Gentoo Archives: gentoo-dev

From: Alec Warner <antarus@g.o>
To: Gentoo Dev <gentoo-dev@l.g.o>, gentoo-dev-announce@l.g.o
Subject: Re: [gentoo-dev] Signed push & clock drift rejection
Date: Tue, 19 Jul 2016 20:22:48
Message-Id: CAAr7Pr9dBiC1_feuqOdHt5AfUXRTPD+t-POzQVk6Euy5zPd60w@mail.gmail.com
In Reply to: Re: [gentoo-dev] Signed push & clock drift rejection by Consus
1 On Tue, Jul 19, 2016 at 4:31 AM, Consus <consus@×××.com> wrote:
2
3 > On 18:03 Fri 15 Jul, Robin H. Johnson wrote:
4 > > Hi all,
5 > >
6 > > In tracing down problems with the git->rsync path, it has been noticed
7 > > that some developers have significant clock drift on their local systems
8 > > (up to one case of 14 days wrong), and it's potentially contributing to
9 > > problems in generating the rsync tree.
10 > >
11 > > I have implemented a check as part of the hook that validates Git push
12 > > certificates (require-signed-push). It looks for clock drift or an
13 > > overly long push, and aborts if needed.
14 > >
15 > > The tolerances are presently set to:
16 > > - 5 seconds of clock drift.
17 > > - 'git push' must be completed in 60 seconds.
18 >
19 > AFAIR Windows AD servers allow 5 minutes clock drift. How about at least
20 > a minute or so?
21 >
22 >
23 I would also argue for 5 minutes.
24
25 -A