{"thread":{"id":"41210","subject":"Don't use PGP/GPG signatures in mail that contains patches","startedAt":"2016-01-18T01:27:15Z","lastAt":"2016-01-19T21:05:47Z","messageCount":4,"participants":["Andrey Utkin","Jeff King","Eric Wong"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"276264","messageId":"569C3F73.3090805@pb.com","threadId":"41210","inReplyTo":null,"subject":"Don't use PGP/GPG signatures in mail that contains patches","fromName":"Andrey Utkin","fromEmail":"andrey.utkin@pb.com","sentAt":"2016-01-18T01:27:15Z","receivedAt":"2016-01-18T01:27:15Z","isPatch":false,"sender":{"key":"andrey.utkin@pb.com","avatar":null},"body":"\n________________________________\n\n\n\n===== QUOTE =====\nDon't use PGP/GPG signatures in mail that contains patches.\nThis breaks many scripts that read and apply the patches.\n(This should be fixable.)\n===== END QUOTE =====\n\nThis is in Linux' Documentation/email-clients.txt since 2007, and still\nalmost nobody signs patch submissions. There are few brave people who\ndo, though, and seems it's not the end of world for any \"scripts\".\nThe broken scripts could be an excuse in 2007, but not today.\n\nProposal:\n1. Implement signing option in git-send-email.\n2. Figure out if anything fails to interoperate.\n3. Drop the quoted statement or change it to appreciate signing.\n\n"},{"id":"276313","messageId":"20160118214857.GA24136@sigill.intra.peff.net","threadId":"41210","inReplyTo":"569C3F73.3090805@pb.com","subject":"Re: Don't use PGP/GPG signatures in mail that contains patches","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2016-01-18T21:48:58Z","receivedAt":"2016-01-18T21:48:58Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Mon, Jan 18, 2016 at 03:27:15AM +0200, Andrey Utkin wrote:\n\n> ===== QUOTE =====\n> Don't use PGP/GPG signatures in mail that contains patches.\n> This breaks many scripts that read and apply the patches.\n> (This should be fixable.)\n> ===== END QUOTE =====\n> \n> This is in Linux' Documentation/email-clients.txt since 2007, and still\n> almost nobody signs patch submissions. There are few brave people who\n> do, though, and seems it's not the end of world for any \"scripts\".\n> The broken scripts could be an excuse in 2007, but not today.\n> \n> Proposal:\n> 1. Implement signing option in git-send-email.\n> 2. Figure out if anything fails to interoperate.\n> 3. Drop the quoted statement or change it to appreciate signing.\n\nI don't know about other receiving scripts, but \"git am\" will handle\nsigned PGP-MIME out of the box (I didn't try it with inline signatures,\nbut I imagine it would stick the \"BEGIN PGP MESSAGE\" cruft into the\ncommit message).\n\nHowever, there's an open question of what to _do_ with such a signature.\nThe email signature does not function as a valid git commit signature.\nSo you are left with one of:\n\n 1. The receiver can verify the origin of the email before applying the\n patch.\n\n 2. The receiver can keep a copy of the email \"somewhere\", so people\n can later re-verify it, and then hand-verify that it matches what\n got applied.\n\n That \"somewhere\" may just be a mailing list archive, but you could\n get fancy with scripts and associate it with the applied commit\n (e.g., using \"git notes\").\n\nBut those are really questions for the project. If you are mailing your\npatches to Linus, does he actually care about (1)? My general impression\nof his past opinion is that it's more important to read the patch text\nthan the \"From\" line. Of course subsystem maintainers and other projects\nmay have different opinions.\n\nI think (2) is more compelling, if only to create a better record in the\nmailing list archive. Assuming the receivers of your patches don't mind\n(and I know some people really _don't_ like things like PGP-MIME,\nbecause their mail readers are not good at replying in-line to the\npatches then), I don't it would be a bad thing to teach git-send-email\nan option to send it.\n\n-Peff\n"},{"id":"276341","messageId":"569E2398.2050206@gmail.com","threadId":"41210","inReplyTo":"20160118214857.GA24136@sigill.intra.peff.net","subject":"Re: Don't use PGP/GPG signatures in mail that contains patches","fromName":"Andrey Utkin","fromEmail":"andrey.od.utkin@gmail.com","sentAt":"2016-01-19T11:52:56Z","receivedAt":"2016-01-19T11:52:56Z","isPatch":false,"sender":{"key":"andrey.od.utkin@gmail.com","avatar":null},"body":"On 18.01.2016 23:48, Jeff King wrote:\n> I don't know about other receiving scripts, but \"git am\" will handle\n> signed PGP-MIME out of the box (I didn't try it with inline signatures,\n> but I imagine it would stick the \"BEGIN PGP MESSAGE\" cruft into the\n> commit message).\n> \n> However, there's an open question of what to _do_ with such a signature.\n> The email signature does not function as a valid git commit signature.\n> So you are left with one of:\n> \n> 1. The receiver can verify the origin of the email before applying the\n> patch.\n> \n> 2. The receiver can keep a copy of the email \"somewhere\", so people\n> can later re-verify it, and then hand-verify that it matches what\n> got applied.\n> \n> That \"somewhere\" may just be a mailing list archive, but you could\n> get fancy with scripts and associate it with the applied commit\n> (e.g., using \"git notes\").\n> \n> But those are really questions for the project. If you are mailing your\n> patches to Linus, does he actually care about (1)? My general impression\n> of his past opinion is that it's more important to read the patch text\n> than the \"From\" line. Of course subsystem maintainers and other projects\n> may have different opinions.\n> \n> I think (2) is more compelling, if only to create a better record in the\n> mailing list archive. Assuming the receivers of your patches don't mind\n> (and I know some people really _don't_ like things like PGP-MIME,\n> because their mail readers are not good at replying in-line to the\n> patches then), I don't it would be a bad thing to teach git-send-email\n> an option to send it.\n\nThank you for thoughtful reply!\nSurely email submission signature cannot be used as git commit\nsignature. And surely there are issues of usability. And surely people\nare used not to care.\nBut still, if we encourage signing maillist correspondence, we would\navoid impersonation attacks. Imagine that somebody sends stupid\nsubmissions from your name, maintainers shout at you, and your\nreputataion is... changed. Of course, you will be able to sort things\nout after you read the replies and reply that it's not you. But, given\nto openness of maillists, the attacker is able to follow your replies\nand insert his ones. Or to reply to your valid submissions that they are\nnot from you.\nStill it seems that making fun of that is not much harder than\nmasquerading on GitHub\n(https://github.com/amoffat/masquerade/commit/9b0562595cc479ac8696110cb0a2d33f8f2b7d29)\nSure there are anti-spoofing measures like DKIM. Honestly I am not aware\nif vger.kernel.org is so restrictive that it accepts only letters from\nsuper-safe email servers, but I guess it is not, because not everybody\nhas this stuff configured on their email servers.\n\n"},{"id":"276364","messageId":"20160119210547.GA2822@dcvr.yhbt.net","threadId":"41210","inReplyTo":"569E2398.2050206@gmail.com","subject":"Re: Don't use PGP/GPG signatures in mail that contains patches","fromName":"Eric Wong","fromEmail":"normalperson@yhbt.net","sentAt":"2016-01-19T21:05:47Z","receivedAt":"2016-01-19T21:05:47Z","isPatch":false,"sender":{"key":"e@80x24.org","avatar":null},"body":"Andrey Utkin wrote:\n> But still, if we encourage signing maillist correspondence, we would\n> avoid impersonation attacks. Imagine that somebody sends stupid\n> submissions from your name, maintainers shout at you, and your\n> reputataion is... changed. Of course, you will be able to sort things\n> out after you read the replies and reply that it's not you. But, given\n> to openness of maillists, the attacker is able to follow your replies\n> and insert his ones. Or to reply to your valid submissions that they are\n> not from you.\n\nIs impersonation an actual problem on vger.kernel.org lists?\nReply-to-all conventions on these lists do a great deal to discourage them.\n"}]}