5 ms·

Linus (from 2009) on problems with signing every commit: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-tp2582986p2583316.html http://git.661346.n2.

Linus (from 2009) on problems with signing every commit: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-tp2582986p2583316.html http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-t...

shittyadmin 8y ago
He seems to be discouraging signing every commit's individual data but encouraging signing the actual commit ID (SHA1) which should be perfectly feasible for something like homebrew.
- mnarayan01 8y ago
  > Signing each commit is totally stupid. It just means that you automate it, and you make the signature worth less.
  - shittyadmin 8y ago
    You're still getting a signature directly from the developer's machine, not from the repository server and as such you're still vastly shrinking the attack surface.
  - mratzloff 8y ago
    It's really not that hard to type a password into the terminal every time you commit.
    - majewsky 8y ago
      You have no idea how creative people get when faced with minor nuisances. I've seen devs/admins go to great lengths to avoid doing more than one 2FA per day.
      - bigiain 8y ago
        Like this? https://www.youtube.com/watch?v=AsNwon4fjqY https://www.youtube.com/watch?v=AsNwon4fjqY A publicly available webcam pointed at an RSA SecurID hardware token... (The optimist ion me hopes this was performance art. But I've worked with people who'd do that if it made their day ever so slightly easier...)
ejholmes 8y ago
General rule of thumb for secure package distribution: 1. Is the identifier mutable? Make sure it points to a content addressable identifier (SHA2), and sign that link. 2. Is it a content addressable identifier? Nothing to do. When it comes to signing in git, signing tags is usually where you see the most value (mutable identifier that points to a git tree, which is content addressable). You’re just trying to improve the trust in saying “Hey, v1.2 is this SHA digest”.

shittyadmin 8y ago

He seems to be discouraging signing every commit's individual data but encouraging signing the actual commit ID (SHA1) which should be perfectly feasible for something like homebrew.

mnarayan01 8y ago
> Signing each commit is totally stupid. It just means that you automate it, and you make the signature worth less.
- shittyadmin 8y ago
  You're still getting a signature directly from the developer's machine, not from the repository server and as such you're still vastly shrinking the attack surface.
- mratzloff 8y ago
  It's really not that hard to type a password into the terminal every time you commit.
  - majewsky 8y ago
    You have no idea how creative people get when faced with minor nuisances. I've seen devs/admins go to great lengths to avoid doing more than one 2FA per day.
    - bigiain 8y ago
      Like this? https://www.youtube.com/watch?v=AsNwon4fjqY https://www.youtube.com/watch?v=AsNwon4fjqY A publicly available webcam pointed at an RSA SecurID hardware token... (The optimist ion me hopes this was performance art. But I've worked with people who'd do that if it made their day ever so slightly easier...)

ejholmes 8y ago

General rule of thumb for secure package distribution: 1. Is the identifier mutable? Make sure it points to a content addressable identifier (SHA2), and sign that link. 2. Is it a content addressable identifier? Nothing to do. When it comes to signing in git, signing tags is usually where you see the most value (mutable identifier that points to a git tree, which is content addressable). You’re just trying to improve the trust in saying “Hey, v1.2 is this SHA digest”.