Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122899
Precedence: bulk
MIME-Version: 1.0
References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net> <CAPyj-LC9Ygr0vNB3RyTKmmYmq1VbNgzDS_J3bq6NaoXD1YaMhQ@mail.gmail.com>
 <33406173-693c-44c2-a378-fff49751f3b4@rwec.co.uk> <CAPyj-LDh7K=cGcxX1qpY7=SYGOdOo0y-QAQjorhRoeqO2ni96A@mail.gmail.com>
 <089e6466-540b-4d86-8cf4-1a6b5506efed@rwec.co.uk>
In-Reply-To: <089e6466-540b-4d86-8cf4-1a6b5506efed@rwec.co.uk>
Date: Wed, 3 Apr 2024 00:05:50 +0200
Message-ID: <CAPyj-LDyD_UC75bMeT4hR04tKYC=XAMJ3fu3BDgsYybmkZ+gZA@mail.gmail.com>
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: tovilo.ilija@gmail.com (Ilija Tovilo)

On Tue, Apr 2, 2024 at 9:43=E2=80=AFPM Rowan Tommins [IMSoP]
<imsop.php@rwec.co.uk> wrote:
>
> Similarly, if you discover a compromised key or signing account, you can =
look for uses of that key or account, which might be a tiny number from a n=
on-core contributor; if you discover a compromised account pushing unsigned=
 commits, you have to audit every commit in the repository.

Right, that and what Jakub mentioned are fair arguments.

> I agree it's not a complete solution, but no security measure is; it's al=
ways about reducing the attack surface or limiting the damage.

Right. That was the original intention of my e-mail: To point out that
we might also want to consider other mitigations. Not that we
shouldn't do commit signing.

Ilija