Gentoo Archives: gentoo-dev

From: Kent Fredric <kentfredric@×××××.com>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] git security (SHA-1)
Date: Tue, 16 Sep 2014 14:33:34
Message-Id: CAATnKFAtr_33LsODLn32EG6GjbOF1RV_D+1mqYYsxNpx7nuKKQ@mail.gmail.com
In Reply to: Re: [gentoo-dev] git security (SHA-1) by Ian Stakenvicius
1 On 17 September 2014 01:44, Ian Stakenvicius <axs@g.o> wrote:
2
3 > bottom of the comment a clearsign on the contents of the commit?
4 >
5
6
7 I don't see that being useful as written, because that's presently exactly
8 what git does.
9
10 the very best I think you could do is sign the commit *diff*, ie:
11 recursively compare TREE and PARENT->TREE and feed only *new* objects
12 through GPG. That's the most meaningful thing you'll get. ( And it really
13 is up-streams responsibility to implement this feature if they care,
14 bolting it on after the fact is horrible )
15
16 --
17 Kent
18
19 *KENTNL* - https://metacpan.org/author/KENTNL

Replies

Subject Author
Re: [gentoo-dev] git security (SHA-1) Ian Stakenvicius <axs@g.o>