public inbox for
 help / color / mirror / Atom feed
From: "Frank Ch. Eigler" <>
To: "Ludovic Courtès" <>
Cc: "Frank Ch. Eigler" <>,
	Overseers mailing list <>,
	Mark Wielaard <>
Subject: Re: gitsigur for protecting git repo integrity
Date: Mon, 10 Jul 2023 18:05:52 -0400	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

Hi -

> >>   My understanding is that gitsigur checks signatures against an
> >>   out-of-band list of authorized keys, which isn’t very useful because
> >>   the set of authorized committers changes over time.
> >
> > The list of authorized keys is stored in a selected branch
> If it’s in another branch than the code it’s about, how can you tell
> whether a key was authorized at a given point in the commit history?

You're talking about retrospectively verifying old commit signatures,
rather than verifying eligilibity at the time of a push.  gitsigur at
uses the "current" contents of the keymaster repo/branch for the list
of public keys.  It could also look back in time, relying on that
repo's commit timeline, to inspect the time-varying mapping.  There is
enough information there, so it's a SMOP.

- FChE

  reply	other threads:[~2023-07-10 22:05 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-06-17  0:03 Frank Ch. Eigler
2023-06-18 23:03 ` Mark Wielaard
2023-06-19 20:20   ` Frank Ch. Eigler
2023-06-29 18:55 ` Frank Ch. Eigler
2023-07-04  8:32   ` Mark Wielaard
2023-07-05 18:25     ` Mark Wielaard
2023-07-05 20:01       ` Frank Ch. Eigler
2023-07-10 21:35         ` Ludovic Courtès
2023-07-10 22:05           ` Frank Ch. Eigler [this message]
2023-07-14 13:18             ` Ludovic Courtès
2023-07-14 14:00               ` Frank Ch. Eigler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).