push right for trivial commits

push right for trivial commits

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 235 bytes --]

Hello,

I finally have my savannah account recovered after forgetting about it
for a year[0]. Can I have push right for trivial commits (e.g. version
bumps)? Do I need to give my GPG key?

[0]: https://savannah.gnu.org/support/?109377

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: push right for trivial commits

[Ludovic Courtès]

[-- Attachment #1: Type: text/plain, Size: 588 bytes --]

Hi Alex,

Alex Vong <alexvong1995@gmail.com> skribis:

> I finally have my savannah account recovered after forgetting about it
> for a year[0]. Can I have push right for trivial commits (e.g. version
> bumps)? Do I need to give my GPG key?

I’ve added you to the group on Savannah, so you now have commit access.

Please upload the OpenPGP key you will use to sign commits to Savannah,
and reply with a message signed with this key.

Also, please read the ‘HACKING’ file, which defines the rules for commit
access.

Thank you, and welcome aboard!  :-)

Ludo’.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: push right for trivial commits

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 1086 bytes --]

Hi Ludo,

ludo@gnu.org (Ludovic Courtès) writes:

> Hi Alex,
>
> Alex Vong <alexvong1995@gmail.com> skribis:
>
>> I finally have my savannah account recovered after forgetting about it
>> for a year[0]. Can I have push right for trivial commits (e.g. version
>> bumps)? Do I need to give my GPG key?
>
> I’ve added you to the group on Savannah, so you now have commit access.
>
> Please upload the OpenPGP key you will use to sign commits to Savannah,
> and reply with a message signed with this key.
>
I receive the following error message when I test my uploaded openpgp
key:

  gpg: keyring `/tmp/tmp.0pv00NrtVS/secring.gpg' created
  gpg: keyring `/tmp/tmp.0pv00NrtVS/pubring.gpg' created
  gpg: key 3AE3FB38: no valid user IDs
  gpg: this may be caused by a missing self-signature
  gpg: Total number processed: 1
  gpg:           w/o user IDs: 1

I'll send a bug report to the Savannah admin.

> Also, please read the ‘HACKING’ file, which defines the rules for commit
> access.
>
> Thank you, and welcome aboard!  :-)
>
:)

> Ludo’.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: push right for trivial commits

[Nils Gillmann]

Alex Vong transcribed 1.5K bytes:
> Hi Ludo,
> 
> ludo@gnu.org (Ludovic Courtès) writes:
> 
> > Hi Alex,
> >
> > Alex Vong <alexvong1995@gmail.com> skribis:
> >
> >> I finally have my savannah account recovered after forgetting about it
> >> for a year[0]. Can I have push right for trivial commits (e.g. version
> >> bumps)? Do I need to give my GPG key?
> >
> > I’ve added you to the group on Savannah, so you now have commit access.
> >
> > Please upload the OpenPGP key you will use to sign commits to Savannah,
> > and reply with a message signed with this key.
> >
> I receive the following error message when I test my uploaded openpgp
> key:
> 
>   gpg: keyring `/tmp/tmp.0pv00NrtVS/secring.gpg' created
>   gpg: keyring `/tmp/tmp.0pv00NrtVS/pubring.gpg' created
>   gpg: key 3AE3FB38: no valid user IDs
>   gpg: this may be caused by a missing self-signature
>   gpg: Total number processed: 1
>   gpg:           w/o user IDs: 1
> 
> I'll send a bug report to the Savannah admin.

Are you by any chance using an EC key?

> > Also, please read the ‘HACKING’ file, which defines the rules for commit
> > access.
> >
> > Thank you, and welcome aboard!  :-)
> >
> :)
> 
> > Ludo’.

Re: push right for trivial commits

[Ludovic Courtès]

Hi Alex,

Alex Vong <alexvong1995@gmail.com> skribis:

> ludo@gnu.org (Ludovic Courtès) writes:

[...]

>> I’ve added you to the group on Savannah, so you now have commit access.
>>
>> Please upload the OpenPGP key you will use to sign commits to Savannah,
>> and reply with a message signed with this key.
>>
> I receive the following error message when I test my uploaded openpgp
> key:

By “uploading”, I meant you have to manually paste the ASCII-armored
output to the Savannah web interface; there’s no key server there.

