Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:122868 X-Original-To: internals@lists.php.net Delivered-To: internals@lists.php.net Received: from php-smtp4.php.net (php-smtp4.php.net [45.112.84.5]) by qa.php.net (Postfix) with ESMTPS id 06BE61AD8EA for ; Tue, 2 Apr 2024 14:44:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=php.net; s=mail; t=1712069073; bh=bJfO9EBW7el8po+gC4Vb452D504ew8T854kTvivcIyg=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=OHvvgZeHqd/g2wXJ3X7UC0VpnMZjLybRGu7ad6kk5dF/eUJLqsU3WP9ONZQxShpaV cvVlsugqBrJJUiueCEKa8KJzWYMqU036ov+24i5Vb2p4mbAmBCBi0M1fodayTCHw1q /pcVg5+35gDNB9/14amKhLFsqPkQIxowsmzhDk77nYtxTATAZiN5cI7MjFLx8yPJoL z6sOMf2ZAqbzsdXZB+wb5B/mUNiJmlOTU+W45dna7HYUVi4jPyi5NzIZNzLCPpP3KT D2gPCNxu0SNFA4gXdYs/3M4Zg/uRwBXnRz4pCV2uks1aX8NCAJzYiwiwBevwFfPFCU /ZFJVgWgoxsHA== Received: from php-smtp4.php.net (localhost [127.0.0.1]) by php-smtp4.php.net (Postfix) with ESMTP id 9DC9A180687 for ; Tue, 2 Apr 2024 14:44:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on php-smtp4.php.net X-Spam-Level: X-Spam-Status: No, score=-0.2 required=5.0 tests=BAYES_20,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,DMARC_PASS,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=4.0.0 X-Spam-Virus: No X-Envelope-From: Received: from forward500b.mail.yandex.net (forward500b.mail.yandex.net [178.154.239.144]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by php-smtp4.php.net (Postfix) with ESMTPS for ; Tue, 2 Apr 2024 14:44:27 +0000 (UTC) Received: from mail-nwsmtp-smtp-production-main-60.sas.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-60.sas.yp-c.yandex.net [IPv6:2a02:6b8:c08:81a8:0:640:f69b:0]) by forward500b.mail.yandex.net (Yandex) with ESMTPS id 1D42C6130D for ; Tue, 2 Apr 2024 17:43:57 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-60.sas.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id thTeCTiSna60-XFXIUc0F; Tue, 02 Apr 2024 17:43:56 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=php.watch; s=mail; t=1712069036; bh=bJfO9EBW7el8po+gC4Vb452D504ew8T854kTvivcIyg=; h=To:Subject:Message-ID:References:Date:From:In-Reply-To:Cc; b=NMlyaiADmFipnuqFaj1daCwSrlD2SpzOeNWrzZmcv6EmdRpvdB01HVGL5FMkqaqPH ttuJrgImDaxReXJN7zP2T4gU1+JpDZgpDzMTeCoqi+2eRstDAu3jj65u6w0sci0tu0 p8OOVyxhSQuMQpPWsRcuC2tPaIKj06lTnDoeeh5s= Authentication-Results: mail-nwsmtp-smtp-production-main-60.sas.yp-c.yandex.net; dkim=pass header.i=@php.watch Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-2a2559fe607so667530a91.2 for ; Tue, 02 Apr 2024 07:43:55 -0700 (PDT) X-Gm-Message-State: AOJu0YwQ/hy7knW5iOlo7lRIB1LBtsDgrXi30ZPXMCHSzDX0V0PjxoiW Kz9Pe7+VAwzz/FoRFlZyp7/bAXebpLtJRCgHW6z4QcyV4RZ8AiNu9PgwnwRqI8u9+CrT6DHiluK YLVrTC7vUKeeE8Odr6svUGlt6Z9w= X-Google-Smtp-Source: AGHT+IHHcWZrrmx6/EOe5bFOWyC/RFdDOcirRFHmCG5m14aAbUU6Z54KZsdNSrKIhyVWnWyqPtXRSIJRKCRd+JAwIQo= X-Received: by 2002:a17:90a:b8f:b0:2a0:156f:b8 with SMTP id 15-20020a17090a0b8f00b002a0156f00b8mr9958490pjr.46.1712069034605; Tue, 02 Apr 2024 07:43:54 -0700 (PDT) Precedence: bulk list-help: list-post: List-Id: internals.lists.php.net MIME-Version: 1.0 References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net> In-Reply-To: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net> Date: Tue, 2 Apr 2024 21:43:25 +0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PHP-DEV] Requiring GPG Commit Signing To: Derick Rethans Cc: PHP Developers Mailing List Content-Type: text/plain; charset="UTF-8" From: ayesh@php.watch (Ayesh Karunaratne) > > Hi, > > What do y'all think about requiring GPG signed commits for the php-src > repository? > > I had a look, and this is also something we can enforce through GitHub > as well (by using branch protections). > > cheers, > Derick > > > -- > https://derickrethans.nl | https://xdebug.org | https://dram.io > > Author of Xdebug. Like it? Consider supporting me: https://xdebug.org/support > > mastodon: @derickr@phpc.social @xdebug@phpc.social +1 from me as well, and quite good timing with all the xz fiasco just last week. Git can also sign with SSH keys now, so this is now merely a config update