesn't have pre-generated metadata, which makes things painful
TheDong 10y ago
It's dangerous to recommend that instead of the github mirror because the gentoo.org git server is not made to scale to the number of users of gentoo. That's the whole reason the rsync infrastructure exists in the first place.

anonbanker 10y ago

Calculate Linux, a Gentoo-variant, already syncs over git, and is therefore immune to this issue.

jamiesonbecker 10y ago
Funtoo as well, but the issue is that (at least for Funtoo), upstream that feeds the git has to be untampered with as well, which in this case is (you guessed it) Gentoo.
hannob 10y ago
I don't know Calculate Linux, but this indicates that they use the git://-protocol: http://www.calculate-linux.ru/blogs/en/320/show http://www.calculate-linux.ru/blogs/en/320/show That is just as insecure as rsync. You need to use https in order to protect data. (Appart from that it seems calculate linux doesn't even have a webpage over https...)