From: Ulrich Drepper <drepper@redhat.com>
To: Richard Biener <richard.guenther@gmail.com>
Cc: Ulrich Drepper via Gcc <gcc@gcc.gnu.org>
Subject: Re: commit signing
Date: Wed, 14 Sep 2022 14:07:29 +0200 [thread overview]
Message-ID: <CAP3s5k9H5f68r96HyMb5Pk1-_5sCX42Cu1vjqCXMQQSmOeycpA@mail.gmail.com> (raw)
In-Reply-To: <CAFiYyc1r0JKh1VG_=YSuvzp2QWs+wsU_C6=4O79iwABOSxDx8Q@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 921 bytes --]
On Wed, Sep 14, 2022 at 1:31 PM Richard Biener <richard.guenther@gmail.com>
wrote:
> How does this improve supply chain security if the signing happens
> automagically rather than manually at points somebody actually
> did extra verification?
It works only automatically if you have ssh-agent (and/or gpg-agent)
running. I assume that's what developers do anyway because that's how they
like push changes to sourceware. If you don't have an agent you'll have to
provide the signature of the signing key at the time of the commit.
What's the extra space requirement if every commit is signed? I suspect
> the signatures themselves do not compress well.
>
The signatures are probably implemented as signed hashes of some sort. So,
perhaps an additional SHA256 block plus infrastructure to determine the key
used etc. I doubt that this is really measurable with today's disks and
servers and network connections.
next prev parent reply other threads:[~2022-09-14 12:07 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-14 9:11 Ulrich Drepper
2022-09-14 9:15 ` Jonathan Wakely
2022-09-14 11:31 ` Richard Biener
2022-09-14 12:07 ` Jakub Jelinek
2022-09-14 12:07 ` Ulrich Drepper [this message]
2022-09-28 17:03 ` Ulrich Drepper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAP3s5k9H5f68r96HyMb5Pk1-_5sCX42Cu1vjqCXMQQSmOeycpA@mail.gmail.com \
--to=drepper@redhat.com \
--cc=gcc@gcc.gnu.org \
--cc=richard.guenther@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).