Newsgroups: php.doc,php.internals
Path: news.php.net
Xref: news.php.net php.doc:969387882 php.internals:113925
To: "'Nikita Popov'" <nikita.ppv@gmail.com>,
	"'PHP internals'" <internals@lists.php.net>,
	"'PHP Doc Mailing List'" <phpdoc@lists.php.net>
References: <CAF+90c9A6zG-nYzc3NNtWGjN7y5FmwqnYzjq6GSFC5NtRsOT0w@mail.gmail.com>
In-Reply-To: <CAF+90c9A6zG-nYzc3NNtWGjN7y5FmwqnYzjq6GSFC5NtRsOT0w@mail.gmail.com>
Date: Fri, 2 Apr 2021 04:16:58 +0800
Message-ID: <2a7501d72733$f7eb7e60$e7c27b20$@jhdxr.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Content-Language: en-us
Thread-Index: AQGnu0ykSYaw86KE3S7Dya9eai9WIqr+71aA
Feedback-ID: Yeas:jhdxr.com:qybgforeign:qybgforeign6
Subject: RE: [PHP-DEV] Changes to Git commit workflow
From: me@jhdxr.com (=?utf-8?b?Q0hVIFpoYW93ZWk=?=)

Hi Nikita,

Can I check with you if the hook integrating with bugs.php.net still =
works? I just committed a bug fix on doc-zh repo, and the bug report has =
been updated. Thanks.

Regards,
CHU Zhaowei

-----Original Message-----
From: Nikita Popov <nikita.ppv@gmail.com>=20
Sent: Monday, March 29, 2021 6:52 AM
To: PHP internals <internals@lists.php.net>; PHP Doc Mailing List =
<phpdoc@lists.php.net>
Subject: [PHP-DEV] Changes to Git commit workflow

Hi everyone,

Yesterday (2021-03-28) two malicious commits were pushed to the php-src =
repo [1] from the names of Rasmus Lerdorf and myself. We don't yet know =
how exactly this happened, but everything points towards a compromise of =
the git.php.net server (rather than a compromise of an individual git =
account).

While investigation is still underway, we have decided that maintaining =
our own git infrastructure is an unnecessary security risk, and that we =
will discontinue the git.php.net server. Instead, the repositories on =
GitHub, which were previously only mirrors, will become canonical. This =
means that changes should be pushed directly to GitHub rather than to =
git.php.net.

While previously write access to repositories was handled through our =
home-grown karma system, you will now need to be part of the php =
organization on GitHub. If you are not part of the organization yet, or =
don't have access to a repository you should have access to, contact me =
at nikic@php.net with your php.net and GitHub account names, as well as =
the permissions you're currently missing. Membership in the organization =
requires 2FA to be enabled.

This change also means that it is now possible to merge pull requests =
directly from the GitHub web interface.

We're reviewing the repositories for any corruption beyond the two =
referenced commits. Please contact security@php.net if you notice =
anything.

Regards,
Nikita

[1]:
https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a=
68d7d
and
https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a1=
1ed8a