Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122911
Date: Wed, 3 Apr 2024 15:51:06 +0100 (BST)
To: John Coggeshall <john@coggeshall.org>
cc: Andreas Heigl <andreas@heigl.org>, 
    "internals@lists.php.net" <internals@lists.php.net>
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
In-Reply-To: <609B255E-518E-4DAF-B41A-D21A3EBB5B5D@getmailspring.com>
Message-ID: <8caff876-0995-3a57-dd87-791c83881312@php.net>
References: <eed6980c-a685-4d31-a354-f8af426137c1@heigl.org> <609B255E-518E-4DAF-B41A-D21A3EBB5B5D@getmailspring.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="8323329-2098442926-1712155866=:14553"
From: derick@php.net (Derick Rethans)

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--8323329-2098442926-1712155866=:14553
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: QUOTED-PRINTABLE

On Tue, 2 Apr 2024, John Coggeshall wrote:

>=20
> > So if we want to make sure that something like XY doesn't happen, we
> > have to add some additional restrictions to those GPG keys.
>=20
> Looks like all those geeky colleagues of ours back in the day having=20
> key-signing parties at conferences were on to something, maybe..

> Let's be clear about something -- having GPG key requirements isn't=20
> going to help a situation like XZ. The XZ attack was done by an active=20
> maintainer of the project (who arguably manipulated the original=20
> maintainer of the project to become a maintainer themselves). It was=20
> as much a social engineering attack as anything.

> Having GPG key requirements is all fine and dandy I suppose, but my=20
> tongue-in-cheek comment above has a real point behind it: GPG keys=20
> don't mean jack if you can't trust who owns the key.

GitHub doesn't show the web of trust anyway, just "verified". Command=20
line GIT doesn't either, just:

$ git verify-commit HEAD~1
gpg: Signature made Tue 02 Apr 2024 14:55:21 BST
gpg:                using RSA key 5A52880781F755608BF815FC910DEB46F53EA312
=E2=80=A6
gpg:                 aka "Derick Rethans (GitHub) <github@derickrethans.nl>=
" [ultimate]
gpg:                 aka "Derick Rethans (PHP) <derick@php.net>" [ultimate]


cheers,
Derick
--8323329-2098442926-1712155866=:14553--