Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122910
Date: Wed, 3 Apr 2024 15:47:31 +0100 (BST)
To: Ayesh Karunaratne <ayesh@php.watch>
cc: PHP Developers Mailing List <internals@lists.php.net>
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
In-Reply-To: <CANLbj-rrk5S8-UrX=GKW05=zC-UEWpfVX8cH=dgYRZB-qKkARQ@mail.gmail.com>
Message-ID: <ab7e3081-17ff-cf42-11dd-43c4ffd2f81f@php.net>
References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net> <CANLbj-rrk5S8-UrX=GKW05=zC-UEWpfVX8cH=dgYRZB-qKkARQ@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
From: derick@php.net (Derick Rethans)

On Tue, 2 Apr 2024, Ayesh Karunaratne wrote:

> > What do y'all think about requiring GPG signed commits for the 
> > php-src repository?
> >
> > I had a look, and this is also something we can enforce through 
> > GitHub as well (by using branch protections).
> 
> +1 from me as well, and quite good timing with all the xz fiasco just 
> last week.
> 
> Git can also sign with SSH keys now, so this is now merely a config 
> update

The issue with SSH keys is that they can not be signed by others to form 
a "web of trust". For example, my key has been signed by several other 
people:

https://keyserver.ubuntu.com/pks/lookup?search=derick%40php.net&fingerprint=on&op=index

cheers,
Derick