Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122891
Precedence: bulk
MIME-Version: 1.0
References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net> <CAPyj-LC9Ygr0vNB3RyTKmmYmq1VbNgzDS_J3bq6NaoXD1YaMhQ@mail.gmail.com>
 <33406173-693c-44c2-a378-fff49751f3b4@rwec.co.uk>
In-Reply-To: <33406173-693c-44c2-a378-fff49751f3b4@rwec.co.uk>
Date: Tue, 2 Apr 2024 21:02:48 +0200
Message-ID: <CAPyj-LDh7K=cGcxX1qpY7=SYGOdOo0y-QAQjorhRoeqO2ni96A@mail.gmail.com>
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: tovilo.ilija@gmail.com (Ilija Tovilo)

Hi Rowan

On Tue, Apr 2, 2024 at 8:48=E2=80=AFPM Rowan Tommins [IMSoP]
<imsop.php@rwec.co.uk> wrote:
>
> In fact, you don't need to compromise anybody's key: you could socially e=
ngineer a situation where you have push access to the repository, or break =
the security in some other way. As I understand it, this is exactly what ha=
ppened 3 years ago: someone gained direct write access to the git.php.net s=
erver, and added commits "authored by" Nikita and others to the history in =
the repository.

Right, but I would like to believe that attaining push access _without
gaining access to a maintainers account_ should be substantially
harder on GitHub than our self-hosted git server. :)

> If all commits are signed, a compromised key or account can only be used =
to sign commits with that specific identity: your GitHub account can't be u=
sed to sign commits as Derick or Nikita, only as you. The impact is limited=
 to one identity, not the integrity of the entire repository.

But, does it matter? I'm not sure we look at some commits closer than
others, based on its author. It's true that it might be easier to
identify malicious commits if they all come from the same user, but it
wouldn't prevent them.

To be clear: I'm not against commit signing, I've been doing it for
years. I'm just unsure if it's a sufficient solution (apart from
releases, which are a whole different can of worms).

Ilija