From: kuzetsa <kuzetsa@gmail.com>
To: gentoo-project@lists.gentoo.org
Subject: Re: [gentoo-project] Repo mirror & CI: official statement wrt GitHub
Date: Fri, 15 Jun 2018 10:55:28 -0400 [thread overview]
Message-ID: <36a4e0e2-c9b5-7058-6c16-a326bbd73d36@gmail.com> (raw)
In-Reply-To: <dd5053ac-1042-d83a-fb39-eba31ba6b696@gentoo.org>
On 06/15/2018 07:50 AM, Thomas Deutschmann wrote:
> On 2018-06-15 04:27, kuzetsa wrote:
>> I think I understand that viewpoint, but there's nuance:
>>
>> (it matters "more than zero", as you claimed)
>>
>> if proxy-maintainers or other contributors have no
>> assurance that they aren't being impersonated, then
>> a person in bad faith could spoof a submission.
{...}
> We can only rely on our own key management. If an attacker is able to
> manipulate Gentoo LDAP (our single point of truth),
{...}
{...} /// proxy maintainer's signature will never appear in
> Gentoo repository (it is always the developer's signature which will
> replace the proxy maintainer's signature), there's no need to do
> something like that at the moment because we have nothing to verify.
{...}
> - For Gentoo developers it is important to understand that you are
> reliable for anything signed by your key. So it doesn't really matter if
> the PR was spoofed or not. /// {...}
I'm aware of this, and it's part of what I'm troubled by:
the act of throwing away signatures from contributors is
a thing which I had considered mentioning in a different
context: ["Would you sign a Contributor License Agreement?"]
"Gentoo Developer's Certificate of Origin" - shouldn't
the author / contributor themselves be involved in this?
contributor keys /do/ matter, at least until the point
where a commit is in the tree (with signature replaced)
at some point, the contributor exercises their judgment
in saying to themselves: "yes, this matches what I wrote",
and will then reconcile their local git tree with the
official (developer-signed) one.
^ meta-stuff for non-developer contributions ::sigh::
- for the original thing I was trying to say:
the analogy could be made where an employer insists that
all wages are issued to a preloaded debit card, rather
than a bank transfer or paycheck which gets handled by
the financial institution designated by each employee.
while possible that banks could do something malicious,
/not/ having a bank would increase the counterparty risk
for employees; separation of duties might be an apt term?
involving a 3rd party means the option is available to spot
any discrepancies between activity / commits in the gentoo
tree, versus the tree (on github, or any other 3rd party)
which a contributor has made transparent / visible.
-- kuza
next prev parent reply other threads:[~2018-06-15 14:55 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-09 7:25 [gentoo-project] Repo mirror & CI: official statement wrt GitHub Michał Górny
2018-06-09 7:50 ` Ulrich Mueller
2018-06-09 7:52 ` Michał Górny
2018-06-09 9:11 ` Thomas Deutschmann
2018-06-11 12:15 ` Kristian Fiskerstrand
2018-06-11 13:28 ` Rich Freeman
2018-06-14 9:47 ` James Le Cuirot
2018-06-14 14:14 ` Alec Warner
2018-06-14 14:25 ` Mauricio Lima Pilla
2018-06-15 0:33 ` Thomas Deutschmann
2018-06-15 1:14 ` Aaron W. Swenson
2018-06-15 2:16 ` Alec Warner
2018-06-15 7:20 ` Kristian Fiskerstrand
2018-06-16 23:55 ` Virgil Dupras
2018-06-17 0:25 ` Rich Freeman
2018-06-16 21:58 ` Andreas K. Huettel
2018-06-16 23:14 ` Rich Freeman
2018-06-16 23:45 ` Alec Warner
2018-06-17 1:05 ` Brian Dolbec
2018-06-14 19:55 ` kuzetsa
2018-06-15 0:26 ` Thomas Deutschmann
2018-06-15 2:27 ` kuzetsa
2018-06-15 11:50 ` Thomas Deutschmann
2018-06-15 14:55 ` kuzetsa [this message]
2018-06-15 15:31 ` Rich Freeman
2018-06-15 16:03 ` kuzetsa
2018-06-15 16:11 ` Rich Freeman
2018-06-15 16:22 ` kuzetsa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=36a4e0e2-c9b5-7058-6c16-a326bbd73d36@gmail.com \
--to=kuzetsa@gmail.com \
--cc=gentoo-project@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox