Re: [gentoo-user] Re: All sorts of digest verification failures

[Neil Bothwick]

On Mon, 16 Nov 2015 03:48:52 -0600, Dale wrote:

> > According to https://bugs.gentoo.org/show_bug.cgi?id=565694 it has
> > been fixed, I synced too early this morning to pick that up.

> I synced again just a hour or two ago and I must have missed it too.  It
> spit out the same error as before.  I'll try again in a couple days. 
> Maybe things will have settled by then.  Maybe.  ;-)

I was a little too quick off the mark there, but I have just synced again
and it finally works.


-- 
Neil Bothwick

Q: What's the proper plural of a 'Net-connected Windows machine?
A: A Botnet


pgppgvoxbQll9.pgp
Description: OpenPGP digital signature

[gentoo-user] Re: All sorts of digest verification failures

[Martin Vaeth]

cov...@ccs.covici.com  wrote:
>
> I have thinmanifests=true as specified in some news item or post, I
> think this was a mandatory change some time ago using rsync.

If you really use rsync/webrsync and not git, this is unlikely:
The file containing this line (metadata/layout.conf) should be
overridden at every rsync (unless you took special measures,
but this was certainly never recommended).

> They figured the ebuilds sync anyway so no reason for the
> manifests to have them.

It is not about syncing but about security (checksums with
signatures should safe you from MITM and even compromised
servers). Thin-manifests was only meant for git, because git
already contains checksums ('though only less secure sha1,
but that's a different story), so it was decided that no
duplicate checksums are needed for git.
For *rsync* the situation is different.

Re: [gentoo-user] Problems while updateing screen (tool not monitor)

[Meino . Cramer]

Zhu Sha Zang  [15-11-16 17:00]:
> You can't. Please report a bug correctly: bugs.gentoo.org.
> 
> Regards
> 
> On Mon, 16 Nov 2015 04:13:54 +0100
> meino.cra...@gmx.de wrote:
> 
> > Stroller  [15-11-16 03:24]:
> > >   
> > > > On Sun, 15 November 2015, at 4:33 a.m., meino.cra...@gmx.de wrote:
> > > > 
> > > > screen refuses update due to an compilation error:
> > > > 
> > > > ...
> > > > Is a fix for that known?  
> > > 
> > > The fix is app-misc/tmux
> > > 
> > > ;)
> > > 
> > >   
> > 
> > Sorry, not in my case.
> > 
> > How can I make screen make compile successfully?
> > 
> > 
> > 
> 

Seems already been reported, but not officially fixed:
Bug 559746 - app-misc/screen-4.3.1 with >=sys-apps/texinfo-5.2 - 
./screen.texinfo:3150: `@end' expected `deffn', but saw `example'

...I think, I have to wait longer...

Best
Meino

Re: [gentoo-user] Re: All sorts of digest verification failures

[Marc Joliet]

On Monday 16 November 2015 17:21:07 Martin Vaeth wrote:
>cov...@ccs.covici.com  wrote:
>> I have thinmanifests=true as specified in some news item or post, I
>> think this was a mandatory change some time ago using rsync.
>
>If you really use rsync/webrsync and not git, this is unlikely:
>The file containing this line (metadata/layout.conf) should be
>overridden at every rsync (unless you took special measures,
>but this was certainly never recommended).
>
>> They figured the ebuilds sync anyway so no reason for the
>> manifests to have them.
>
>It is not about syncing but about security (checksums with
>signatures should safe you from MITM and even compromised
>servers). Thin-manifests was only meant for git, because git
>already contains checksums ('though only less secure sha1,
>but that's a different story), so it was decided that no
>duplicate checksums are needed for git.
>For *rsync* the situation is different.

Don't forget that in Gentoo all commits are also GPG signed.

-- 
Marc Joliet
--
"People who think they know everything really annoy those of us who know we
don't" - Bjarne Stroustrup


signature.asc
Description: This is a digitally signed message part.

Re: [gentoo-user] Re: All sorts of digest verification failures

[Rich Freeman]

On Mon, Nov 16, 2015 at 4:49 PM, Marc Joliet  wrote:
>
> Don't forget that in Gentoo all commits are also GPG signed.
>

Sure, but to be fair those signatures are only bound to the content of
the commit by an sha1 hash.

