{"thread":{"id":"28309","subject":"Re: Linux 3.1-rc5","startedAt":"2011-09-05T20:26:39Z","lastAt":"2011-09-07T01:37:50Z","messageCount":3,"participants":["Mauro Carvalho Chehab","Michael J Gruber","Henrique de Moraes Holschuh"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"174885","messageId":"4E65307F.5020103@redhat.com","threadId":"28309","inReplyTo":"CA+55aFxDjVJwbpP5YT4o=qud=OcxtT3Ry4HfCtW-FvNdj+RFeQ@mail.gmail.com","subject":"Re: Linux 3.1-rc5","fromName":"Mauro Carvalho Chehab","fromEmail":"mchehab@redhat.com","sentAt":"2011-09-05T20:26:39Z","receivedAt":"2011-09-05T20:26:39Z","isPatch":false,"sender":{"key":"mchehab@redhat.com","avatar":null},"body":"Em 04-09-2011 20:27, Linus Torvalds escreveu:\n\n> One thing to note: If you just do\n> \n>    git pull https://github.com/torvalds/linux.git\n> \n> you probably won't get the tags, since it's not your origin branch. So do\n> \n>    git fetch --tags<...>\n> \n> too, so that you get not only the actual changes, but the tag that you\n> can verify too.\n> \n\nIt would be great if \"git remote update\" could also verify the tag\nsignature (if present), as most of us just do a \"git remote update\".\n\nMaybe an extra parameter for git config remote.tagopt?\n\nOk, if in doubt, we can always use git tag -v <new tag>, but doing\nit automagically would help us to detect if a git tag got mangled\nby some  at the moment we update our trees, with seems to be\na good idea.\n\nThanks,\nMauro\n"},{"id":"174898","messageId":"4E65CA7B.5050803@drmicha.warpmail.net","threadId":"28309","inReplyTo":"4E65307F.5020103@redhat.com","subject":"Re: Linux 3.1-rc5","fromName":"Michael J Gruber","fromEmail":"git@drmicha.warpmail.net","sentAt":"2011-09-06T07:23:39Z","receivedAt":"2011-09-06T07:23:39Z","isPatch":false,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"Mauro Carvalho Chehab venit, vidit, dixit 05.09.2011 22:26:\n> Em 04-09-2011 20:27, Linus Torvalds escreveu:\n> \n>> One thing to note: If you just do\n>>\n>>    git pull https://github.com/torvalds/linux.git\n>>\n>> you probably won't get the tags, since it's not your origin branch. So do\n>>\n>>    git fetch --tags<...>\n>>\n>> too, so that you get not only the actual changes, but the tag that you\n>> can verify too.\n>>\n> \n> It would be great if \"git remote update\" could also verify the tag\n> signature (if present), as most of us just do a \"git remote update\".\n\n...when you should \"git fetch --all\" ;)\n\n> Maybe an extra parameter for git config remote.tagopt?\n> \n> Ok, if in doubt, we can always use git tag -v <new tag>, but doing\n> it automagically would help us to detect if a git tag got mangled\n> by some  at the moment we update our trees, with seems to be\n> a good idea.\n\nThe update hook (if you want to reject falsified tags) or post-update\nhook (if you want to be warned) is the perfect place for this. It would\nbe worth amending the standard update hook, me thinks, after removing\nits insisting on a project description, and maybe switching the defaults.\n\nMichael\n"},{"id":"174973","messageId":"20110907013750.GA25150@khazad-dum.debian.net","threadId":"28309","inReplyTo":"4E65307F.5020103@redhat.com","subject":"Re: Linux 3.1-rc5","fromName":"Henrique de Moraes Holschuh","fromEmail":"hmh@hmh.eng.br","sentAt":"2011-09-07T01:37:50Z","receivedAt":"2011-09-07T01:37:50Z","isPatch":false,"sender":{"key":"hmh@hmh.eng.br","avatar":null},"body":"On Mon, 05 Sep 2011, Mauro Carvalho Chehab wrote:\n> It would be great if \"git remote update\" could also verify the tag\n> signature (if present), as most of us just do a \"git remote update\".\n\nThat helps, and it really should be all that matter for a power-end-user\nthat just wants to build his kernel from a git tree.\n\nHowever, one can still try to trick someone to base the tree he's going to\nuse for a future pull request on a tree with a rogue commit, in order to\ntry to get the rogue commit into mainline through an indirect path, for\nexample.\n\nYeah, it is very obvious, and not a real major point of concern around\nLKML: we all check the diff, log or shortlog between the tree we're\noffering upstream to pull from) and the current upstream tree for any\nstray commits after all (if only to avoid embarassing mistakes).   And\nupstream does his/her own checks before keeping the merged tree, and so\nforth.\n\nIt's just that the security of the kernel source trees are not a simple\nconsequence of how git works: the workflow matters.  I feel that point\ndeserves to be stressed every once in a while, however obvious it might\nbe.\n\n-- \n  \"One disk to rule them all, One disk to find them. One disk to bring\n  them all and in the darkness grind them. In the Land of Redmond\n  where the shadows lie.\" -- The Silicon Valley Tarot\n  Henrique Holschuh\n"}]}