Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 373301

Summary: Feature "severe" is not honored
Product: Portage Development Reporter: Dirk Tilger <dirk>
Component: Core - ConfigurationAssignee: Portage team <dev-portage>
Status: RESOLVED FIXED    
Severity: normal Keywords: InVCS
Priority: Normal    
Version: 2.1   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 373933    

Description Dirk Tilger 2011-06-28 09:02:20 UTC
I have set the "severe" FEATURE to get some protection against tampered rsync mirrors. However, not once could I not emerge a package for security reasons, although I'm using packages from all kind of overlays with non-signed Manifest's. I haven't knowingly trusted any keys so far.

Although I haven't set it explicitly, the "strict" FEATURE is active and bug 68906 points out there might be an issue then. However that bug is now 4 years old and I haven't found anything recent on the "severe" FEATURE.

Portage 2.1.9.42 (hardened/linux/amd64, gcc-4.4.5, unavailable, 2.6.38-hardened-r4 x86_64)
=================================================================
System uname: Linux-2.6.38-hardened-r4-x86_64-Intel-R-_Core-TM-2_Quad_CPU_Q8200_@_2.33GHz-with-gentoo-1.12.14
Timestamp of tree: Fri, 24 Jun 2011 15:30:01 +0000
distcc 3.1 x86_64-pc-linux-gnu [disabled]
app-shells/bash:     4.1_p9
dev-java/java-config: 2.1.11-r3
dev-lang/python:     2.4.6, 2.5.4-r2, 2.6.6-r2, 2.7.1-r1::<unknown repository>, 3.1.3-r1
dev-util/cmake:      2.8.4-r1
sys-apps/baselayout: 1.12.14-r1
sys-apps/sandbox:    2.4
sys-devel/autoconf:  2.13, 2.65-r1
sys-devel/automake:  1.7.9-r1, 1.8.5-r3, 1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils:  2.20.1-r1
sys-devel/gcc:       4.3.4, 4.4.5
sys-devel/gcc-config: 1.4.1-r1
sys-devel/libtool:   2.2.10
sys-devel/make:      3.81-r2
sys-kernel/linux-headers: 2.6.36.1
sys-libs/glibc:      2.12.2
virtual/os-headers:  2.6.36.1 (sys-kernel/linux-headers)
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="* -@EULA dlj-1.1 PUEL sun-bcla-java-vm AdobeFlash-10 AdobeFlash-10.1 googleearth"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=native"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/maven-bin-2.2/conf /usr/share/openvpn/easy-rsa /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php5.3/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -pipe -march=native"
DISTDIR="/home/portage/distfiles"
FEATURES="assume-digests binpkg-logs collision-protect distlocks fixlafiles fixpackages news parallel-fetch protect-owned sandbox severe sfperms sign strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync"
FFLAGS=""
GENTOO_MIRRORS="ftp://mirrors.linuxant.fr/distfiles.gentoo.org/ rsync://mirror.netcologne.de/gentoo/ http://91.121.124.139/gentoo-distfiles/ rsync://mirrors.evolva.ro/gentoo/gentoo-distfiles/ ftp://ftp.free.fr/mirrors/ftp.gentoo.org/"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="en ar it ru de"
MAKEOPTS="-j5"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/home/portage"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/home/dirk/Source/g-cpan /home/dirk/Source/apple-overlay /home/dirk/Source/intel-overlay /home/dirk/Source/locator-overlay /home/dirk/Source/g-pypi-overlay /home/dirk/src/magicdraw-overlay /home/dirk/src/ossim-overlay /usr/local/portage/layman/kde /usr/local/portage/layman/enlightenment /usr/local/portage/layman/pythonhead /usr/local/portage/layman/sunrise /usr/local/portage/layman/java-overlay /usr/local/portage/layman/dotnet /usr/local/portage/layman/dustin /usr/local/portage/layman/science /home/dirk/Source/Overlay"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X acl alsa amd64 avahi bash-completion berkdb bluetooth bzip2 cli cracklib crypt cups cxx dbus dri gdbm gnome gpm hardened iconv jpeg justify kde mmx modules mudflap multilib ncurses nptl nptlonly opengl openmp pam pcre perl png pppd python readline semantic-desktop session speex sse sse2 ssl svg sysfs tcpd truetype udev unicode urandom usb vim vim-syntax xfce xorg zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="braindump flow karbon kexi kpresenter krita tables words" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en ar it ru de" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="intel vesa" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 Zac Medico gentoo-dev 2011-06-28 09:25:07 UTC
It seems that FEATURES=severe is not implemented, so I've removed all references to it:

http://git.overlays.gentoo.org/gitweb/?p=proj/portage.git;a=commit;h=75a3815d904ca29584fd89b25017538631053c3b

Bug 64258 is about eclass signatures and verification.
Comment 2 Zac Medico gentoo-dev 2011-07-01 05:08:52 UTC
This is in 2.2.0_alpha42, but I'll leave this bug open until it's in an unmasked release.
Comment 3 Zac Medico gentoo-dev 2011-07-03 17:34:36 UTC
This is fixed in 2.1.10.4.