Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114017
MIME-Version: 1.0
References: <CAF+90c9A6zG-nYzc3NNtWGjN7y5FmwqnYzjq6GSFC5NtRsOT0w@mail.gmail.com>
 <CAN2symg2SueEONzMRndsWEhj6anXmeAQwKg+HzKh-o61bcP0Qg@mail.gmail.com>
 <CAESVnVoPEitSCzmrAR2pRY4zUp4WEBc3a1b3q4H_uh1q8ebVWw@mail.gmail.com>
 <CAEYWF=71sahVwiaPEAYMCfLd+fgZ5FA24bS-LCtzxNW==9H=xg@mail.gmail.com>
 <c0849f5f-4233-d0f1-d00d-29840459070b@gmail.com> <CAEYWF=5PE9MKt_zxU8u+Mv0oHz_Stw3_vVNe1BWfO-5mZ7ab5g@mail.gmail.com>
In-Reply-To: <CAEYWF=5PE9MKt_zxU8u+Mv0oHz_Stw3_vVNe1BWfO-5mZ7ab5g@mail.gmail.com>
Date: Sat, 10 Apr 2021 19:21:47 +0100
Message-ID: <CAEKnhAGagh5pqr8ofSix0kkbi3J-DJGf=2ZbjSB7WDAu-Ydn7A@mail.gmail.com>
To: Bishop Bettini <bishop@php.net>
Cc: Rowan Tommins <rowan.collins@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000255fe805bfa25b58"
Subject: Re: [PHP-DEV] Changes to Git commit workflow
From: bukka@php.net (Jakub Zelenka)

--000000000000255fe805bfa25b58
Content-Type: text/plain; charset="UTF-8"

On Thu, Apr 1, 2021 at 3:21 PM Bishop Bettini <bishop@php.net> wrote:

> On Thu, Apr 1, 2021 at 9:22 AM Rowan Tommins <rowan.collins@gmail.com>
> wrote:
>
> > On 01/04/2021 05:54, Bishop Bettini wrote:
> > > I've documented why we need signing, and how to set it up:
> > >
> > > https://wiki.php.net/vcs/commit-signing
> > >
> > > Feedback welcomed!
> >
> >
> > This looks great, and very easy to follow.
> >
> > One edit I would strongly suggest though:
> >
> > Remove the "Passphrase:" line from the --generate-key command, so that
> > gpg will prompt interactively for the passphrase using the same entry as
> > it will use later when signing. You should never include a password or
> > passphrase in a command if you can avoid it, as it will be visible on
> > your screen, and stored in plain text in your shell history.
> >
> >
> > Some additional tips that might be worth adding:
> >
> > As an advanced setup suggestion, "gpg --full-generate-key" launches a
> > wizard with a couple of extra prompts.
> >
> > If you're on Ubuntu and don't have a new enough git (e.g. 18.04LTS ships
> > with 2.17.1), there is an official PPA to upgrade it; just run: "sudo
> > add-apt-repository ppa:git-core/ppa && sudo apt update && sudo apt
> > install git"
> >
> > Before pushing to github, you can verify the signature on a commit
> > locally with "git show --show-signature HEAD", or similarly for a tag by
> > passing the tag name.
> >
>
> Excellent suggestions. I've updated the guide with these.
>
> I also added a FAQ.
>
> https://wiki.php.net/vcs/commit-signing
>
>
Nice! It would be great if we start enforcing that. I finally set it up
too. I should have done it long time ago considering that I have been
maintaining gnupg extension for some time. :)

I think it's better to always use subkey for signing commits so that might
be good to add to the tutorial. Also RSA is getting a bit heavy with big
keys so it might be also good to suggest using ECC (e.g. EdDSA) which is
faster and possibly more secure. Although it's still in expert settings but
it works fine and a good tutorial can be found here
https://dev.to/benjaminblack/signing-git-commits-with-modern-encryption-1koh
.

Regards

Jakub

--000000000000255fe805bfa25b58--