#22883 - Trustable "guix pull" - GNU bug report logs

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #16 received at 22883@debbugs.gnu.org (full text, mbox, reply):

Received: (at 22883) by debbugs.gnu.org; 25 Apr 2016 22:25:29 +0000
From debbugs-submit-bounces@debbugs.gnu.org Mon Apr 25 18:25:29 2016
Received: from localhost ([127.0.0.1]:46987 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1auowb-0003pM-10
	for submit@debbugs.gnu.org; Mon, 25 Apr 2016 18:25:29 -0400
Received: from eggs.gnu.org ([208.118.235.92]:39639)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@gnu.org>) id 1auowZ-0003p7-HG
 for 22883@debbugs.gnu.org; Mon, 25 Apr 2016 18:25:27 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <ludo@gnu.org>) id 1auowQ-0005iZ-F0
 for 22883@debbugs.gnu.org; Mon, 25 Apr 2016 18:25:22 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_20,RP_MATCHES_RCVD
 autolearn=disabled version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:33651)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <ludo@gnu.org>)
 id 1auowQ-0005iV-CQ; Mon, 25 Apr 2016 18:25:18 -0400
Received: from reverse-83.fdn.fr ([80.67.176.83]:57924 helo=pluto)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128)
 (Exim 4.82) (envelope-from <ludo@gnu.org>)
 id 1auowP-0007mx-Jr; Mon, 25 Apr 2016 18:25:18 -0400
From: ludo@gnu.org (Ludovic Courtès)
To: Christopher Allan Webber <cwebber@dustycloud.org>
Subject: Re: bug#22883: Trustable "guix pull"
References: <87io14sqoa.fsf@dustycloud.org>
Date: Tue, 26 Apr 2016 00:25:11 +0200
In-Reply-To: <87io14sqoa.fsf@dustycloud.org> (Christopher Allan Webber's
 message of "Wed, 02 Mar 2016 10:03:59 -0800")
Message-ID: <87h9ep8gxk.fsf@gnu.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha256; protocol="application/pgp-signature"
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -4.4 (----)
X-Debbugs-Envelope-To: 22883
Cc: 22883@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -4.4 (----)

[Message part 1 (text/plain, inline)]

Hello!

Christopher Allan Webber <cwebber@dustycloud.org> skribis:

> On top of that, even if you run from git proper what there isn't a test
> about is: can you trust those latest commits?  Git doesn't really check,
> at least by default.
>
>   https://mikegerwitz.com/papers/git-horror-story
>
> How about this: anyone with commit access should use "signed off by" and
> gpg signatures combined.  We should keep some list of guix committers'
> gpg keys.  No commit should be pushed to guix without a gpg signature.
> At this point, at least, there is some possibility of auditing things.

To make progress on this front, I’ve decided to start signing all my
commits, so:

--8<---------------cut here---------------start------------->8---
$ git config commit.gpgsign
true
$ git config --global user.signingkey
090B11993D9AEBB5
--8<---------------cut here---------------end--------------->8---

I invite everyone to do the same.  Hopefully, within a few weeks, we can
add a commit hook to reject unsigned commits.

Note that we’ll be signing patches we push on behalf of contributors who
do not have commit access (reviewer’s responsibility).

Also, rebasing, amending, and cherry-picking code signed by someone else
would lose the original signature, which isn’t great and should be
avoided, if possible.

What remains to be seen, among other things, is how we’ll maintain a
keyring of the committers, and how we’ll distribute it to users of ‘guix
pull’; the TUF spec has clever ideas about it, but we need to see how
they map to our setup.

Thoughts?

Ludo’.

[signature.asc (application/pgp-signature, inline)]

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:17:32 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#22883 Trustable "guix pull"