HTH!

Ludo’.

Re: push right for trivial commits

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 703 bytes --]

ludo@gnu.org (Ludovic Courtès) writes:

> Hi Alex,
>
> Alex Vong <alexvong1995@gmail.com> skribis:
>
>> ludo@gnu.org (Ludovic Courtès) writes:
>
> [...]
>
>>> I’ve added you to the group on Savannah, so you now have commit access.
>>>
>>> Please upload the OpenPGP key you will use to sign commits to Savannah,
>>> and reply with a message signed with this key.
>>>
>> I receive the following error message when I test my uploaded openpgp
>> key:
>
> By “uploading”, I meant you have to manually paste the ASCII-armored
> output to the Savannah web interface; there’s no key server there.
>
Yes, I am using a ECC key. Does it work with Savannah?

> HTH!
>
> Ludo’.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: push right for trivial commits

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 1145 bytes --]

Alex Vong <alexvong1995@gmail.com> writes:

> ludo@gnu.org (Ludovic Courtès) writes:
>
>> Hi Alex,
>>
>> Alex Vong <alexvong1995@gmail.com> skribis:
>>
>>> ludo@gnu.org (Ludovic Courtès) writes:
>>
>> [...]
>>
>>>> I’ve added you to the group on Savannah, so you now have commit access.
>>>>
>>>> Please upload the OpenPGP key you will use to sign commits to Savannah,
>>>> and reply with a message signed with this key.
>>>>
>>> I receive the following error message when I test my uploaded openpgp
>>> key:
>>
>> By “uploading”, I meant you have to manually paste the ASCII-armored
>> output to the Savannah web interface; there’s no key server there.
>>
> Yes, I am using a ECC key. Does it work with Savannah?
>
I should have mentioned that I'd sent a bug report to Savannah:
https://savannah.gnu.org/support/?109583

In the discussion, it was mentioned that the GnuPG version installed on
Savannah is 1.4.16. Therefore, savannah cannot send encrypted messages
to me using my ECC key. However, I am not sure about signing commits
with ECC key. Does it works in Savannah?

>> HTH!
>>
>> Ludo’.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: push right for trivial commits

[Nils Gillmann]

Alex Vong transcribed 1.1K bytes:
> ludo@gnu.org (Ludovic Courtès) writes:
> 
> > Hi Alex,
> >
> > Alex Vong <alexvong1995@gmail.com> skribis:
> >
> >> ludo@gnu.org (Ludovic Courtès) writes:
> >
> > [...]
> >
> >>> I’ve added you to the group on Savannah, so you now have commit access.
> >>>
> >>> Please upload the OpenPGP key you will use to sign commits to Savannah,
> >>> and reply with a message signed with this key.
> >>>
> >> I receive the following error message when I test my uploaded openpgp
> >> key:
> >
> > By “uploading”, I meant you have to manually paste the ASCII-armored
> > output to the Savannah web interface; there’s no key server there.
> >
> Yes, I am using a ECC key. Does it work with Savannah?

At the moment? Not at all.
I've had this discussion with the savannah admin, they expected to
update their gnupg at earliest sometime in 2019.

If you have added the ECC key already it might happen that your
key won't work at all after a correction, so you need to contact
the admin anyway (so that they can fix your key/account).

> > HTH!
> >
> > Ludo’.

Re: push right for trivial commits

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 568 bytes --]

On Tue, Nov 13, 2018 at 09:58:32AM +0800, Alex Vong wrote:
> In the discussion, it was mentioned that the GnuPG version installed on
> Savannah is 1.4.16. Therefore, savannah cannot send encrypted messages
> to me using my ECC key. However, I am not sure about signing commits
> with ECC key. Does it works in Savannah?

Yes, you can still use your ECC key to sign commits. This is a feature
of Git, not Savannah, so it shouldn't matter which version of GnuPG
Savannah is using internally. As far as I know, Savannah doesn't do
anything related to Git commit signing.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: push right for trivial commits

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 1580 bytes --]

Nils Gillmann <ng0@n0.is> writes:

> Alex Vong transcribed 1.1K bytes:
>> ludo@gnu.org (Ludovic Courtès) writes:
>> 
>> > Hi Alex,
>> >
>> > Alex Vong <alexvong1995@gmail.com> skribis:
>> >
>> >> ludo@gnu.org (Ludovic Courtès) writes:
>> >
>> > [...]
>> >
>> >>> I’ve added you to the group on Savannah, so you now have commit access.
>> >>>
>> >>> Please upload the OpenPGP key you will use to sign commits to Savannah,
>> >>> and reply with a message signed with this key.
>> >>>
>> >> I receive the following error message when I test my uploaded openpgp
>> >> key:
>> >
>> > By “uploading”, I meant you have to manually paste the ASCII-armored
>> > output to the Savannah web interface; there’s no key server there.
>> >
>> Yes, I am using a ECC key. Does it work with Savannah?
>
> At the moment? Not at all.
> I've had this discussion with the savannah admin, they expected to
> update their gnupg at earliest sometime in 2019.
>
> If you have added the ECC key already it might happen that your
> key won't work at all after a correction, so you need to contact
> the admin anyway (so that they can fix your key/account).
>
Thanks everyone for the help! I've pushed my 1st commit as
c991806a7d9817c8c204dfd0813144aa0ea96c57. This is the first time I ever
push to a repo not own by myself!

Besides, you can follow this bug report[0] for ECC key support in
Savannah (I'm unaware that Nils previously had discussion with the admin
as well).

>> > HTH!
>> >
>> > Ludo’.

[0]: https://savannah.gnu.org/support/?109583

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: push right for trivial commits

[swedebugia]

On 2018-11-14 06:34, Alex Vong wrote:

snip

> Thanks everyone for the help! I've pushed my 1st commit as
> c991806a7d9817c8c204dfd0813144aa0ea96c57. This is the first time I ever
> push to a repo not own by myself!

Congratulations :D \o/

-- 
Cheers
Swedebugia

Re: push right for trivial commits

[Ludovic Courtès]

Hello,

Nils Gillmann <ng0@n0.is> skribis:

> Alex Vong transcribed 1.1K bytes:
>> ludo@gnu.org (Ludovic Courtès) writes:
>> 
>> > Hi Alex,
>> >
>> > Alex Vong <alexvong1995@gmail.com> skribis:
>> >
>> >> ludo@gnu.org (Ludovic Courtès) writes:
>> >
>> > [...]
>> >
>> >>> I’ve added you to the group on Savannah, so you now have commit access.
>> >>>
>> >>> Please upload the OpenPGP key you will use to sign commits to Savannah,
>> >>> and reply with a message signed with this key.
>> >>>
>> >> I receive the following error message when I test my uploaded openpgp
>> >> key:
>> >
>> > By “uploading”, I meant you have to manually paste the ASCII-armored
>> > output to the Savannah web interface; there’s no key server there.
>> >
>> Yes, I am using a ECC key. Does it work with Savannah?
>
> At the moment? Not at all.

Hmm?  I think it neither works nor doesn’t work with Savannah because
AIUI Savannah simply stores the keys.  Or am I missing something?

Thanks,
Ludo’.

Re: push right for trivial commits

[Nils Gillmann]

Ludovic Courtès transcribed 1.0K bytes:
> Hello,
> 
> Nils Gillmann <ng0@n0.is> skribis:
> 
> > Alex Vong transcribed 1.1K bytes:
> >> ludo@gnu.org (Ludovic Courtès) writes:
> >> 
> >> > Hi Alex,
> >> >
> >> > Alex Vong <alexvong1995@gmail.com> skribis:
> >> >
> >> >> ludo@gnu.org (Ludovic Courtès) writes:
> >> >
> >> > [...]
> >> >
> >> >>> I’ve added you to the group on Savannah, so you now have commit access.
> >> >>>
> >> >>> Please upload the OpenPGP key you will use to sign commits to Savannah,
> >> >>> and reply with a message signed with this key.
> >> >>>
> >> >> I receive the following error message when I test my uploaded openpgp
> >> >> key:
> >> >
> >> > By “uploading”, I meant you have to manually paste the ASCII-armored
> >> > output to the Savannah web interface; there’s no key server there.
> >> >
> >> Yes, I am using a ECC key. Does it work with Savannah?
> >
> > At the moment? Not at all.
> 
> Hmm?  I think it neither works nor doesn’t work with Savannah because
> AIUI Savannah simply stores the keys.  Or am I missing something?
> 
> Thanks,
> Ludo’.
> 
My only experience with savannah and infrastructure of GNU wrt keys is
ftp access.  ftp access is linked to the key you keep in your savannah
profile.
At first I started with an ed25519 key. This lead to the savannah /
ftp admin realizing that ed25519 is not yet supported on the OS and
its gnupg version, and it threw off savannah, required a manual fix of
my profile.

Re: push right for trivial commits

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 550 bytes --]

ludo@gnu.org (Ludovic Courtès) writes:

[...]
>
> Hmm?  I think it neither works nor doesn’t work with Savannah because
> AIUI Savannah simply stores the keys.  Or am I missing something?
>
I think ECC key works with commit signing precisely because commit
signing simply requires Savannah to store the key. However, for
functionalities provided by Savannah (e.g. sending email to your address
encrypted with your ECC public key), it wouldn't work (as mentioned in
<https://savannah.gnu.org/support/?109583>).

> Thanks,
> Ludo’.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: push right for trivial commits

[Ludovic Courtès]

Alex Vong <alexvong1995@gmail.com> skribis:

> ludo@gnu.org (Ludovic Courtès) writes:
>
> [...]
>>
>> Hmm?  I think it neither works nor doesn’t work with Savannah because
>> AIUI Savannah simply stores the keys.  Or am I missing something?
>>
> I think ECC key works with commit signing precisely because commit
> signing simply requires Savannah to store the key. However, for
> functionalities provided by Savannah (e.g. sending email to your address
> encrypted with your ECC public key), it wouldn't work (as mentioned in
> <https://savannah.gnu.org/support/?109583>).

OK, I didn’t know about this feature.  Thanks for explaining!

Ludo’.

Re: push right for trivial commits

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 767 bytes --]

On Thu, Nov 22, 2018 at 04:07:33AM +0800, Alex Vong wrote:
> I think ECC key works with commit signing precisely because commit
> signing simply requires Savannah to store the key. However, for
> functionalities provided by Savannah (e.g. sending email to your address
> encrypted with your ECC public key), it wouldn't work (as mentioned in
> <https://savannah.gnu.org/support/?109583>).

To clarify, Savannah doesn't require you to store any key at all in
order to sign Git commits. I think that Savannah accounts don't
integrate with Git at all; they simply offer hosted Git repositories,
and commit signing is a feature of Git.

We require Guix contributors to upload their keys to their Savannah
account so that there is an authoritative source of signing keys.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: push right for trivial commits

[Alex Vong]

[-- Attachment #1: Type: text/plain, Size: 976 bytes --]

Leo Famulari <leo@famulari.name> writes:

> On Thu, Nov 22, 2018 at 04:07:33AM +0800, Alex Vong wrote:
>> I think ECC key works with commit signing precisely because commit
>> signing simply requires Savannah to store the key. However, for
>> functionalities provided by Savannah (e.g. sending email to your address
>> encrypted with your ECC public key), it wouldn't work (as mentioned in
>> <https://savannah.gnu.org/support/?109583>).
>
> To clarify, Savannah doesn't require you to store any key at all in
> order to sign Git commits. I think that Savannah accounts don't
> integrate with Git at all; they simply offer hosted Git repositories,
> and commit signing is a feature of Git.
>
> We require Guix contributors to upload their keys to their Savannah
> account so that there is an authoritative source of signing keys.

I see, so it's a guix policy rather than a technical
requirement. Indeed, we can download the key from
<https://savannah.gnu.org/users/********>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]