{"thread":{"id":"19275","subject":"Re: Distributed VCS with good user verification?","startedAt":"2009-05-10T19:59:07Z","lastAt":"2009-05-10T19:59:07Z","messageCount":1,"participants":["Yann Dirson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"113482","messageId":"20090510195907.GA5994@nan92-1-81-57-214-146.fbx.proxad.net","threadId":"19275","inReplyTo":"20090505212420.GC2761-KgLppkx3sYOz9XH0brcyGRf3AA1FrM/fXqFh9Ls21Oc@public.gmane.org","subject":"Re: Distributed VCS with good user verification?","fromName":"Yann Dirson","fromEmail":"ydirson-whniv8geegkdnm+yrofe0a@public.gmane.org","sentAt":"2009-05-10T19:59:07Z","receivedAt":"2009-05-10T19:59:07Z","isPatch":false,"sender":{"key":"ydirson-whniv8geegkdnm+yrofe0a@public.gmane.org","avatar":null},"body":"On Tue, May 05, 2009 at 11:24:20PM +0200, Lasse Kliemann wrote:\n> This list hasn't seen any traffic for over a year, but since \n> usually no-one unsubscribes from a list with no traffic, I hope \n> someone will read this.\n> \n> \n> I am looking for a VCS that makes it easy to see who committed \n> which revision and to be certain that this information is \n> correct.\n> \n> When I look at the commit log, I want to see at a glance who \n> committed which revision. I want to be sure that those names \n> displayed are really meaningful. That is, it should be guaranteed \n> that in fact that person which I associate with the displayed \n> name has committed the respective revision.\n> \n> In Subversion, a centralized VCS, this can be ensured by \n> correctly setting '--tunnel-user=USER' on the server, when using \n> SSH. Then, a user authenticates himself by his SSH key, then the \n> SSH server picks the corresponding entry in \n> '~/.ssh/authorized_keys', and this will cause the intended user \n> name to be recorded as the committer.\n> \n> In a distributed VCS, this is no option since commits happen \n> locally. Instead, revisions must be cryptographically signed.  \n> However, signing is not everything. In addition, signatures must \n> be verified, and the commit log should reflect which commits have \n> valid signatures and wich not.\n\n\nIf you're only relying on an ssh tunnel for svn, I suppose it should\nbe OK for you as well to use this mechanism with a DSCM.  If so,\ngitosis provides the necessay infrastucture to do so comfortably on\ntop of git (gitosis upstream does not seem very active, but there is\nat least one gentoo person writing patches, and I registered a mirror\nof his repository as a fork on http://repo.or.cz/w/gitosis.git.  FWIW,\nI have started to make a couple of cleanups of this code recently, and\nwill push them as another fork shortly).\n\nOTOH, it does enforce a centralized verification scheme.  If you want\nsomething more flexible, I believe that could easily be done on top of\ncommit notes (development for that feature has unfortunately stalled\nAFAIK).  I'm cc'ing the git list so others have the opportunity to\ncomment.\n\n> \n> I tested several systems in this respect without finding any 100% \n> satisfactory solution.\n> \n> Here is what I found:\n> \n> - Mercurial provides an extension to explicitly sign certain \n>   revisions. The act of signing creates a new revision by itself. \n>   It seems like there is no way of automatically checking all \n>   signatures or to detect revisions without signatures.\n> \n> - Git only allows to sign tags and to verify those signatures on \n>   demand.\n> \n> - Monotone has mandatory signatures, which looks rather good to \n>   me. However, the monotone server does not support encryption \n>   and also does not seem to support SSH tunneling in a convenient \n>   way (like most other systems, by calling 'ssh'), but only by a \n>   \"real\" tunnel (opening a local port and such). So, \n>   unfortunately, monotone is ruled out by this other criterion.\n> \n> - Bazaar can sign revisions, and it can be told to sign each and \n>   every revision upon commit. However, I did not find any \n>   built-in way to check signatures. There is an option \n>   'check_signatures' which can be set to 'required', but I could \n>   not find out what it does actually. It is not documented.\n> \n>   There is a plugin for Bazaar, however, with which one can get \n>   statistics on how many revisions are signed and which \n>   signatures cause problems. When this statistics says that \n>   everything is signed and okay, then one can trust the user \n>   names in the commit log.\n> \n> Bottom line is that Bazaar is closest to my needs, but not yet 100%.\n> \n> Suggestions?\n> \n> Thank you!\n> Lasse\n> \n\n\n\n> _______________________________________________\n> Better-scm-discuss mailing list\n> Better-scm-discuss-0fE9KPoRgkgATYTw5x5z8w@public.gmane.org\n> https://lists.berlios.de/mailman/listinfo/better-scm-discuss\n"}]}