Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Gentoo install not using package signatures ?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
el muchacho
Tux's lil' helper
Tux's lil' helper


Joined: 26 Mar 2015
Posts: 77

PostPosted: Tue Mar 31, 2015 3:29 pm    Post subject: Gentoo install not using package signatures ? Reply with quote

As far as I can tell, checking the package's integrity is not done through the installation of Gentoo. I can't see that we add the "FEATURES" options to make.conf nor have the public key to check that packages were signed.

Is it really the case or I am missing something ?

Code:
File: /etc/portage/make.conf

PORTAGE_GPG_DIR="/etc/portage/gnupg"
FEATURES="webrsync-gpg parallel-fetch userfetch userpriv usersandbox"
Back to top
View user's profile Send private message
Apheus
Guru
Guru


Joined: 12 Jul 2008
Posts: 419

PostPosted: Tue Mar 31, 2015 3:43 pm    Post subject: Reply with quote

If you want complete checking, use webrsync with webrsync-gpg feature. The snapshot is signed with a key in Gentoo's control, and contains the manifest files with checksums. Portage checks downloads and distfiles with these checksums whenever something is fetched or unpacked.

Pulling validated snapshots
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum