From: "Marvin Häuser" <mhaeuser@posteo.de>
To: devel@edk2.groups.io, pedro.falcato@gmail.com
Subject: Re: [edk2-devel] Question about EDK2 and commit signing
Date: Sun, 12 Sep 2021 09:53:34 +0000 [thread overview]
Message-ID: <7752ca61-c66a-2667-7c3d-ab2eb10105b7@posteo.de> (raw)
In-Reply-To: <CAKbZUD0-HoxnWG0ZpK9xhHxTxzX6Oif30-XVskznFVThu+SNZQ@mail.gmail.com>
Hey,
Just my 2 cents...
Contributors: Git's stance is the author doesn't really matter as long
as the code is acceptable. For most people, you will not know them
anyway and it does not buy you much to know they own GitHub account XY.
If someone is impersonating a maintainer (who would push the changes
directly after review), that would be obvious anyway.
Maintainers: Why would someone have access to your SSH key but not your
GPG key? Especially if your commits are auto-signed, both keys are
likely equally readable. More factors do not meaningfully increase
security if they are not clearly separate.
I'm sure nobody minds your signatures though. :)
Best regards,
Marvin
On 11/09/2021 20:25, Pedro Falcato wrote:
> Hi everyone,
>
> Yesterday, when pushing my first commits to edk2-platforms (as the
> Ext4Pkg maintainer), I noticed that my commits (see 7872c98 and
> 71f3343) stick out like a sore thumb, as I have GPG signing on my
> commits on by default (see git config commit.gpgsign), globally across
> all my projects.
>
> Is there an official stance on signed commits? I was thinking that
> commit signing, at least for the maintainers that apply and push
> patches, could be useful as a way to establish authenticity for every
> commit that gets to the edk2 repos.
>
> Best regards,
>
> Pedro Falcato
>
>
>
>
>
next prev parent reply other threads:[~2021-09-12 9:53 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-11 18:25 Question about EDK2 and commit signing Pedro Falcato
2021-09-11 21:48 ` [edk2-devel] " James Bottomley
2021-09-12 9:53 ` Marvin Häuser [this message]
2021-09-13 16:50 ` Pedro Falcato
2021-09-13 19:31 ` Marvin Häuser
2021-09-14 18:02 ` James Bottomley
2021-09-14 20:18 ` Marvin Häuser
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7752ca61-c66a-2667-7c3d-ab2eb10105b7@posteo.de \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox