Hacker News Reader

Comment by hannob | Hacker News Reader

As a long time gentoo dev I am happy that this gets more attention. Although this is an open secret and completely obvious. Gentoo's rsync-based system was always insecure. There have been multiple attempts to implement some kind of package signing, but it never made it to deployment.

A workaround right now is to use git-based sync over https. You can sync from https://github.com/gentoo-mirror/gentoo which is a copy of the portage tree with pregenerated metadata.

View on HN

Who is it run by? It's not under https://github.com/gentoo and the gentoo-mirror org doesn't have any "public members" ... I'd be more concerned with trusting this, than my ISP or OSU OSL MITM-ing me.

That aside, wouldn't it make sense to have the generated metadata in a separate repository? Sync the latest metadata, then check out the corresponding revision from the actual gentoo git repo.

The official source for git-over-https is: https://anongit.gentoo.org/git/repo/gentoo.git

Unlike rsync/webrsync/above repo, it doesn't have pre-generated metadata, which makes things painful

It's dangerous to recommend that instead of the github mirror because the gentoo.org git server is not made to scale to the number of users of gentoo.

That's the whole reason the rsync infrastructure exists in the first place.

Hehe. I discovered this after our last discussion on HN, so really it's your doing. If you have handbook edit rights fixing that would be a good temporary measure... I've made some suggestions for revision: https://wiki.gentoo.org/wiki/Handbook_Talk:AMD64/Installatio...

I don't think the github-solution will make it into the official handbook. People want to have everything on Gentoo-owned infrastructure, which I can understand.

I think the github thing is just a python GPG wrapper library that gkeys uses (and was written for that purpose), whereas the gkeys tool itself is already on Gentoo-owned infrastructure.

Calculate Linux, a Gentoo-variant, already syncs over git, and is therefore immune to this issue.

I don't know Calculate Linux, but this indicates that they use the git://-protocol: http://www.calculate-linux.ru/blogs/en/320/show

That is just as insecure as rsync. You need to use https in order to protect data. (Appart from that it seems calculate linux doesn't even have a webpage over https...)

Funtoo as well, but the issue is that (at least for Funtoo), upstream that feeds the git has to be untampered with as well, which in this case is (you guessed it) Gentoo.

Reply on news.ycombinator.com