Re: Commit signing

From: Martin Langhoff <martin.langhoff@gmail.com>
Date: Jan 15, 2007, 18:36 UTC
Message-ID: <46a038f90701151036k7b9ee5e2sdd3bbf6d69f9a27c@mail.gmail.com>
In-Reply-To: <200701151141.51659.andyparkins@gmail.com>

On 1/16/07, Andy Parkins <andyparkins@gmail.com> wrote:

> What about this set of repositories
>
>  Central - Maintainer - Lieutenant - Subsystem Maintainer - Idiot - Vandal

...

>  * Vandal spends one year developing reasonable relationship with Idiot, all
>    patches are good.  Occasional big patches are pulled by Idiot.

If you are using signatures, the trojan horse would make sure he gets his patches signed. What is the advantage again?

>  * Vandal prepares extra big series of commits, with ostensibly good
>    functionality.  In the middle of large series adds one small commit with
>    the committer set to someone other than himself.  In fact, he sets it to be
>    someone he doesn't like.

How about
 - not pulling without review
 - pulling only "own" patches from peripheral developers

> Well yes.  I personally wouldn't bother, but I'm casting myself in the role
> of "paranoid" maintainer for this discussion.

And if you are so paranoid, then you review, and mandate that all patches get a lot of reading ;-) because bugs slip in due to idiocy a whole lot more than because of trojans. Maybe you force patches to be sent to a mailing list, discussed and merged in only if they survive the hard-assed review. Like it happens with git or linux.

Show 8 quoted lines

> The answer is: no, you can't put your 100+X commits in my repository because I
> don't trust the person who wrote X of them.  It is paranoid, and it is
> overkill, but it is also /my/ repository.  It might also be that you are my
> employee and you will do as you are damn well told.
>
> I'm arguing that git should cater for the borderline sociopath as well as the
> well adjusted developer as well.  After all, PHB's need version control
> too :-)

Architecturally, you can't rewrite history just like that -- merge skipping patches isn't possible. You _can_, however, cancel a merge because something looks fishy.

> In the case above, it is the distributed nature of git that causes the
> problem, the original comitter is Idiot, but the repository that the changes
> use to get into central is Maintainer's.

IIRC Linus discussed this early on, and his view was that authorship only gives you false security. The only security is in reviewing code. And that the code-signed patches are dog-slow too.

cheers,

martin