Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122841
Content-Type: multipart/signed;
	boundary="Apple-Mail=_841D2EA9-9F10-4C41-8FA8-0F25010055E4";
	protocol="application/pgp-signature";
	micalg=pgp-sha256
Precedence: bulk
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.500.171.1.1\))
Subject: Re: [PHP-DEV] Consider removing autogenerated files from tarballs
In-Reply-To: <CAPzBOBNxnvbTZDTj1WRp_sduKFQB+mbcz2RfAvpO1DEciaYY4g@mail.gmail.com>
Date: Sun, 31 Mar 2024 18:52:53 -0500
Cc: Christian Schneider <cschneid@cschneid.com>,
 php internals <internals@lists.php.net>
Message-ID: <8AD52323-A273-40FE-90FD-8A7AE55535AE@benramsey.com>
References: <AM8P250MB01705B564C0F9B2F460F56B0E2392@AM8P250MB0170.EURP250.PROD.OUTLOOK.COM>
 <9008050F-4EE1-4E19-B513-654602E118A7@benramsey.com>
 <3d90e236-49d8-4f80-a6dd-3584267a83e3@php.net>
 <586c3320-b38b-47bb-9c06-6762f1eb242b@gmail.com>
 <cc1e1415-a4cd-4bb2-99f0-e5b05ef6582c@gmail.com>
 <CAEKnhAEMAmgoFmgCPOnV_0sxpaB5SNwRo-qFcE_YeLSduq+bHg@mail.gmail.com>
 <1c7bcd0e-4e32-480f-acd2-2c8eb049bde2@gmail.com>
 <3E13B046-FE40-48D7-AAF0-13362B12C438@cschneid.com>
 <CAPzBOBNxnvbTZDTj1WRp_sduKFQB+mbcz2RfAvpO1DEciaYY4g@mail.gmail.com>
To: Robert Landers <landers.robert@gmail.com>
From: ben@benramsey.com (Ben Ramsey)


--Apple-Mail=_841D2EA9-9F10-4C41-8FA8-0F25010055E4
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

> On Mar 31, 2024, at 11:08, Robert Landers <landers.robert@gmail.com> =
wrote:
>=20
> There are probably multiple parties that require trust: the people
> hosting the CI servers, the people with access to the CI servers, the
> RM, and maybe more that I can't think of right now.
>=20
> One option would be to have
>=20
> - CI push the code + generated files to a git-branch `php-8.3-built`
> (or something) so that changes can be reviewed, along with the
> tarball.
> - CI signs the commit and tarball.
> - RM checks out commit and, also signs the tarball, then does a git
> commit --amend --signoff and "blesses" the commit
> - RM releases tarball


When I was considering this and created a PR that followed these steps, =
I discussed the process with folks from other open source communities, =
notably the Apache Software Foundation community, since some of their =
projects follow similar processes. The notion of automating the build =
and signing it on a remote machine, only to be inspected and signed =
again on the release manager=E2=80=99s machine was outright rejected by =
everyone. The machine where it is signed by the RM should be the machine =
where it is built, according to everyone I spoke with.

As it stands right now, if we build the tarball on a remote machine (in =
CI), and then the RM wants to compare it and build it locally, the =
hashes on those tarballs will be different because we can=E2=80=99t =
guarantee reproducible builds. If we could guarantee reproducible =
builds, then maybe this process could work, but it would still require =
the RM to build it locally from the source tag in order to trust and =
verify that nothing sneaked in on the CI machine.

Cheers,
Ben


--Apple-Mail=_841D2EA9-9F10-4C41-8FA8-0F25010055E4
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iHUEAREIAB0WIQToXQMR3fpbrPOmEOewLZeYnIwHGwUCZgn3VQAKCRCwLZeYnIwH
G4x0AP9aVtdgte/AeO+kYVzXYx7zD4C+/x2HMo8gJNR70pPocQD/T/2vM403GNcj
NqvqcmijAOAtiOr1B8qtAmmBCCHjdwY=
=Gz61
-----END PGP SIGNATURE-----

--Apple-Mail=_841D2EA9-9F10-4C41-8FA8-0F25010055E4--