| 1 |
On 07/08/2018 07:34 PM, Rich Freeman wrote: |
| 2 |
> The patch is to do the verification before |
| 3 |
> checking it out so that if it fails the tree is left in a |
| 4 |
> last-known-good state (at least as seen by tools at the filesystem |
| 5 |
> level - the fetched bad commits would still be visible to git). |
| 6 |
|
| 7 |
there is still a very different key management issue discussed. If a |
| 8 |
developers credentials are removed from Gentoo LDAP for some reason it |
| 9 |
will be stopped from pushing new commits immediately, but the third |
| 10 |
party verification can be valid up until that point and after since the |
| 11 |
developer might not have published a revocation certificate. |
| 12 |
|
| 13 |
the git sync method will need a way to distinguish this for end-users, |
| 14 |
but the proper rsync synchronization will be able to trust the data at |
| 15 |
the point we say it is OK. |
| 16 |
|
| 17 |
|
| 18 |
-- |
| 19 |
Kristian Fiskerstrand |
| 20 |
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net |
| 21 |
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3 |
Archives