Gentoo/Secured Portage Sync

Page last edited 3,363 days ago
From Alon Bar-Lev's Site
Jump to navigation Jump to search

Secured Portage Sync

By default, the standard portage sync command uses the unsecured rsync protocol by default.

emerge --sync

A man in the middle attack or rogue rsync mirror may alter the data and cause malformed packages to be installed.

One alternative is a secure sync using emerge-webrsync, which uses the HTTP protocol to retrieve a validated Portage tarball, signed by the Gentoo Foundation with a GPG key. It will test the tarball signature and timestamp to verify the tarball before it's installed on the system.

Installation

emerge app-arch/tarsync app-crypt/gnupg
mkdir /etc/portage/gnupg
chmod 0700 /etc/portage/gnupg
GNUPGHOME=/etc/portage/gnupg gpg --keyserver subkeys.pgp.net --recv-keys 0x96D8BF6D
GNUPGHOME=/etc/portage/gnupg gpg --fingerprint 0x96D8BF6D

Be sure to check the double check the fingerprint on the release engineering page.

Add:

File: /etc/portage/make.conf
PORTAGE_GPG_DIR="/etc/portage/gnupg"
FEATURES="webrsync-gpg parallel-fetch userfetch userpriv usersandbox"
File: /etc/portage/repos.conf/gentoo.conf
[DEFAULT]
main-repo = gentoo

[gentoo]
location = /var/gentoo/portage
sync-type = websync

Sync

emerge --sync

References