From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id E5B9D3858280; Tue, 27 Sep 2022 11:45:57 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E5B9D3858280 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1664279157; bh=dTFi2DNa5/CmYCJ7kgHNp19Oivl5NaHaPxsRfTx4E+s=; h=From:To:Subject:Date:In-Reply-To:References:From; b=Tr4IVaq3hGT6tt/y3E4MhhpaZJeT2ed8uE9hnnYInEkjG/cPuf5XLrBfw2qWWsRAI Df3aqPJjhG+ygumLfD8js30haPfx8y7EYjURXqLDexC17LG+FCvte9Tr+K82RaoC5L PJjtgSgv6Bwc+BuSYVKxD5rHsfIxLVCCKFSOUpy0= From: "mark at klomp dot org" To: overseers@sourceware.org Subject: [Bug Infrastructure/29615] prototype & document SOP for signed-git-op repo Date: Tue, 27 Sep 2022 11:45:57 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: sourceware X-Bugzilla-Component: Infrastructure X-Bugzilla-Version: unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: mark at klomp dot org X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: overseers at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: cc Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://sourceware.org/bugzilla/show_bug.cgi?id=3D29615 Mark Wielaard changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mark at klomp dot org --- Comment #4 from Mark Wielaard --- It would be nice to go through the source integrity threats identified in https://slsa.dev/spec/v0.1/threats For a sourceware project that means checking section (A) "Submit unauthoriz= ed change" of: https://slsa.dev/spec/v0.1/threats#source-integrity-threats Almost all of those are policy issues, but it would be good to note where o= ur setup doesn't support adopting a specific policy change (if wanted, I think some of there policy changes are a bit heavy-handed, not everybody wants to= be SLSA4 compliant, but it would be nice to make sure that technically a proje= ct can choose to adopt them). --=20 You are receiving this mail because: You are the assignee for the bug.=