1 |
On Sun, Jul 5, 2015 at 3:33 AM, Alon Bar-Lev <alonbl@g.o> wrote: |
2 |
> On 4 July 2015 at 23:28, Alexandre Rostovtsev <tetromino@g.o> wrote: |
3 |
>> |
4 |
>> On Sun, 2015-07-05 at 02:16 +0700, C Bergström wrote: |
5 |
>> > 2) I don't understand your comment about signatures. |
6 |
>> |
7 |
>> Gpg commit signatures [1] which are a requirement for any gentoo git |
8 |
>> workflow. Rebasing breaks the author's signature afaict, so the user |
9 |
>> who is doing rebasing needs to re-sign the commit using his own key. |
10 |
>> |
11 |
>> [1] https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work#Signing-Commits |
12 |
>> |
13 |
> |
14 |
> Maybe this is the root cause of all issues, and simpler was to remain |
15 |
> with signed manifests. |
16 |
> Just a thought... Not every git feature out there should be actually |
17 |
> be leveraged. |
18 |
> Doing so would enable rebase without loosing data, more secure (than |
19 |
> SHA-1) signatures, using code review tools such as gerrit without an |
20 |
> issue, migration out of git in future and probably more. |
21 |
> |
22 |
|
23 |
Gpg commit signatures - lol... really? (sorry I realize this is a |
24 |
serious comment) |
25 |
---------- |
26 |
I'd agree that the point of security failure would probably be better |
27 |
at actually ensuring the content to the users is correct and valid. |
28 |
|
29 |
+1 for gerrit, but I realize that may be overkill |