From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: Commits signed by key not registered on Savannah Date: Sun, 12 Feb 2017 16:55:14 -0500 Message-ID: <878tpbula5.fsf@netris.org> References: <20170210161608.9175.4763@vcs0.savannah.gnu.org> <20170210161610.BD4DB21058@vcs0.savannah.gnu.org> <8760kh3uvb.fsf_-_@netris.org> <87d1eoa0vb.fsf@netris.org> <877f4w9xwa.fsf@netris.org> <20170212111900.scgyf6q75y7sk2pg@wasp> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:57123) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cd288-000154-1W for guix-devel@gnu.org; Sun, 12 Feb 2017 16:56:25 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cd284-0006rx-Tz for guix-devel@gnu.org; Sun, 12 Feb 2017 16:56:24 -0500 Received: from world.peace.net ([50.252.239.5]:38315) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cd284-0006rs-Pv for guix-devel@gnu.org; Sun, 12 Feb 2017 16:56:20 -0500 In-Reply-To: (David Craven's message of "Sun, 12 Feb 2017 13:26:25 +0100") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: David Craven Cc: guix-devel David Craven writes: > The integrity of our source code is given by peer review - we are > subscribed to the commits ML so we see other peoples commits. If we're concerned about security (and we should be), then we should not rely on the commits mailing list (or any web interface) to show us the same set of commits that have been pushed to the repo. An attacker could prevent some of those emails from reaching us, or modify them in transit to introduce a malicious commit into our repository without it being noticed. It's better to "git pull" and read the commits directly out of our local copy of the git repository. Mark