Bug 703698 – repos.conf(5) setting "sync-git-verify-commit-signature" is dangerous

• Product: Portage Development
• Status: RESOLVED FIXED

[Description Aaron Jones 2019-12-25 05:24:44 UTC]

If one sets "sync-git-verify-commit-signature" to anything other than "true" or "false", its value is silently ignored and nothing is verified.

This seems both dangerous and counter-intuitive -- other boolean options, such as "auto-sync", also accept "yes" and "no" as values.

It should at least warn if an unsupported value is given, and ideally support "yes" and "no" as well.

[Comment 1 Zac Medico 2019-12-25 06:15:12 UTC]

Yeah, the code in portage/sync/modules/git/git.py looks like this:

> def verify_head(self, revision='-1'):
> 	if (self.repo.module_specific_options.get(
> 			'sync-git-verify-commit-signature', 'false') != 'true'):
> 		return True

[Comment 2 Zac Medico 2020-07-02 18:09:20 UTC]

We have a patch here:

https://archives.gentoo.org/gentoo-portage-dev/message/8e164de58c07618a1c492822797309bd

[Comment 3 Larry the Git Cow 2020-07-02 22:08:43 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/proj/portage.git/commit/?id=33b08baff4825bf84f639cf213de92ed36f76771

commit 33b08baff4825bf84f639cf213de92ed36f76771
Author:     Wynn Wolf Arbor <[e-mail]>
AuthorDate: 2020-07-02 15:50:18 +0000
Commit:     Zac Medico <[e-mail]>
CommitDate: 2020-07-02 21:39:39 +0000

    git: Verify boolean values passed to sync-git-verify-commit-signature
    
    Currently, if 'sync-git-verify-commit-signature' is set to anything
    other than 'yes', 'no', 'true', or 'false', its value is ignored
    silently and nothing is verified because the option defaults to 'false'.
    
    Introduce a check to CheckGitConfig that warns the user if their input
    is invalid.
    
    Bug: https://bugs.gentoo.org/703698
    Signed-off-by: Wynn Wolf Arbor <[e-mail]>
    Signed-off-by: Zac Medico <[e-mail]>

 lib/portage/sync/modules/git/__init__.py | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

[Comment 4 Larry the Git Cow 2020-07-19 05:45:28 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bb3180edb5d310d5382bb3c0772c06be0b354806

commit bb3180edb5d310d5382bb3c0772c06be0b354806
Author:     Zac Medico <[e-mail]>
AuthorDate: 2020-07-19 05:18:41 +0000
Commit:     Zac Medico <[e-mail]>
CommitDate: 2020-07-19 05:37:48 +0000

    sys-apps/portage: Bump to version 3.0.0
    
     #703698 Improve repos.conf handling of boolean settings
     #721516 ecompress complains about compressed files that have
             been excluded by docompress -x
     #729852 Set XTerm titles for konsole
     #731114 Drop support for python2.7
     #731246 man ebuild(5) has incorrect example of $P and $PN
     #732378 Use lru_cache for use_reduce, vercmp, and catpkgsplit
     #733154 List of ignored warnings in .desktop files should be
             updated for compatibility with >=desktop-file-utils-0.25
    
    Bug: https://bugs.gentoo.org/733180
    Bug: https://bugs.gentoo.org/703698
    Bug: https://bugs.gentoo.org/721516
    Bug: https://bugs.gentoo.org/729852
    Bug: https://bugs.gentoo.org/731114
    Bug: https://bugs.gentoo.org/731246
    Bug: https://bugs.gentoo.org/732378
    Bug: https://bugs.gentoo.org/733154
    Package-Manager: Portage-3.0.0, Repoman-2.3.23
    Signed-off-by: Zac Medico <[e-mail]>

 sys-apps/portage/Manifest             |   1 +
 sys-apps/portage/portage-3.0.0.ebuild | 263 ++++++++++++++++++++++++++++++++++
 2 files changed, 264 insertions(+)