From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2.migadu.com ([2001:41d0:303:e16b::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms13.migadu.com with LMTPS id gJLaA4iR3GZxUwEAe85BDQ:P1 (envelope-from ) for ; Sat, 07 Sep 2024 17:46:48 +0000 Received: from aspmx1.migadu.com ([2001:41d0:303:e16b::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2.migadu.com with LMTPS id gJLaA4iR3GZxUwEAe85BDQ (envelope-from ) for ; Sat, 07 Sep 2024 19:46:48 +0200 X-Envelope-To: larch@yhetil.org Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=famulari.name header.s=mesmtp header.b="h 0e9Vgh"; dkim=pass header.d=messagingengine.com header.s=fm1 header.b=EsEf8pmU; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1725731208; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:in-reply-to:in-reply-to: references:references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:dkim-signature; bh=waa5R8Z7pLW/jfesKZJnVIdeEZf7h0utUXd5G47pvPI=; b=r5Wu+w7idgCjed1k/6GdaHUkBrn/9skXkr17p2Ki9nvfxrcZqK6adpP1I+yoHys41bKmiB tiWhrDQzKpZXsDRaVaiVAJzx/A8zWaeQNlnVv0oagBsTb3fwaxKn7+QVxzJ599ccahyagN xmZTx1s+vJbQ4xA3FxbYSs7jVnO3A7u1pxDg5XbY/srbhLmufRz0HrqaYw7Bvq1qe+ItTF Lkzr6p1DJNrHXgQAd1UL+cko5tlzHFzLB9PBM/9GvnXLk6SHtc1Db9TyfFLfL6H8LJgLS7 S0mQalLGa6zzn6FG+LM4EGLH6QLspbHQbbqvQB7Xb/WQRjZfjf8lPIlR0FXMGQ== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=pass header.d=famulari.name header.s=mesmtp header.b="h 0e9Vgh"; dkim=pass header.d=messagingengine.com header.s=fm1 header.b=EsEf8pmU; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=none ARC-Seal: i=1; s=key1; d=yhetil.org; t=1725731208; a=rsa-sha256; cv=none; b=eyTqBGKI2RY1enux3RIHxNbZzZd32qYh6rOtgi4WUvmkdRnHF4S3l2JUzBivWpPgx+6NVA 4QKUKL0uOf1N1UcB3BwlNEKRUSJd9rdhEELxkjLC+ddYvbR4bzGOF22RuHcqD0RDCbFmUF XgtvasE6/rphQ/JMAfvolEvr7vKEranKuG6t/mV/lkKxjMQ2zZljJlXAk0JMVUljVWGMKm lHMohg5EYSNz4TcZMoGuOJsoOTyzaKd9x1zeIFhvlFY8+vuZPfuPsiR1XFouLgoVvsPpfV 9xFT+buoLEPDHWO5X1oLD038TKD/iHBsXo7kMz5c8lfxPwZeYdkf64Crk4iW0A== Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 4B64A6D2C7 for ; Sat, 07 Sep 2024 19:46:47 +0200 (CEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1smzVc-0006fw-55; Sat, 07 Sep 2024 13:46:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smzVW-0006fP-Tw for guix-devel@gnu.org; Sat, 07 Sep 2024 13:46:01 -0400 Received: from fout4-smtp.messagingengine.com ([103.168.172.147]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1smzVU-0008Vn-Nm; Sat, 07 Sep 2024 13:45:58 -0400 Received: from phl-compute-06.internal (phl-compute-06.phl.internal [10.202.2.46]) by mailfout.phl.internal (Postfix) with ESMTP id 2A8241380216; Sat, 7 Sep 2024 13:45:47 -0400 (EDT) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-06.internal (MEProxy); Sat, 07 Sep 2024 13:45:47 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=cc:cc:content-type:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=mesmtp; t=1725731147; x= 1725817547; bh=waa5R8Z7pLW/jfesKZJnVIdeEZf7h0utUXd5G47pvPI=; b=h 0e9Vghlj+hea+IV+wsPyvxAuL4iyJHtb2mOm6SW+E8DFrEIb5gVnd1AkkYJCqcAP 1ThPFK1h+1hsPu6B7O8YF/tFl8etCa8UM3rVzgUT6ipg4RZyBMkiwXU1YXRvZEMX 6KwIBy1BhIEa0HD22RGGdUlwKN8HyiHpuSE7hZvQ8o= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm1; t=1725731147; x=1725817547; bh=waa5R8Z7pLW/jfesKZJnVIdeEZf7 h0utUXd5G47pvPI=; b=EsEf8pmUMPJ7eq0GiuC7swg8AM2WcuOVnE1q1PPlXgzS NL4+bpTcX9IaCcHWvMTnUzdgVtte4l52R4pNHkd6j8svvDXkL8TkCgztEWBaE+VU 2Ytph5JctND+RjaMEO47nGK6NIvDH1Ak9M+FW6u++BXsTPCdQ2FZxaKYMqDHqyge