Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130344
Precedence: list
MIME-Version: 1.0
References: <839153A0-004D-4562-BD6E-65923201EDAA@gmail.com>
 <CAPyj-LAajGgbhtibKGpWkM6TpHM2mNW68h=pUW81bC+-PaGzpg@mail.gmail.com>
 <CAMW7n8A1hL40ke7Y2FRiOP-Z2watKCHFxhUbL0hwMQ8LbB60kg@mail.gmail.com> <20260315141049.161081A00BD@lists.php.net>
In-Reply-To: <20260315141049.161081A00BD@lists.php.net>
Date: Sun, 15 Mar 2026 15:55:30 +0100
Message-ID: <CAKXKfQubWWixPLVm3YyPCYrvQybz_8aa58a5Zsw4nuAnQ7dfdg@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] php-community: a faster-moving, community-driven PHP.
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000dd6a7d064d114b8a"
From: daniil.gentili@gmail.com (Daniil Gentili)

--000000000000dd6a7d064d114b8a
Content-Type: text/plain; charset="UTF-8"

>
>
> I worked on an automated release workflow[^1] for php-src a few years
> ago, but after discussions with others from various major project
> communities (including Apache, Linux, etc.), I realized the solution
> wasn't workable for one main reason:
>
> An automated workflow cannot sign builds and still be considered secure.
>
> Builds must be signed by a human on the machine where the build took
> place. Automating the signatures in the cloud significantly reduces
> trust and greatly increases the likelihood of a bad actor gaining access
> to sneak things into the build (e.g., through compromised GitHub
> Actions, etc.).
>

I strongly disagree.

I have way more trust in an automatic build environment with reproducible
(key word here) builds than in a (potentially corruptible) human that
pinkie swears no changes were made to an autogenerated configure contained
in released tarballs.

>

--000000000000dd6a7d064d114b8a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div><div class=3D"gmail_quote gmail_quote_container"><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef=
t:1px solid rgb(204,204,204);padding-left:1ex"><br>
I worked on an automated release workflow[^1] for php-src a few years <br>
ago, but after discussions with others from various major project <br>
communities (including Apache, Linux, etc.), I realized the solution <br>
wasn&#39;t workable for one main reason:<br>
<br>
An automated workflow cannot sign builds and still be considered secure.<br=
>
<br>
Builds must be signed by a human on the machine where the build took <br>
place. Automating the signatures in the cloud significantly reduces <br>
trust and greatly increases the likelihood of a bad actor gaining access <b=
r>
to sneak things into the build (e.g., through compromised GitHub <br>
Actions, etc.).<br></blockquote></div></div><div dir=3D"auto"><br></div><di=
v dir=3D"auto">I strongly disagree.</div><div dir=3D"auto"><br></div><div d=
ir=3D"auto">I have way more trust in an automatic build environment with re=
producible (key word here) builds than in a (potentially corruptible) human=
 that pinkie swears no changes were made to an autogenerated configure cont=
ained in released tarballs.</div><div dir=3D"auto"><div class=3D"gmail_quot=
e gmail_quote_container"><blockquote class=3D"gmail_quote" style=3D"margin:=
0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">=
</blockquote></div></div></div>

--000000000000dd6a7d064d114b8a--