From: Ulrich Drepper <drepper@redhat.com>
To: Richard Biener <richard.guenther@gmail.com>
Cc: Ulrich Drepper via Gcc <gcc@gcc.gnu.org>
Subject: Re: commit signing
Date: Wed, 28 Sep 2022 19:03:17 +0200 [thread overview]
Message-ID: <CAP3s5k-HygxYwOVbkRj36oByw1SyoT7J3MAttHoOdB91ggZ-DQ@mail.gmail.com> (raw)
In-Reply-To: <CAP3s5k9H5f68r96HyMb5Pk1-_5sCX42Cu1vjqCXMQQSmOeycpA@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1065 bytes --]
On Wed, Sep 14, 2022 at 2:07 PM Ulrich Drepper <drepper@redhat.com> wrote:
> On Wed, Sep 14, 2022 at 1:31 PM Richard Biener <richard.guenther@gmail.com>
> wrote:
>
>> How does this improve supply chain security if the signing happens
>> automagically rather than manually at points somebody actually
>> did extra verification?
>
>
> It works only automatically if you have ssh-agent (and/or gpg-agent)
> running. I assume that's what developers do anyway because that's how they
> like push changes to sourceware. If you don't have an agent you'll have to
> provide the signature of the signing key at the time of the commit.
>
This was the last message I sent and no further questions or comments
arrived.
Shall I prepare a small patch with an initial version of the key files
(with my key), perhaps a patch to the setup script Jonathan mentioned, and
a few words to be added to a README or similar file (which?)?
Initially this could be optional and we could gather data on the pickup and
only after an initial period switch to make the signing mandatory.
prev parent reply other threads:[~2022-09-28 17:03 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-14 9:11 Ulrich Drepper
2022-09-14 9:15 ` Jonathan Wakely
2022-09-14 11:31 ` Richard Biener
2022-09-14 12:07 ` Jakub Jelinek
2022-09-14 12:07 ` Ulrich Drepper
2022-09-28 17:03 ` Ulrich Drepper [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAP3s5k-HygxYwOVbkRj36oByw1SyoT7J3MAttHoOdB91ggZ-DQ@mail.gmail.com \
--to=drepper@redhat.com \
--cc=gcc@gcc.gnu.org \
--cc=richard.guenther@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).