Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122877
Content-Type: multipart/alternative;
 boundary="------------30dProsg8hQ0s0BDgVSOvvXc"
Message-ID: <dfcbb3fd-dd7a-4ed2-9cdc-fbef58c6c4d8@scriptfusion.com>
Date: Tue, 2 Apr 2024 16:58:12 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
To: internals@lists.php.net
References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net>
 <444D24BA-D9D5-410C-B34B-AD0A8C7C4E68@cmpct.info>
Content-Language: en-GB
In-Reply-To: <444D24BA-D9D5-410C-B34B-AD0A8C7C4E68@cmpct.info>
From: bilge@scriptfusion.com (Bilge)

This is a multi-part message in MIME format.
--------------30dProsg8hQ0s0BDgVSOvvXc
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 02/04/2024 15:55, Calvin Buckley wrote:
> On Apr 2, 2024, at 11:15 AM, Derick Rethans<derick@php.net>  wrote:
>> What do y'all think about requiring GPG signed commits for the php-src
>> repository?
>>
>> I had a look, and this is also something we can enforce through GitHub
>> as well (by using branch protections).
> Would this affect only direct pushes to master, or would it be required
> for pull requests too? I'd be worried the average drive-by contributor
> wouldn't have GPG signing set up.

FWIW, I'm a drive-by contributor and I have GPG signing 
<https://github.com/php/php-src/pull/13845/commits> set up.

--------------30dProsg8hQ0s0BDgVSOvvXc
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 02/04/2024 15:55, Calvin Buckley
      wrote:<br>
    </div>
    <blockquote type="cite"
      cite="mid:444D24BA-D9D5-410C-B34B-AD0A8C7C4E68@cmpct.info">
      <pre class="moz-quote-pre" wrap="">On Apr 2, 2024, at 11:15 AM, Derick Rethans <a class="moz-txt-link-rfc2396E" href="mailto:derick@php.net">&lt;derick@php.net&gt;</a> wrote:
</pre>
      <blockquote type="cite">
        <pre class="moz-quote-pre" wrap="">
What do y'all think about requiring GPG signed commits for the php-src 
repository?

I had a look, and this is also something we can enforce through GitHub 
as well (by using branch protections).
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">
Would this affect only direct pushes to master, or would it be required
for pull requests too? I'd be worried the average drive-by contributor
wouldn't have GPG signing set up.</pre>
    </blockquote>
    <p>FWIW, I'm a drive-by contributor and I have <a
        href="https://github.com/php/php-src/pull/13845/commits">GPG
        signing</a> set up.<br>
    </p>
  </body>
</html>

--------------30dProsg8hQ0s0BDgVSOvvXc--