Re: [gentoo-project] Repo mirror & CI: official statement wrt GitHub

[kuzetsa]

On 06/15/2018 07:50 AM, Thomas Deutschmann wrote:
> On 2018-06-15 04:27, kuzetsa wrote:
>> I think I understand that viewpoint, but there's nuance:
>>
>> (it matters "more than zero", as you claimed)
>>
>> if proxy-maintainers or other contributors have no
>> assurance that they aren't being impersonated, then
>> a person in bad faith could spoof a submission.

{...}

> We can only rely on our own key management. If an attacker is able to
> manipulate Gentoo LDAP (our single point of truth),

{...}

{...} /// proxy maintainer's signature will never appear in
> Gentoo repository (it is always the developer's signature which will
> replace the proxy maintainer's signature), there's no need to do
> something like that at the moment because we have nothing to verify.

{...}

> - For Gentoo developers it is important to understand that you are
> reliable for anything signed by your key. So it doesn't really matter if
> the PR was spoofed or not. /// {...}
I'm aware of this, and it's part of what I'm troubled by:

the act of throwing away signatures from contributors is
a thing which I had considered mentioning in a different
context: ["Would you sign a Contributor License Agreement?"]

"Gentoo Developer's Certificate of Origin" - shouldn't
the author / contributor themselves be involved in this?

contributor keys /do/ matter, at least until the point
where a commit is in the tree (with signature replaced)

at some point, the contributor exercises their judgment
in saying to themselves: "yes, this matches what I wrote",
and will then reconcile their local git tree with the
official (developer-signed) one.

^ meta-stuff for non-developer contributions ::sigh::

- for the original thing I was trying to say:

the analogy could be made where an employer insists that
all wages are issued to a preloaded debit card, rather
than a bank transfer or paycheck which gets handled by
the financial institution designated by each employee.

while possible that banks could do something malicious,
/not/ having a bank would increase the counterparty risk
for employees; separation of duties might be an apt term?

involving a 3rd party means the option is available to spot
any discrepancies between activity / commits in the gentoo
tree, versus the tree (on github, or any other 3rd party)
which a contributor has made transparent / visible.

-- kuza