Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122872
Date: Tue, 2 Apr 2024 16:03:15 +0100 (BST)
To: Calvin Buckley <calvin@cmpct.info>
cc: PHP Developers Mailing List <internals@lists.php.net>
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
In-Reply-To: <444D24BA-D9D5-410C-B34B-AD0A8C7C4E68@cmpct.info>
Message-ID: <de8b8567-4c7f-b6b6-e131-a6e36fc4dacb@php.net>
References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net> <444D24BA-D9D5-410C-B34B-AD0A8C7C4E68@cmpct.info>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/mixed; BOUNDARY="8323329-353320578-1712070160=:14553"
From: derick@php.net (Derick Rethans)

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--8323329-353320578-1712070160=:14553
Content-Type: text/plain; CHARSET=UTF-8
Content-Transfer-Encoding: QUOTED-PRINTABLE

On Tue, 2 Apr 2024, Calvin Buckley wrote:

> On Apr 2, 2024, at 11:15=E2=80=AFAM, Derick Rethans <derick@php.net> wrot=
e:
> >=20
> > What do y'all think about requiring GPG signed commits for the php-src=
=20
> > repository?
> >=20
> > I had a look, and this is also something we can enforce through GitHub=
=20
> > as well (by using branch protections).
>=20
> Would this affect only direct pushes to master, or would it be required
> for pull requests too? I'd be worried the average drive-by contributor
> wouldn't have GPG signing set up.

As Ayesh said, you can also use SSH for this now:
https://docs.github.com/en/authentication/managing-commit-signature-verific=
ation/about-commit-signature-verification#ssh-commit-signature-verification

I think it would apply to people merging the commits. But, I am not 100%=20
sure (until we try, I suppose).

cheers,
Derick



--=20
https://derickrethans.nl | https://xdebug.org | https://dram.io

Author of Xdebug. Like it? Consider supporting me: https://xdebug.org/suppo=
rt

mastodon: @derickr@phpc.social @xdebug@phpc.social
--8323329-353320578-1712070160=:14553--