Re: [gentoo-project] ChangeLog generation - continued discussions

[Robin H. Johnson]

On Wed, Sep 07, 2011 at 08:38:06PM +0200, Fabian Groffen wrote:
> On 24-08-2011 09:20:00 +0000, Robin H. Johnson wrote:
> > Commit signing has a few implications/side-effects:
> > - commits are signed so Manifests are NOT signed anymore.
> What are you referring to when you mention "commit signing"?  The
> commit signing and verification capabilties of CVS?
The present discussion of signing git commits as has been on the -scm
list for more than a year now (most notably starting after last year's
GSoC Mentor summit, where we had a chance to discuss it with some of the
Git authors).

> I've done some googling, and basically nothing showed up for git, apart
> from hacky script solutions like [1].
That's along the same lines as proposed on the -scm list, but quite a
lot messier: 
- it's not clear if he's signing the correct portions of the commit.
- We're going to be storing the (detached) signatures as git notes, not
  in the commit message body.

Most recently, see my responses to alexxy on that list, describing a
pre-image attack against the git commit signing as implemented by RSBAC.
Their scripts are nice, but their actual choice of what to sign is
wrong.

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Trustee & Infrastructure Lead
E-Mail     : robbat2@g.o
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85