Gentoo/Secured Portage Sync
Page last edited 3,640 days ago
From Alon Bar-Lev's Site
< Gentoo
Jump to navigation
Jump to search
Secured Portage Sync
By default, the standard portage sync command uses the unsecured rsync protocol by default.
emerge --sync
A man in the middle attack or rogue rsync mirror may alter the data and cause malformed packages to be installed.
One alternative is a secure sync using emerge-webrsync, which uses the HTTP protocol to retrieve a validated Portage tarball, signed by the Gentoo Foundation with a GPG key. It will test the tarball signature and timestamp to verify the tarball before it's installed on the system.
Installation
emerge app-arch/tarsync app-crypt/gnupg
mkdir /etc/portage/gnupg
chmod 0700 /etc/portage/gnupg
GNUPGHOME=/etc/portage/gnupg gpg --keyserver subkeys.pgp.net --recv-keys 0x96D8BF6D
GNUPGHOME=/etc/portage/gnupg gpg --fingerprint 0x96D8BF6D
Be sure to check the double check the fingerprint on the release engineering page.
Add:
File: /etc/portage/make.conf
PORTAGE_GPG_DIR="/etc/portage/gnupg" FEATURES="webrsync-gpg parallel-fetch userfetch userpriv usersandbox"
File: /etc/portage/repos.conf/gentoo.conf
[DEFAULT] main-repo = gentoo [gentoo] location = /var/gentoo/portage sync-type = websync
Sync
emerge --sync