git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [RFC] Authenticate push via PGP signature, not SSH

From
JHJan Hudec <bulb@ucw.cz>
Date
Jan 28, 2008, 21:06 UTC
Message-ID
<20080128210640.GC5788@efreet.light.src>
In-Reply-To
<20080128081258.GE24004@spearce.org>
On Mon, Jan 28, 2008 at 03:12:58 -0500, Shawn O. Pearce wrote:
Show 9 quoted lines
> Sam Vilain <sam@vilain.net> wrote:
> > This does force potential contributors to get PGP keys, and get them
> > signed - but that seems to me to be a reasonable barrier of entry and
> > may even help drive some PGP adoption.
> 
> In many cases today such contributers would have been forced to get
> an SSH account on the server they want to push to.  Getting an SSH
> account configured and a key installed may be more difficult than
> generating a PGP key pair and emailing in the public key.

Actually no. SSH key pair is good enough in current situation. In fact it might be *better* than SSH account, because with SSH account, the user either has or does not have write access, while with SSH key pair he is still subject to limitations enforced by the receive-hook.

> Of course the PGP based system is nicer in that the administrator
> might get a public key that has been signed by others he trusts,
> and thus is more readily able to verify that the contributor is
> who they think it is.

That, however, is an advantage of PGP. Obviously, additional rules can still be enforced by the receive-hook.

-- 
						 Jan 'Bulb' Hudec <bulb@ucw.cz>
Previous: Shawn O. PearceNext: Sam Vilain
Message 3 of 21 in “[RFC] Authenticate push via PGP signature, not SSH”
  1. Sam VilainJan 28, 2008
  2. Shawn O. PearceJan 28, 2008
  3. Jan HudecJan 28, 2008
  4. Sam VilainJan 28, 2008
  5. Shawn O. PearceJan 29, 2008
  6. Shawn O. PearceJan 29, 2008
  7. Pierre HabouzitJan 29, 2008
  8. Shawn O. PearceJan 30, 2008
  9. Sam VilainJan 30, 2008
  10. Shawn O. PearceJan 30, 2008
  11. Pierre HabouzitJan 30, 2008
  12. Sam VilainJan 30, 2008
  13. Johannes SixtJan 30, 2008
  14. Shawn O. PearceJan 31, 2008
  15. Pierre HabouzitJan 30, 2008
  16. Shawn O. PearceJan 31, 2008
  17. Pierre HabouzitJan 31, 2008
  18. Sam VilainJan 30, 2008
  19. Shawn O. PearceJan 30, 2008
  20. Sam VilainJan 31, 2008
  21. Pierre HabouzitJan 28, 2008

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.