Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122880
Precedence: bulk
MIME-Version: 1.0
References: <eed6980c-a685-4d31-a354-f8af426137c1@heigl.org> <609B255E-518E-4DAF-B41A-D21A3EBB5B5D@getmailspring.com>
In-Reply-To: <609B255E-518E-4DAF-B41A-D21A3EBB5B5D@getmailspring.com>
Date: Tue, 2 Apr 2024 16:18:43 +0000
Message-ID: <CAEKnhAFY-cU+grnHxsBGT4quOHXJcvA_3cDb9a5Lrm5BimczTA@mail.gmail.com>
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
To: John Coggeshall <john@coggeshall.org>
Cc: Andreas Heigl <andreas@heigl.org>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000066f9c606151f7610"
From: bukka@php.net (Jakub Zelenka)

--00000000000066f9c606151f7610
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Apr 2, 2024 at 5:05=E2=80=AFPM John Coggeshall <john@coggeshall.org=
> wrote:

>
> So if we want to make sure that something like XY doesn't happen, we
> have to add some additional restrictions to those GPG keys.
>
>
> Looks like all those geeky colleagues of ours back in the day having
> key-signing parties at conferences were on to something, maybe..
>
> Let's be clear about something -- having GPG key requirements isn't going
> to help a situation like XZ. The XZ attack was done by an active maintain=
er
> of the project (who arguably manipulated the original maintainer of the
> project to become a maintainer themselves). It was as much a social
> engineering attack as anything.
>
> Having GPG key requirements is all fine and dandy I suppose, but my
> tongue-in-cheek comment above has a real point behind it: GPG keys don't
> mean jack if you can't trust who owns the key. Unless we want to start
> limiting contributors to people who show up at conferences to do key
> signings of their GPG keys, I question exactly what this buys the project
> other than an illusion of security and additional complexity? I couldn't
> even *really*  trust Derick to read me his GPG public key
> character-by-character over the phone now days thanks to AI.
>
>
It's not meant to prevent XZ attack. The purpose is really just for the
actual contributors to have some assurance that just some random person
won't commit anything in their name just by changing the author of the
commit.

See another thread [1] about prevention of the XZ attack - that basically
requires moving the actual build to the CI and have the right process to
verify it.

[1] https://externals.io/message/122811

Regards

Jakub

--00000000000066f9c606151f7610
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Tue, Apr 2, 2024 at 5:05=E2=80=AFPM Jo=
hn Coggeshall &lt;<a href=3D"mailto:john@coggeshall.org">john@coggeshall.or=
g</a>&gt; wrote:<br></div><div class=3D"gmail_quote"><blockquote class=3D"g=
mail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204=
,204,204);padding-left:1ex"><br><blockquote><div><div>So if we want to make=
 sure that something like XY doesn&#39;t happen, we</div><div>have to add s=
ome additional restrictions to those GPG keys.</div></div></blockquote><div=
><br><div>Looks like all those geeky colleagues of ours back in the day hav=
ing key-signing parties at conferences were on to something, maybe.. </div>=
<br><div>Let&#39;s be clear about something -- having GPG key requirements =
isn&#39;t going to help a situation like XZ. The XZ attack was done by an a=
ctive maintainer of the project (who arguably manipulated the original main=
tainer of the project to become a maintainer themselves). It was as much a =
social engineering attack as anything.</div><br><div>Having GPG key require=
ments is all fine and dandy I suppose, but my tongue-in-cheek comment above=
 has a real point behind it: GPG keys don&#39;t mean jack if you can&#39;t =
trust who owns the key. Unless we want to start limiting contributors to pe=
ople who show up at conferences to do key signings of their GPG keys, I que=
stion exactly what this buys the project other than an illusion of security=
 and additional complexity? I couldn&#39;t even <em>really</em>=C2=A0 trust=
 Derick to read me his GPG public key character-by-character over the phone=
 now days thanks to AI.</div><br></div></blockquote><div><br></div><div>It&=
#39;s not meant to prevent XZ attack. The purpose is really just for the ac=
tual contributors to have some assurance that just some random person won&#=
39;t commit anything in their name just by changing the author of the commi=
t.</div><div><br></div><div>See another thread [1] about prevention of the =
XZ attack - that basically requires moving the actual build to the CI and h=
ave the right process to verify it.</div><div><br></div><div>[1]=C2=A0<a hr=
ef=3D"https://externals.io/message/122811">https://externals.io/message/122=
811</a></div><div><br></div><div>Regards</div><div><br></div><div>Jakub</di=
v></div></div>

--00000000000066f9c606151f7610--