Re: Subscribing Apple people to git-security@googlegroups.com

From: Jeff King <peff@peff.net>
Date: Jul 2, 2018, 19:50 UTC
Message-ID: <20180702195016.GA17102@sigill.intra.peff.net>
In-Reply-To: <CAGba+=U4nbxL2uuSxyqyZqiiavJpo_E=GhUkipz6DczLdmnkgQ@mail.gmail.com>

On Mon, Jul 02, 2018 at 09:29:41PM +0200, Christian Couder wrote:

> When people complained a month ago about the MacOS package on
> https://git-scm.com/ not being up-to-date after the Git security
> release, I got in touch with Apple people GitLab has been working with
> to see if they could help on this.

Unfortunately I don't think this will quite solve the issue we had, just because people get their copy of Git in various ways. So Homebrew updated pretty promptly, but people going to git-scm.com to find a binary package were left without help. Likewise, this will help people getting Git as part of XCode, but not people gettin the package from git-scm.com.

All that said, I'm happy to get as many binary packagers into the loop as early as possible. It can only help, even if it doesn't solve all problems. :)

> Please add these addresses to the git-security mailing list:
>     jeremyhu@apple.com
>     akilsrin@apple.com
>     dt-epm@group.apple.com

Done.

> Please add these GitHub accounts to the cabal repo:
>     jeremyhu

Done.

>     productsecurityOSSapple

I couldn't find that account. Is it maybe a team name within the apple org or something?

> I am also personally very happy with the Apple developers' willingness
> to get involved and help.

Yes, welcome aboard!

I hope that maybe they're also interested in reducing the overall diff between upstream Git and what ships with XCode. Last time I looked (which was admittedly a while ago), a lot of the changes seemed like things that could probably be considered upstream.

-Peff