From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: Commits signed by key not registered on Savannah Date: Sun, 12 Feb 2017 18:01:45 -0500 Message-ID: <20170212230145.GA16447@jasmine> References: <20170210161608.9175.4763@vcs0.savannah.gnu.org> <20170210161610.BD4DB21058@vcs0.savannah.gnu.org> <8760kh3uvb.fsf_-_@netris.org> <87d1eoa0vb.fsf@netris.org> <877f4w9xwa.fsf@netris.org> <20170212111900.scgyf6q75y7sk2pg@wasp> <878tpbula5.fsf@netris.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="nFreZHaLTZJo0R7j" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:36217) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cd39U-000810-MZ for guix-devel@gnu.org; Sun, 12 Feb 2017 18:01:54 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cd39R-0006Vx-MB for guix-devel@gnu.org; Sun, 12 Feb 2017 18:01:52 -0500 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:54248) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cd39R-0006Vc-Fh for guix-devel@gnu.org; Sun, 12 Feb 2017 18:01:49 -0500 Content-Disposition: inline In-Reply-To: <878tpbula5.fsf@netris.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mark H Weaver Cc: guix-devel --nFreZHaLTZJo0R7j Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Feb 12, 2017 at 04:55:14PM -0500, Mark H Weaver wrote: > David Craven writes: > > The integrity of our source code is given by peer review - we are > > subscribed to the commits ML so we see other peoples commits. >=20 > If we're concerned about security (and we should be), then we should not > rely on the commits mailing list (or any web interface) to show us the > same set of commits that have been pushed to the repo. An attacker > could prevent some of those emails from reaching us, or modify them in > transit to introduce a malicious commit into our repository without it > being noticed. In fact, the guix-commits mailing list was not sending any messages for a few days recently: http://lists.gnu.org/archive/html/savannah-hackers-public/2017-02/msg00030.= html --nFreZHaLTZJo0R7j Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlig6VUACgkQJkb6MLrK fwiziQ//b3sElGW0/LSSNHL5ZjRoGrxfyzhFJTMiT53D2fahPRauOYWAALQy9eu4 Algb50tWt0z/ObOkrafM+dYEk2X+mo5WXVzIyeDIxMs/7gwCV5hVIqhx0irOgEVz ub6TBLdKUwnIiFtfdqEqZn0JEasEOd0DfadAdvI+kaVqolAzekSwIgYllBnnYn2a HJvnrjVZwMntnhQ8LivOGz97YsvpnMAaGdfxbg7OuM8mk2H7m4WG/1p+3AnnGZsp wmCjdj8vdI/0dFbctOCrmv+n+5RZdOGtejuGvX5YHCSOgGUkxP4zxvE4X4E2NPnH pvjAwrb0ycmwzKk+7vptvrx+IxwD14Rov23MvFo6Jjdcc4GE9lgTwTiChVqTt16O wKGmN6DOZ5qQ0KOrD6BHFQbsaQktjU6AsrBwYUyid+THVMjgLF+9DKAL8CVf7kOb TT7WM7+bw5XGiVHeCp09LiFrTcReIjMoN8TU59oQ134nTFUh8392K0XorcpG6aPP 47prTIsRV9eJ2dO2roXwCQAOuZoq9uQnW6h4ONY9EujkaMXfkwJG1rHQ1yzsCPyK uBoGRm/YH9oK1kT7Y6x60EstkPGH9tE3zwMLDJuZv5jsxXhKZrLEGz1ZS1/Ooism RSl7bj0po16/A6IccYVYhwOleeABPPh6YZ+IcrZLQsaEhNaDBkI= =761h -----END PGP SIGNATURE----- --nFreZHaLTZJo0R7j--