Newsgroups: php.doc,php.internals
Path: news.php.net
Xref: news.php.net php.doc:969387868 php.internals:113840
MIME-Version: 1.0
References: <CAF+90c9A6zG-nYzc3NNtWGjN7y5FmwqnYzjq6GSFC5NtRsOT0w@mail.gmail.com>
In-Reply-To: <CAF+90c9A6zG-nYzc3NNtWGjN7y5FmwqnYzjq6GSFC5NtRsOT0w@mail.gmail.com>
Date: Sun, 28 Mar 2021 16:57:16 -0700
Message-ID: <CAN2symg2SueEONzMRndsWEhj6anXmeAQwKg+HzKh-o61bcP0Qg@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: PHP internals <internals@lists.php.net>, PHP Doc Mailing List <phpdoc@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Changes to Git commit workflow
From: paul.crovella@gmail.com (Paul Crovella)

You might consider requiring commits be signed while you're at it.

On Sun, Mar 28, 2021 at 3:53 PM Nikita Popov <nikita.ppv@gmail.com> wrote:
>
> Hi everyone,
>
> Yesterday (2021-03-28) two malicious commits were pushed to the php-src
> repo [1] from the names of Rasmus Lerdorf and myself. We don't yet know how
> exactly this happened, but everything points towards a compromise of the
> git.php.net server (rather than a compromise of an individual git account).
>
> While investigation is still underway, we have decided that maintaining our
> own git infrastructure is an unnecessary security risk, and that we will
> discontinue the git.php.net server. Instead, the repositories on GitHub,
> which were previously only mirrors, will become canonical. This means that
> changes should be pushed directly to GitHub rather than to git.php.net.
>
> While previously write access to repositories was handled through our
> home-grown karma system, you will now need to be part of the php
> organization on GitHub. If you are not part of the organization yet, or
> don't have access to a repository you should have access to, contact me at
> nikic@php.net with your php.net and GitHub account names, as well as the
> permissions you're currently missing. Membership in the organization
> requires 2FA to be enabled.
>
> This change also means that it is now possible to merge pull requests
> directly from the GitHub web interface.
>
> We're reviewing the repositories for any corruption beyond the two
> referenced commits. Please contact security@php.net if you notice anything.
>
> Regards,
> Nikita
>
> [1]:
> https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a68d7d
> and
> https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a