Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:123055
Date: Tue, 9 Apr 2024 12:02:53 +0100 (BST)
To: PHP Developers Mailing List <internals@lists.php.net>
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
In-Reply-To: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net>
Message-ID: <848f7e51-b987-93d0-f900-5f09302ebd12@php.net>
References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
From: derick@php.net (Derick Rethans)

On Tue, 2 Apr 2024, Derick Rethans wrote:

> What do y'all think about requiring GPG signed commits for the php-src 
> repository?
> 
> I had a look, and this is also something we can enforce through GitHub 
> as well (by using branch protections).

It seems that most of the reply to this was positive, although with the 
realisation that it wouldn't be a panacea.

I will therefore propose a minimalistic RFC to create this requirement 
to sign commits to all branches, in the next few days.

 I probably would have prefered requiring *GPG* signing (due to a web of 
trust), but GitHub's requirement isn't that granuar (it's either 
SSG+GPG, or nothing).

Any other opinions, I'd be delighted to hear them.

cheers,
Derick

-- 
https://derickrethans.nl | https://xdebug.org | https://dram.io

Author of Xdebug. Like it? Consider supporting me: https://xdebug.org/support

mastodon: @derickr@phpc.social @xdebug@phpc.social