On 11/15/2017 12:47 PM, R0b0t1 wrote: > On Wednesday, November 15, 2017, Michał Górny <mgo...@gentoo.org > <mailto:mgo...@gentoo.org>> wrote: >> Hi, everyone. >> >> The Council has approved the manifest-hashes switch on 2017-11-12 >> meeting [1]. The transition will occur to the initial plan, with small >> changes. The updated plan is included at the end of this mail. >> >> According to this plan, BLAKE2B will be enabled on 2017-11-21. This >> means that starting at this time, all new and updated DIST entries will >> use BLAKE2B+SHA512. Old DIST entries will still use the current hash set >> until updated. >> >> The developers are required to upgrade to a package manager supporting >> this hash. That is: >> >> a. Portage 2.3.5 when using py3.6+, >> >> b. Portage 2.3.13 + pyblake2 installed manually, >> >> c. Portage 2.3.13-r1 that includes the pyblake2 dep. >> >> Modern (and old) Portage will refuse to update Manifests if it does not >> support the necessary hashes. However, Portage versions between 2.3.5 >> and 2.3.13 inclusively will create Manifests missing BLAKE2B hash rather >> than failing when no hash provider is present. Those Manifests will be >> rejected by the git hook. >> >> Users will not be affected noticeably as the SHA512 hash continues being >> used for compatibility. >> >> >> That said, I'd like to request developers not to start proactively >> converting all old Manifest entries to the new set immediately, >> and instead give some time for things to settle down. >> >> >> >> The updated plan >> ================ >> >> Already done: >> >> - revbumped Portage with pyblake2 dep and started stabilizing it, >> >> - added git update hook to reject invalid Manifest entries. >> >> 2017-11-21 (T+7d): >> >> - manifest-hashes = BLAKE2B SHA512 >> >> 2018-02-14 (T+3m): >> >> - manifest-required-hashes = BLAKE2B >> >> 2018-05-14 (T+6m): >> >> - last rite fetch-restricted packages that do not use BLAKE2B. >> >> The final removal of SHA512 will be decided by the Council separately. >> > > Does the existence of a decision mean I would need to contact the > trustees if I feel the changes have not been adequately justified? > > Respectfully, > R0b0t1
No, if you think there is an issue with the Council decision, you should speak with the Council. Moreover... The Council is responsible for technical decisions within Gentoo. Unless it violates the Social Contract, I cannot see how the Trustees should be involved here. They have empowered the Council to make technical decisions as they see fit. -- NP-Hardass
signature.asc
Description: OpenPGP digital signature
