Newsgroups: php.doc,php.internals
Path: news.php.net
Xref: news.php.net php.doc:969387876 php.internals:113854
MIME-Version: 1.0
References: <CAF+90c9A6zG-nYzc3NNtWGjN7y5FmwqnYzjq6GSFC5NtRsOT0w@mail.gmail.com>
In-Reply-To: <CAF+90c9A6zG-nYzc3NNtWGjN7y5FmwqnYzjq6GSFC5NtRsOT0w@mail.gmail.com>
Date: Mon, 29 Mar 2021 23:10:47 +0200
Message-ID: <CAG9XoMRj3DGcnaQobH_==W7P6JaiY16iL0c+JWaN-dLsJeNAbA@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: PHP internals <internals@lists.php.net>, PHP Doc Mailing List <phpdoc@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000078262905beb3519f"
Subject: Re: Changes to Git commit workflow
From: benjamin.morel@gmail.com (Benjamin Morel)

--00000000000078262905beb3519f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

>
> Hi everyone,
>
> Yesterday (2021-03-28) two malicious commits were pushed to the php-src
> repo [1] from the names of Rasmus Lerdorf and myself. We don't yet know h=
ow
> exactly this happened, but everything points towards a compromise of the
> git.php.net server (rather than a compromise of an individual git
> account).
>

That is scary. Can you disclose the contents of the commits? Are they
specially designed to open a security hole, or to be harmful in another way=
?


> While investigation is still underway, we have decided that maintaining
> our own git infrastructure is an unnecessary security risk, and that we
> will discontinue the git.php.net server. Instead, the repositories on
> GitHub, which were previously only mirrors, will become canonical. This
> means that changes should be pushed directly to GitHub rather than to
> git.php.net.
>

This change will be welcome anyway!

=E2=80=94 Benjamin

--00000000000078262905beb3519f--