Re: Updated Sourceware infrastructure plans

["Frank Ch. Eigler" <fche@redhat.com>]

Hi -

> Would it be possible for gitsigur to support signing commits with ssh
> keys as well as gpg? Git supports this, and it's much easier for
> everybody than having to set up gpg. [...]

It would save some effort, but OTOH plenty of people have gpg keys
too, and the common desktop key agents support both.

> We already need an SSH key on sourceware.org to push to Git, so all
> those public keys could be treated as trusted (via git config
> gpg.ssh.allowedSignersFile). [...]

One difference is that gitsigur aims to prevent impersonation, by
tying the recorded committer to a designated set of keys for that
committer.  The git builtin ssh-signing gadget doesn't attempt this.
But maybe just a small matter of wrapping might do the job.

Filed https://sourceware.org/bugzilla/show_bug.cgi?id=31670 .

> I'm already signing my GCC commits that way, without needing to use
> gpg or gitsigur:

Great, keep it up!  Nothing has been stopping people from signing
their commits any way they like, including even more complex ways like
sigstore.  gitsigur verification is not enabled (even in permissive
mode) at all for gcc at this time.

> commit 7c2a9dbcc2c1cb1563774068c59d5e09edc59f06 [r14-10008-g7c2a9dbcc2c1cb]
> Good "git" signature for jwakely@redhat.com with RSA key
> SHA256:8rFaYhDWn09c3vjsYIg2JE9aSpcxzTnCqajoKevrUUo

Thanks, this will help test a prototype later on.

- FChE