-- 
Rich

Re: [gentoo-user] Re: All sorts of digest verification failures

[Dale]

Grant Edwards wrote:
> On 2015-11-15, Dale  wrote:
>
>> Wasn't there a emerge option to ignore the manifest?  I seem to recall
>> there used to be one but it was a LONG time ago.  Of course, if someone
>> has tinkered with something that would be a bad thing to do.
> If the digest failures are for packages you don't have installed, just
> removing the entire directory for each of the broken manifests is one
> temporary work-around.
>


Thing is, one of the ones that fails is a package that I have
installed.  That would be busybox and I think that is likely on
everyone's system so this would affect every Gentoo system out there.  I
think I read on -dev somewhere a while back that busybox ended up being
pulled in as part of the @system profile/set. 

Anyway, I figure they will have a fix before to long.  I just find it
hard to believe that with all the planning that was put into this, the
changelogs and these issues were missed.  It's not like they decided to
change this over a short time frame.  They been working on this for
ages.  Live and learn I guess.  ;-)

Dale

:-)  :-) 

Re: [gentoo-user] Re: All sorts of digest verification failures

[Dale]

Neil Bothwick wrote:
> On Sun, 15 Nov 2015 17:39:29 -0800, walt wrote:
>
>
>> I hope the gentoo devs will fix this bug before you have a chance to
>> test my advice :)
> According to https://bugs.gentoo.org/show_bug.cgi?id=565694 it has been
> fixed, I synced too early this morning to pick that up.
>
>


I synced again just a hour or two ago and I must have missed it too.  It
spit out the same error as before.  I'll try again in a couple days. 
Maybe things will have settled by then.  Maybe.  ;-)

Dale

:-)  :-) 

Re: [gentoo-user] Re: All sorts of digest verification failures

[Neil Bothwick]

On Sun, 15 Nov 2015 17:39:29 -0800, walt wrote:

> > I have the same wrong size recorded in the Manifest!
> > No idea why portage didn't yell at me - there seems
> > to be another bug involved...  
> 
> I did the same thing today (15 Nov) and it succeeded.
> 
> However, I ran the ebuild command on a non-broken ebuild.  Try
> repeating the same command on busybox 1.23.x or 1.24.x

Do you mean ebuild manifest? It doesn't matter which ebuild you run that
on, it creates a manifest for all ebuilds and files in the firsctory.

> I hope the gentoo devs will fix this bug before you have a chance to
> test my advice :)

According to https://bugs.gentoo.org/show_bug.cgi?id=565694 it has been
fixed, I synced too early this morning to pick that up.


-- 
Neil Bothwick

Be regular. Eat cron flakes.


pgpiPWRjH234O.pgp
Description: OpenPGP digital signature

Re: [gentoo-user] Problems while updateing screen (tool not monitor)

[Zhu Sha Zang]

You can't. Please report a bug correctly: bugs.gentoo.org.

Regards

On Mon, 16 Nov 2015 04:13:54 +0100
meino.cra...@gmx.de wrote:

> Stroller  [15-11-16 03:24]:
> >   
> > > On Sun, 15 November 2015, at 4:33 a.m., meino.cra...@gmx.de wrote:
> > > 
> > > screen refuses update due to an compilation error:
> > > 
> > > ...
> > > Is a fix for that known?  
> > 
> > The fix is app-misc/tmux
> > 
> > ;)
> > 
> >   
> 
> Sorry, not in my case.
> 
> How can I make screen make compile successfully?
> 
> 
> 

Re: [gentoo-user] Re: All sorts of digest verification failures

[Marc Joliet]

On Monday 16 November 2015 17:32:56 Rich Freeman wrote:
>On Mon, Nov 16, 2015 at 4:49 PM, Marc Joliet  wrote:
>> Don't forget that in Gentoo all commits are also GPG signed.
>
>Sure, but to be fair those signatures are only bound to the content of
>the commit by an sha1 hash.

Ah! Thanks, I didn't know that.

-- 
Marc Joliet
--
"People who think they know everything really annoy those of us who know we
don't" - Bjarne Stroustrup


signature.asc
Description: This is a digitally signed message part.