From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Wingo Subject: Re: =?utf-8?Q?=E2=80=98core-updates=E2=80=99?= merge is a squashed commit Date: Fri, 05 Aug 2016 09:35:59 +0200 Message-ID: <874m6zmzvk.fsf@igalia.com> References: <878twd20ui.fsf@gnu.org> <20160803183911.GC11621@jasmine> <87wpjxy4ta.fsf_-_@gnu.org> <20160803211032.GA6034@jasmine> <87a8gtyntw.fsf@netris.org> <20160804082400.GA1638@solar> <87ziosyalv.fsf@netris.org> <87a8gso9p4.fsf@igalia.com> <20160804164453.GB8137@jasmine> <87a8gsmq2h.fsf@igalia.com> <20160804200519.GA14007@jasmine> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:53665) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVZfs-00049K-D5 for guix-devel@gnu.org; Fri, 05 Aug 2016 03:36:09 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bVZfp-0006il-6q for guix-devel@gnu.org; Fri, 05 Aug 2016 03:36:08 -0400 Received: from pb-sasl2.pobox.com ([64.147.108.67]:65335 helo=sasl.smtp.pobox.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVZfp-0006ho-39 for guix-devel@gnu.org; Fri, 05 Aug 2016 03:36:05 -0400 In-Reply-To: <20160804200519.GA14007@jasmine> (Leo Famulari's message of "Thu, 4 Aug 2016 16:05:19 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org On Thu 04 Aug 2016 22:05, Leo Famulari writes: > On Thu, Aug 04, 2016 at 06:55:34PM +0200, Andy Wingo wrote: >> On Thu 04 Aug 2016 18:44, Leo Famulari writes: >> >> > How would the rest of us distinguish between >> > >> > 1) a range of your commits with a signed HEAD >> > 2) a range of your commits with a signed HEAD that you pushed after I >> > pushed a commit created with `git commit --author="Andy Wingo" >> >> I'm not sure what the threat model here is, and surely this is mostly >> because I am ignorant :) Would you mind elaborating a bit more? > > I admit, the example is really contrived. > > My point is that, as far as I know, there is no way to know who exactly > is behind an unsigned Git commit. > > The "Author" and "Commit" information seen in `git log --format=full` is > trivially forged, for example by altering the [user] field of your Git > configuration file. Yeah. I guess I don't see see "author misattribution on unsigned commits" as part of the threat model. My mental model is that if you have a signed commit A with unsigned parents B, C, ..., that it's the person who signed commit A who signs off on commits B, C, and so on. That person attests to the integrity of that range of commits, *including* the author field(s). If you sign a HEAD which brings in an unsigned commit that you (or someone else) forged to use me (say) as --author, it's true, I can claim not to have made it. But that seems a bit irrelevant to any property we care about; dunno... Andy