Re: [gentoo-dev] Re: git security (SHA-1)

[Gordon Pettey]

On Sat, Sep 20, 2014 at 8:20 PM, Rich Freeman <rich0@g.o> wrote:
On Sat, Sep 20, 2014 at 8:58 PM, Gordon Pettey <petteyg359@×××××.com> wrote:
> You're following the wrong train down the wrong tracks. Git [0-9a-f]{40}
is
> to CVS 1[.][1-9][0-9]+. You're arguing that CVS is more secure because its
> commits are sequential numbers.

Ulrich is well-aware of that.  His argument is that with cvs there is
no security whatsoever in the scm, and so there is more interest in
layering security on-top.  With git there is more of a tendency to
rely on the less-than-robust commit signing system.

On Sat, Sep 20, 2014 at 9:17 PM, Peter Stuge <peter@×××××.se> wrote:

> Rich Freeman wrote:
> > > I've so far gotten zero feedback on my hosting offer, intended to
> > > help find some starting processes.
> >
> > hassufel's repository on github should be more than adequate:
> > https://github.com/gentoo/gentoo-gitmig
>
> The very first email in this thread pointed out that it is difficult
> to do anything custom on github, so I offered to help because I'm
> willing and able to help arrange hooks and scripting and whatever foo
> may be needed to move on.
>

I can set up something in New York and/or Germany if additional hosts are
needed.