Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:113909
MIME-Version: 1.0
References: <CAF+90c9A6zG-nYzc3NNtWGjN7y5FmwqnYzjq6GSFC5NtRsOT0w@mail.gmail.com>
 <CAN2symg2SueEONzMRndsWEhj6anXmeAQwKg+HzKh-o61bcP0Qg@mail.gmail.com>
 <CAESVnVoPEitSCzmrAR2pRY4zUp4WEBc3a1b3q4H_uh1q8ebVWw@mail.gmail.com>
 <CAEYWF=71sahVwiaPEAYMCfLd+fgZ5FA24bS-LCtzxNW==9H=xg@mail.gmail.com> <c0849f5f-4233-d0f1-d00d-29840459070b@gmail.com>
In-Reply-To: <c0849f5f-4233-d0f1-d00d-29840459070b@gmail.com>
Reply-To: bishop@php.net
Date: Thu, 1 Apr 2021 10:20:23 -0400
Message-ID: <CAEYWF=5PE9MKt_zxU8u+Mv0oHz_Stw3_vVNe1BWfO-5mZ7ab5g@mail.gmail.com>
To: Rowan Tommins <rowan.collins@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000c0afbd05bee9f043"
Subject: Re: [PHP-DEV] Changes to Git commit workflow
From: bishop@php.net (Bishop Bettini)

--000000000000c0afbd05bee9f043
Content-Type: text/plain; charset="UTF-8"

On Thu, Apr 1, 2021 at 9:22 AM Rowan Tommins <rowan.collins@gmail.com>
wrote:

> On 01/04/2021 05:54, Bishop Bettini wrote:
> > I've documented why we need signing, and how to set it up:
> >
> > https://wiki.php.net/vcs/commit-signing
> >
> > Feedback welcomed!
>
>
> This looks great, and very easy to follow.
>
> One edit I would strongly suggest though:
>
> Remove the "Passphrase:" line from the --generate-key command, so that
> gpg will prompt interactively for the passphrase using the same entry as
> it will use later when signing. You should never include a password or
> passphrase in a command if you can avoid it, as it will be visible on
> your screen, and stored in plain text in your shell history.
>
>
> Some additional tips that might be worth adding:
>
> As an advanced setup suggestion, "gpg --full-generate-key" launches a
> wizard with a couple of extra prompts.
>
> If you're on Ubuntu and don't have a new enough git (e.g. 18.04LTS ships
> with 2.17.1), there is an official PPA to upgrade it; just run: "sudo
> add-apt-repository ppa:git-core/ppa && sudo apt update && sudo apt
> install git"
>
> Before pushing to github, you can verify the signature on a commit
> locally with "git show --show-signature HEAD", or similarly for a tag by
> passing the tag name.
>

Excellent suggestions. I've updated the guide with these.

I also added a FAQ.

https://wiki.php.net/vcs/commit-signing

Thank you!

--000000000000c0afbd05bee9f043--