xlzWeQhdd4u9oPdwCVoX7A5qa5kcuzX6r/n3BJ5iwJaweylyij/RNn4GrdcNJ1QK 3XL7ZxwrYsk7aw6V+vCxz6VhBRJSOsF3WzuaiRcSAGHzEYJjV5/KaAHZn3iagFCX 9jbp5H9aOj0fdhoh3xkgaEtQI2cvklz14k451BeHOg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeeftddrudeifedguddvtdcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdp uffrtefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivg hnthhsucdlqddutddtmdenucfjughrpeffhffvvefukfhfgggtuggjsehttdertddttddv necuhfhrohhmpefnvghoucfhrghmuhhlrghrihcuoehlvghosehfrghmuhhlrghrihdrnh grmhgvqeenucggtffrrghtthgvrhhnpeeiteduheefkeeufeelgeduhfejgfelheefleeu hfeffffgueduleehvdejleeiteenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmh epmhgrihhlfhhrohhmpehlvghosehfrghmuhhlrghrihdrnhgrmhgvpdhnsggprhgtphht thhopeegpdhmohguvgepshhmthhpohhuthdprhgtphhtthhopehvrghgrhgrnhhtseguvg gsihgrnhdrohhrghdprhgtphhtthhopehluhguohesghhnuhdrohhrghdprhgtphhtthho peiiihhmohhnrdhtohhuthhouhhnvgesghhmrghilhdrtghomhdprhgtphhtthhopehguh higidquggvvhgvlhesghhnuhdrohhrgh X-ME-Proxy: Feedback-ID: i819c4023:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sat, 7 Sep 2024 13:45:46 -0400 (EDT) Date: Sat, 7 Sep 2024 13:45:45 -0400 From: Leo Famulari To: Vagrant Cascadian Cc: Ludovic =?iso-8859-1?Q?Court=E8s?= , Simon Tournier , guix-devel Subject: Re: Rebasing commits and =?utf-8?Q?re-sign?= =?utf-8?Q?ing_before_mergeing_=28Was=3A_=E2=80=98core-updates=E2=80=99_is?= =?utf-8?Q?_gone=3B_long_live_=E2=80=98core-packages-team=E2=80=99!=29?= Message-ID: References: <87le0cj13e.fsf@inria.fr> <87v7zby3r6.fsf@gmail.com> <87zfol170t.fsf@gnu.org> <87y144oew9.fsf@wireframe> <87tteso7ag.fsf@wireframe> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87tteso7ag.fsf@wireframe> Received-SPF: pass client-ip=103.168.172.147; envelope-from=leo@famulari.name; helo=fout4-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: guix-devel-bounces+larch=yhetil.org@gnu.org X-Migadu-Country: US X-Migadu-Flow: FLOW_IN X-Migadu-Queue-Id: 4B64A6D2C7 X-Migadu-Scanner: mx13.migadu.com X-Migadu-Spam-Score: -8.68 X-Spam-Score: -8.68 X-TUID: HzkwgQK9QpEL On Fri, Sep 06, 2024 at 01:29:11PM -0700, Vagrant Cascadian wrote: > > In Guix, the "signed-off-by" tag gives credit to the reviewer of the > > patch, but doesn't indicate anything about authority to push to > > guix.git. > > That sounds more like a Reviewed-by tag. > > from doc/contributing.texi: > > When pushing a commit on behalf of somebody else, please add a > @code{Signed-off-by} line at the end of the commit log message---e.g., > with @command{git am --signoff}. This improves tracking of who did > what. We used the signed-off-by tag for years before we started signing commits, so in Guix it has also indicated the person who performed the primary review of the patch / commit. > My understanding of what properly signed commits tell me, at least in > the context of Guix, is that the person who has signed a given commit > has made reasonable efforts to ensure the code works, is freely > licensed, and is not malicious, etc. I see. That's a misconception. The commit signature can only be used as a code-signing authorization tool, to control access to the authoritative copy of the codebase and, transitively, to control access to users' computers. The project leadership does aim to only authorize people they believe will make the efforts you describe above. But in Guix, the requirement to make those efforts is only enforced socially. There are no mechanisms to ensure that the build is not broken on the master branch, etc.