Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122871
X-Original-To: internals@lists.php.net
Delivered-To: internals@lists.php.net
Received: from php-smtp4.php.net (php-smtp4.php.net [45.112.84.5])
	by qa.php.net (Postfix) with ESMTPS id 3D7FA1ADB1B
	for <internals@lists.php.net>; Tue,  2 Apr 2024 14:55:25 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=php.net; s=mail;
	t=1712069753; bh=mQMYz2dRJtaLVM+TFay8ezHUzxmp5tU4uH5JvvX95i8=;
	h=Subject:From:In-Reply-To:Date:Cc:References:To:From;
	b=Lz72Fgl/gETGhnUViUx5+1/sUcSjO9LKL4FHC0vMCNdD8TLBLmw9ls3gjnFrx1iBX
	 a+V44IV/7f3kollpKgXCfa6+lToHttU/lbPeed4uri1jQnWszg2uo7p9Nwp01OKHk5
	 +jGv71IeOAbU6RovrfwBjTmKR6K0bsJDmLkwqbdIQUi1BLQ+Y0+ruZHVH/txcun/Cl
	 5U0TKeT1zAFaffdUJ34I7wnCjV46jIwmVCk1L6Ubd/u8m0pzBr80+8o3JdJ8re3VtF
	 fdaJzw+2EUqF9zLAXIfFFH3cZ005HYQAZhnmK7yaJlspQGouSURTjJrjcwVJFksaAZ
	 LtKLgFXONzm+w==
Received: from php-smtp4.php.net (localhost [127.0.0.1])
	by php-smtp4.php.net (Postfix) with ESMTP id 71BF318087B
	for <internals@lists.php.net>; Tue,  2 Apr 2024 14:55:51 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on php-smtp4.php.net
X-Spam-Level: 
X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,DMARC_MISSING,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=no
	autolearn_force=no version=4.0.0
X-Spam-Virus: No
X-Envelope-From: <calvin@cmpct.info>
Received: from supercat.cmpct.info (supercat.cmpct.info [71.19.146.230])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
	(No client certificate requested)
	by php-smtp4.php.net (Postfix) with ESMTPS
	for <internals@lists.php.net>; Tue,  2 Apr 2024 14:55:48 +0000 (UTC)
Received: from smtpclient.apple (fctnnbsc38w-142-134-99-147.dhcp-dynamic.fibreop.nb.bellaliant.net [142.134.99.147])
	by supercat.cmpct.info (Postfix) with ESMTPSA id 645FE4E44A;
	Tue,  2 Apr 2024 14:55:17 +0000 (UTC)
Content-Type: text/plain;
	charset=utf-8
Precedence: bulk
list-help: <mailto:internals+help@lists.php.net
list-unsubscribe: <mailto:internals+unsubscribe@lists.php.net>
list-post: <mailto:internals@lists.php.net>
List-Id: internals.lists.php.net
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.500.171.1.1\))
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
In-Reply-To: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net>
Date: Tue, 2 Apr 2024 11:55:05 -0300
Cc: PHP Developers Mailing List <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <444D24BA-D9D5-410C-B34B-AD0A8C7C4E68@cmpct.info>
References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net>
To: Derick Rethans <derick@php.net>
X-Mailer: Apple Mail (2.3774.500.171.1.1)
From: calvin@cmpct.info (Calvin Buckley)

On Apr 2, 2024, at 11:15=E2=80=AFAM, Derick Rethans <derick@php.net> =
wrote:
>=20
> What do y'all think about requiring GPG signed commits for the php-src=20=

> repository?
>=20
> I had a look, and this is also something we can enforce through GitHub=20=

> as well (by using branch protections).

Would this affect only direct pushes to master, or would it be required
for pull requests too? I'd be worried the average drive-by contributor
wouldn't have GPG signing set up.=