Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122866
Precedence: bulk
MIME-Version: 1.0
References: <AM8P250MB01705B564C0F9B2F460F56B0E2392@AM8P250MB0170.EURP250.PROD.OUTLOOK.COM>
 <9008050F-4EE1-4E19-B513-654602E118A7@benramsey.com> <CADyq6sLr=Zv0OmL55na0c6kGkaxvy9A8fJhptn71si8u7rzedQ@mail.gmail.com>
 <CAEKnhAGmDRMypM=fsWAroC6M6JcbwQRf7HYbb7n3GPNVQGvXjA@mail.gmail.com>
 <95c92b6a-6788-fddb-a130-e4d122338b68@php.net> <CAEKnhAG4AYy9wPzuVq3y_hqfjcWMDi8HtCkVQyL9Txoqogwz7A@mail.gmail.com>
 <CAO__Xv7=31W8FQgJ8xTokzA_qu0wo0bcVfOC7dKTMGGeOxmAhA@mail.gmail.com>
In-Reply-To: <CAO__Xv7=31W8FQgJ8xTokzA_qu0wo0bcVfOC7dKTMGGeOxmAhA@mail.gmail.com>
Date: Tue, 2 Apr 2024 14:40:51 +0000
Message-ID: <CAEKnhAEtuiQZ_7TpkwcONCeJ4=nOB-_UCHoJ+ojO1tGVNCmcWw@mail.gmail.com>
Subject: Re: [PHP-DEV] Consider removing autogenerated files from tarballs
To: tag Knife <fenniclog@gmail.com>
Cc: Derick Rethans <derick@php.net>, Marco Pivetta <ocramius@gmail.com>, Ben Ramsey <ben@benramsey.com>, 
	Bob Weinand <bobwei9@hotmail.com>, Daniil Gentili <daniil.gentili@gmail.com>, 
	PHP Internals List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000006325db06151e189a"
From: bukka@php.net (Jakub Zelenka)

--0000000000006325db06151e189a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Apr 2, 2024 at 3:35=E2=80=AFPM tag Knife <fenniclog@gmail.com> wrot=
e:

>
> On Tue, 2 Apr 2024 at 14:53, Jakub Zelenka <bukka@php.net> wrote:
>
>> We will still need RM to sign the build so ideally we should make it
>> reproducible so RM can verify that CI produced expected build and then s=
ign
>> it and just upload the signatures (not sure if we actually need signatur=
e
>> uploaded or if they are used just in announcements).
>>
>> I think this should then prevent compromise of the RM and CI unless CI i=
s
>> compromised by RM, of course, but that should be very unlikely.
>>
>> Regards
>>
>> Jakub
>>
>>
> On the side of the CI being compromised, this does happen, typically with
> authed
> private hosted CI, like jenkins. But if its open and accessible to
> everyone to monitor, such
> as github actions, everyone can monitor and audit the build logs to verif=
y
> the commands
> ran and nothing unexpected happened during build.
>
> That is something PHP is missing atm, no one can verify the build process
> for releases.
>

Yes that's what I was suggesting. This should be done by RM. In that way,
the RM becomes more someone that verifies the build and not the actual
person that provides the build.

Regards

Jakub

--0000000000006325db06151e189a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Tue, Apr 2, 2024 at 3:35=E2=80=AFPM ta=
g Knife &lt;<a href=3D"mailto:fenniclog@gmail.com">fenniclog@gmail.com</a>&=
gt; wrote:<br></div><div class=3D"gmail_quote"><blockquote class=3D"gmail_q=
uote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,2=
04);padding-left:1ex"><div dir=3D"ltr"><br><div class=3D"gmail_quote"><div =
dir=3D"ltr" class=3D"gmail_attr">On Tue, 2 Apr 2024 at 14:53, Jakub Zelenka=
 &lt;<a href=3D"mailto:bukka@php.net" target=3D"_blank">bukka@php.net</a>&g=
t; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0p=
x 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div d=
ir=3D"ltr"><div class=3D"gmail_quote"><div>We will still need RM to sign th=
e build so ideally we should make it reproducible so RM can verify that CI =
produced expected build and then sign it and just upload the signatures (no=
t sure if we actually need signature uploaded or if they are used just in a=
nnouncements).</div><div><br></div><div>I think this should then prevent co=
mpromise of the RM and CI unless CI is compromised by RM, of course, but th=
at should be very unlikely.<br></div><div><br></div><div>Regards</div><div>=
<br></div><div>Jakub<br><br></div></div></div></blockquote><div><br></div><=
div></div><div>On the side of the CI being compromised, this does happen, t=
ypically with authed=C2=A0</div><div>private hosted CI, like jenkins. But i=
f its open and accessible to everyone to monitor, such</div><div>as github =
actions, everyone can monitor and audit the build logs to verify the comman=
ds</div><div>ran and nothing unexpected happened during build.</div><div><b=
r></div><div>That is something PHP is missing atm, no one can verify the bu=
ild process for releases.<br></div></div></div></blockquote><div><br></div>=
<div>Yes that&#39;s what I was suggesting. This should be done by RM. In th=
at way, the RM becomes more someone that verifies the build and not the act=
ual person that provides the build.</div><div><br></div><div>Regards</div><=
div><br></div><div>Jakub</div><div><br></div><div><br></div></div></div>

--0000000000006325db06151e189a--